From 1d3e7ddae2155c244f21b897496da34e8f2b372a Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 11:58:01 -0500
Subject: [PATCH 01/14] update 8.8 docs

---
 ...ebuilt-rules-downloadable-updates.asciidoc |    3 +-
 .../prebuilt-rules-reference.asciidoc         | 1718 ++++++++++-------
 .../prebuilt-rules/rule-desc-index.asciidoc   |  187 +-
 .../a-scheduled-task-was-created.asciidoc     |   73 +-
 .../a-scheduled-task-was-updated.asciidoc     |   85 +-
 ...l-process-id-or-lock-file-created.asciidoc |  136 +-
 .../abnormally-large-dns-response.asciidoc    |  100 +-
 ...ed-default-telnet-port-connection.asciidoc |  113 +-
 ...ess-of-stored-browser-credentials.asciidoc |  101 +-
 ...ess-to-a-sensitive-ldap-attribute.asciidoc |   69 +-
 ...-keychain-credentials-directories.asciidoc |  143 +-
 ...ured-with-never-expiring-password.asciidoc |   82 +-
 ...covery-command-via-system-account.asciidoc |  175 +-
 ...roup-discovery-via-built-in-tools.asciidoc |   86 +
 .../account-password-reset-remotely.asciidoc  |  121 +-
 ...-hidden-file-attribute-via-attrib.asciidoc |  166 +-
 .../adfind-command-activity.asciidoc          |  169 +-
 ...vileges-assigned-to-an-okta-group.asciidoc |   71 +-
 ...tor-role-assigned-to-an-okta-user.asciidoc |   62 +-
 .../adminsdholder-backdoor.asciidoc           |   50 +-
 ...insdholder-sdprop-exclusion-added.asciidoc |   98 +-
 .../adobe-hijack-persistence.asciidoc         |  153 +-
 ...behavior-detected-elastic-endgame.asciidoc |   63 +-
 ...gent-spoofing-mismatched-agent-id.asciidoc |   43 +-
 ...g-multiple-hosts-using-same-agent.asciidoc |   40 +-
 ...anomalous-linux-compiler-activity.asciidoc |   56 +-
 ...us-process-for-a-linux-population.asciidoc |  114 +-
 ...-process-for-a-windows-population.asciidoc |  145 +-
 ...nomalous-windows-process-creation.asciidoc |  121 +-
 ...on-followed-by-network-connection.asciidoc |   86 +-
 ...ion-with-administrator-privileges.asciidoc |   56 +-
 ...-added-to-google-workspace-domain.asciidoc |  128 +-
 ...rom-blocklist-in-google-workspace.asciidoc |  104 +-
 .../attempt-to-create-okta-api-token.asciidoc |   72 +-
 ...to-deactivate-an-okta-application.asciidoc |   91 +-
 ...o-deactivate-an-okta-network-zone.asciidoc |   93 +-
 ...to-deactivate-an-okta-policy-rule.asciidoc |  112 +-
 ...empt-to-deactivate-an-okta-policy.asciidoc |  111 +-
 ...vate-mfa-for-an-okta-user-account.asciidoc |   72 +-
 ...mpt-to-delete-an-okta-application.asciidoc |   64 +-
 ...pt-to-delete-an-okta-network-zone.asciidoc |   93 +-
 ...mpt-to-delete-an-okta-policy-rule.asciidoc |  100 +-
 .../attempt-to-delete-an-okta-policy.asciidoc |  111 +-
 .../attempt-to-disable-gatekeeper.asciidoc    |   54 +-
 ...t-to-disable-iptables-or-firewall.asciidoc |   77 +
 ...attempt-to-disable-syslog-service.asciidoc |   83 +-
 ...ttempt-to-enable-the-root-account.asciidoc |   49 +-
 ...mpt-to-install-kali-linux-via-wsl.asciidoc |   71 +
 ...tempt-to-install-root-certificate.asciidoc |   62 +-
 ...mpt-to-modify-an-okta-application.asciidoc |   64 +-
 ...pt-to-modify-an-okta-network-zone.asciidoc |  124 +-
 ...mpt-to-modify-an-okta-policy-rule.asciidoc |  119 +-
 .../attempt-to-modify-an-okta-policy.asciidoc |  102 +-
 ...-mount-smb-share-via-command-line.asciidoc |   75 +-
 ...-remove-file-quarantine-attribute.asciidoc |   87 +-
 ...-factors-for-an-okta-user-account.asciidoc |   72 +-
 .../attempt-to-revoke-okta-api-token.asciidoc |   94 +-
 ...ndpoint-security-kernel-extension.asciidoc |   55 +-
 .../attempted-bypass-of-okta-mfa.asciidoc     |  106 +-
 ...orce-a-microsoft-365-user-account.asciidoc |  109 +-
 ...-brute-force-an-okta-user-account.asciidoc |   99 +-
 ...authorization-plugin-modification.asciidoc |   60 +-
 .../aws-cloudtrail-log-created.asciidoc       |   78 +-
 .../aws-cloudtrail-log-deleted.asciidoc       |  114 +-
 .../aws-cloudtrail-log-suspended.asciidoc     |  111 +-
 .../aws-cloudtrail-log-updated.asciidoc       |  115 +-
 .../aws-cloudwatch-alarm-deletion.asciidoc    |  103 +-
 ...aws-cloudwatch-log-group-deletion.asciidoc |  117 +-
 ...ws-cloudwatch-log-stream-deletion.asciidoc |  117 +-
 .../aws-config-resource-deletion.asciidoc     |  116 +-
 ...ws-configuration-recorder-stopped.asciidoc |   79 +-
 ...s-searched-for-inside-a-container.asciidoc |   70 +
 ...letion-of-rds-instance-or-cluster.asciidoc |   97 +-
 .../aws-ec2-encryption-disabled.asciidoc      |   79 +-
 ...l-network-packet-capture-detected.asciidoc |   71 +-
 ...work-access-control-list-creation.asciidoc |   80 +-
 ...work-access-control-list-deletion.asciidoc |   84 +-
 .../aws-ec2-snapshot-activity.asciidoc        |  101 +-
 .../aws-ec2-vm-export-failure.asciidoc        |   58 +-
 ...-efs-file-system-or-mount-deleted.asciidoc |   70 +-
 ...lasticache-security-group-created.asciidoc |   69 +-
 ...ecurity-group-modified-or-deleted.asciidoc |   74 +-
 ...ntbridge-rule-disabled-or-deleted.asciidoc |   69 +-
 .../aws-execution-via-system-manager.asciidoc |  111 +-
 .../aws-guardduty-detector-deletion.asciidoc  |   82 +-
 ...aws-iam-assume-role-policy-update.asciidoc |  102 +-
 ...brute-force-of-assume-role-policy.asciidoc |  111 +-
 ...ws-iam-deactivation-of-mfa-device.asciidoc |   97 +-
 .../aws-iam-group-creation.asciidoc           |   82 +-
 .../aws-iam-group-deletion.asciidoc           |   74 +-
 ...s-iam-password-recovery-requested.asciidoc |   75 +-
 .../aws-iam-user-addition-to-group.asciidoc   |  103 +-
 ...isabled-or-scheduled-for-deletion.asciidoc |   41 +-
 ...brute-force-of-root-user-identity.asciidoc |   61 +-
 ...aws-management-console-root-login.asciidoc |  100 +-
 .../aws-rds-cluster-creation.asciidoc         |   82 +-
 ...aws-rds-instance-cluster-stoppage.asciidoc |   74 +-
 .../aws-rds-instance-creation.asciidoc        |   62 +-
 .../aws-rds-security-group-creation.asciidoc  |   64 +-
 .../aws-rds-security-group-deletion.asciidoc  |   60 +-
 .../aws-rds-snapshot-export.asciidoc          |   56 +-
 .../aws-rds-snapshot-restored.asciidoc        |   68 +-
 .../aws-redshift-cluster-creation.asciidoc    |   55 +-
 .../aws-root-login-without-mfa.asciidoc       |  106 +-
 ...-53-domain-transfer-lock-disabled.asciidoc |   57 +-
 ...in-transferred-to-another-account.asciidoc |   58 +-
 .../aws-route-table-created.asciidoc          |   71 +-
 ...s-route-table-modified-or-deleted.asciidoc |   65 +-
 ...hosted-zone-associated-with-a-vpc.asciidoc |   61 +-
 ...-s3-bucket-configuration-deletion.asciidoc |   82 +-
 .../rule-details/aws-saml-activity.asciidoc   |   70 +-
 ...up-configuration-change-detection.asciidoc |   93 +-
 ...oken-service-sts-assumerole-usage.asciidoc |   76 +-
 .../aws-sts-getsessiontoken-abuse.asciidoc    |   69 +-
 .../aws-vpc-flow-logs-deletion.asciidoc       |  111 +-
 ...-waf-access-control-list-deletion.asciidoc |   82 +-
 ...s-waf-rule-or-rule-group-deletion.asciidoc |   92 +-
 ...ctive-directory-high-risk-sign-in.asciidoc |   85 +-
 ...-high-risk-user-sign-in-heuristic.asciidoc |   72 +-
 ...tive-directory-powershell-sign-in.asciidoc |   98 +-
 ...lobal-administrator-role-assigned.asciidoc |   63 +-
 ...pression-rule-created-or-modified.asciidoc |   65 +-
 ...plication-credential-modification.asciidoc |   67 +-
 .../azure-automation-account-created.asciidoc |   80 +-
 ...ation-runbook-created-or-modified.asciidoc |   87 +-
 .../azure-automation-runbook-deleted.asciidoc |   95 +-
 .../azure-automation-webhook-created.asciidoc |   83 +-
 ...ntainer-access-level-modification.asciidoc |   82 +-
 ...ure-blob-permissions-modification.asciidoc |   70 +-
 ...mand-execution-on-virtual-machine.asciidoc |   80 +-
 ...onditional-access-policy-modified.asciidoc |   82 +-
 ...zure-diagnostic-settings-deletion.asciidoc |   83 +-
 ...orization-rule-created-or-updated.asciidoc |   84 +-
 .../azure-event-hub-deletion.asciidoc         |   87 +-
 ...re-external-guest-user-invitation.asciidoc |   77 +-
 .../azure-firewall-policy-deletion.asciidoc   |   86 +-
 ...ation-firewall-waf-policy-deleted.asciidoc |   61 +-
 ...l-network-packet-capture-detected.asciidoc |   70 +-
 ...strator-role-addition-to-pim-user.asciidoc |   87 +-
 .../azure-key-vault-modified.asciidoc         |   83 +-
 .../azure-kubernetes-events-deleted.asciidoc  |   75 +-
 .../azure-kubernetes-pods-deleted.asciidoc    |   66 +-
 ...e-kubernetes-rolebindings-created.asciidoc |   66 +-
 .../azure-network-watcher-deletion.asciidoc   |   86 +-
 ...identity-management-role-modified.asciidoc |   98 +-
 .../azure-resource-group-deletion.asciidoc    |   86 +-
 .../azure-service-principal-addition.asciidoc |   95 +-
 ...rvice-principal-credentials-added.asciidoc |   63 +-
 ...e-storage-account-key-regenerated.asciidoc |   80 +-
 ...etwork-device-modified-or-deleted.asciidoc |  108 +-
 ...base32-encoding-decoding-activity.asciidoc |   75 +-
 .../bash-shell-profile-modification.asciidoc  |   90 +-
 ...uted-from-shared-memory-directory.asciidoc |   81 +-
 .../bpf-filter-applied-using-tc.asciidoc      |   53 +-
 .../bypass-uac-via-event-viewer.asciidoc      |  179 +-
 .../bypass-uac-via-sdclt.asciidoc             |   78 +
 .../chkconfig-service-add.asciidoc            |   63 +-
 .../clearing-windows-console-history.asciidoc |  109 +-
 .../clearing-windows-event-logs.asciidoc      |  178 +-
 ...strike-command-and-control-beacon.asciidoc |   83 +-
 ...dification-through-built-in-tools.asciidoc |  124 ++
 ...icy-modification-through-registry.asciidoc |  127 ++
 ...-execution-via-solarwinds-process.asciidoc |   94 +-
 ...command-prompt-network-connection.asciidoc |  166 +-
 ...ell-activity-started-via-rundll32.asciidoc |   99 +-
 .../component-object-model-hijacking.asciidoc |  251 +--
 ...ion-dll-loaded-by-unusual-process.asciidoc |   68 +
 ...wned-by-suspicious-parent-process.asciidoc |  129 +-
 ...ed-free-ssl-certificate-providers.asciidoc |   97 +-
 ...n-to-commonly-abused-web-services.asciidoc |  362 +---
 ...on-to-external-network-via-telnet.asciidoc |  101 +-
 ...on-to-internal-network-via-telnet.asciidoc |  101 +-
 ...nt-utility-run-inside-a-container.asciidoc |   60 +
 .../container-workload-protection.asciidoc    |   45 +
 ...el-process-with-unusual-arguments.asciidoc |  106 +-
 ...on-of-a-hidden-local-user-account.asciidoc |   79 +-
 ...s-and-directories-via-commandline.asciidoc |   97 +-
 ...-of-hidden-launch-agent-or-daemon.asciidoc |   84 +-
 ...idden-login-item-via-apple-script.asciidoc |   63 +-
 ...tion-of-hidden-shared-object-file.asciidoc |   54 +-
 ...new-gpo-scheduled-task-or-service.asciidoc |   93 +-
 ...f-domain-backup-dpapi-private-key.asciidoc |   87 +-
 ...-modification-of-root-certificate.asciidoc |  165 +-
 ...isition-via-registry-hive-dumping.asciidoc |  133 +-
 ...-dumping-detected-elastic-endgame.asciidoc |   66 +-
 ...dumping-prevented-elastic-endgame.asciidoc |   66 +-
 ...pulation-detected-elastic-endgame.asciidoc |   64 +-
 ...ulation-prevented-elastic-endgame.asciidoc |   64 +-
 ...ged-by-previously-unknown-process.asciidoc |   95 +
 ...-privileged-access-security-error.asciidoc |   52 +-
 ...cess-security-recommended-monitor.asciidoc |   60 +-
 ...lt-strike-team-server-certificate.asciidoc |   88 +-
 ...te-volume-usn-journal-with-fsutil.asciidoc |  146 +-
 ...ting-backup-catalogs-with-wbadmin.asciidoc |  131 +-
 .../direct-outbound-smb-connection.asciidoc   |  177 +-
 ...ecurity-logs-using-built-in-tools.asciidoc |  141 +-
 ...-windows-firewall-rules-via-netsh.asciidoc |  137 +-
 ...control-via-registry-modification.asciidoc |  124 +-
 ...-security-settings-via-powershell.asciidoc |  108 +-
 ...s-over-https-enabled-via-registry.asciidoc |   70 +-
 .../rule-details/dns-tunneling.asciidoc       |   51 +-
 ...-google-workspace-trusted-domains.asciidoc |  129 +-
 .../downloaded-shortcut-files.asciidoc        |   88 +
 .../downloaded-url-files.asciidoc             |   83 +
 ...ount-hashes-via-built-in-commands.asciidoc |   46 +-
 ...hain-content-via-security-command.asciidoc |   54 +-
 .../rule-details/dynamic-linker-copy.asciidoc |   55 +-
 .../eggshell-backdoor-execution.asciidoc      |   50 +-
 .../elastic-agent-service-terminated.asciidoc |  116 +-
 ...nd-rules-creation-or-modification.asciidoc |   65 +-
 ...-host-network-discovery-via-netsh.asciidoc |   90 +-
 ...executable-stored-in-the-registry.asciidoc |   65 +-
 ...ncrypting-files-with-winrar-or-7z.asciidoc |  130 +-
 .../rule-details/endpoint-security.asciidoc   |   37 +-
 ...ing-domain-trusts-via-dsquery-exe.asciidoc |  110 ++
 ...ting-domain-trusts-via-nltest-exe.asciidoc |  112 ++
 ...tion-command-spawned-via-wmiprvse.asciidoc |  122 +-
 ...eration-of-administrator-accounts.asciidoc |  148 +-
 ...ration-of-kernel-modules-via-proc.asciidoc |   82 +
 .../enumeration-of-kernel-modules.asciidoc    |   73 +-
 ...rivileged-local-groups-membership.asciidoc |  222 +--
 ...s-or-groups-via-built-in-commands.asciidoc |  140 +-
 .../esxi-discovery-via-find.asciidoc          |   61 +
 .../esxi-discovery-via-grep.asciidoc          |   62 +
 ...-timestomping-using-touch-command.asciidoc |   65 +
 ...nge-mailbox-export-via-powershell.asciidoc |  121 ++
 ...creation-with-multiple-extensions.asciidoc |   98 +-
 ...om-unusual-directory-command-line.asciidoc |  522 ++---
 ...ecution-of-com-object-via-xwizard.asciidoc |   79 +-
 ...n-or-modified-by-microsoft-office.asciidoc |  134 +-
 ...written-or-modified-by-pdf-reader.asciidoc |  136 +-
 ...-of-persistent-suspicious-program.asciidoc |  101 +-
 ...tron-child-process-node-js-module.asciidoc |   72 +
 ...ution-via-local-sxs-shared-module.asciidoc |   64 +-
 ...ssql-xp-cmdshell-stored-procedure.asciidoc |  107 +
 ...execution-via-tsclient-mountpoint.asciidoc |   64 +-
 ...n-via-windows-subsystem-for-linux.asciidoc |   77 +
 ...xplicit-credentials-via-scripting.asciidoc |   83 +-
 .../expired-or-revoked-driver-loaded.asciidoc |   62 +
 .../exploit-detected-elastic-endgame.asciidoc |   66 +-
 ...exploit-prevented-elastic-endgame.asciidoc |   66 +-
 ...g-exchange-mailbox-via-powershell.asciidoc |  132 +-
 .../rule-details/external-alerts.asciidoc     |   55 +-
 ...p-lookup-from-non-browser-process.asciidoc |  212 +-
 ...r-added-to-google-workspace-group.asciidoc |  127 ++
 .../file-creation-time-changed.asciidoc       |   80 +
 .../file-deletion-via-shred.asciidoc          |   76 +-
 ...able-via-chmod-inside-a-container.asciidoc |   76 +
 .../file-made-immutable-by-chattr.asciidoc    |   51 +-
 ...odification-in-writable-directory.asciidoc |   74 +-
 ...r-listener-established-via-netcat.asciidoc |  171 +-
 ...ync-plugin-registered-and-enabled.asciidoc |   88 +-
 ...value-accessed-in-secrets-manager.asciidoc |  119 ++
 ...used-remote-access-tool-execution.asciidoc |  125 ++
 .../first-time-seen-driver-loaded.asciidoc    |  134 ++
 ...ogin-from-third-party-application.asciidoc |   97 +
 .../first-time-seen-removable-device.asciidoc |   78 +
 ...me-seen-account-performing-dcsync.asciidoc |  121 ++
 ...d-google-workspace-security-alert.asciidoc |   61 +
 ...er-mode-dumps-enabled-system-wide.asciidoc |   44 +-
 .../gcp-firewall-rule-creation.asciidoc       |   80 +-
 .../gcp-firewall-rule-deletion.asciidoc       |   80 +-
 .../gcp-firewall-rule-modification.asciidoc   |   80 +-
 .../gcp-iam-custom-role-creation.asciidoc     |   85 +-
 .../gcp-iam-role-deletion.asciidoc            |   83 +-
 ...-iam-service-account-key-deletion.asciidoc |   86 +-
 .../gcp-logging-bucket-deletion.asciidoc      |   89 +-
 .../gcp-logging-sink-deletion.asciidoc        |   86 +-
 .../gcp-logging-sink-modification.asciidoc    |   83 +-
 ...gcp-pub-sub-subscription-creation.asciidoc |   88 +-
 ...gcp-pub-sub-subscription-deletion.asciidoc |   86 +-
 .../gcp-pub-sub-topic-creation.asciidoc       |   88 +-
 .../gcp-pub-sub-topic-deletion.asciidoc       |   86 +-
 .../gcp-service-account-creation.asciidoc     |   83 +-
 .../gcp-service-account-deletion.asciidoc     |   83 +-
 .../gcp-service-account-disabled.asciidoc     |   83 +-
 .../gcp-service-account-key-creation.asciidoc |   83 +-
 ...bucket-configuration-modification.asciidoc |   87 +-
 .../gcp-storage-bucket-deletion.asciidoc      |   85 +-
 ...e-bucket-permissions-modification.asciidoc |   86 +-
 ...al-private-cloud-network-deletion.asciidoc |   85 +-
 ...tual-private-cloud-route-creation.asciidoc |   98 +-
 ...tual-private-cloud-route-deletion.asciidoc |   85 +-
 ...-transferred-via-google-workspace.asciidoc |   95 +-
 ...gle-workspace-2sv-policy-disabled.asciidoc |   91 +-
 ...ace-admin-role-assigned-to-a-user.asciidoc |  143 +-
 ...gle-workspace-admin-role-deletion.asciidoc |  125 +-
 ...main-wide-delegation-of-authority.asciidoc |  126 +-
 ...kspace-bitlocker-setting-disabled.asciidoc |   96 +-
 ...rkspace-custom-admin-role-created.asciidoc |  129 +-
 ...m-gmail-route-created-or-modified.asciidoc |   96 +-
 ...ey-s-accessed-from-anonymous-user.asciidoc |   85 +
 ...orkspace-mfa-enforcement-disabled.asciidoc |  131 +-
 ...ess-granted-to-custom-application.asciidoc |  138 ++
 ...orkspace-password-policy-modified.asciidoc |  172 +-
 ...etplace-modified-to-allow-any-app.asciidoc |  107 +-
 .../google-workspace-role-modified.asciidoc   |  131 +-
 ...ce-suspended-user-account-renewed.asciidoc |   80 +
 ...-user-organizational-unit-changed.asciidoc |  101 +-
 ...licy-abuse-for-privilege-addition.asciidoc |   95 +-
 ...ry-via-microsoft-gpresult-utility.asciidoc |   63 +
 ...fbaked-command-and-control-beacon.asciidoc |   84 +-
 ...password-reset-or-unlock-attempts.asciidoc |  115 +-
 ...ocess-and-or-service-terminations.asciidoc |   91 +-
 ...gh-number-of-process-terminations.asciidoc |   79 +-
 ...s-via-windows-subsystem-for-linux.asciidoc |   69 +
 .../rule-details/hosts-file-modified.asciidoc |  148 +-
 .../hping-process-activity.asciidoc           |   79 +-
 .../iis-http-logging-disabled.asciidoc        |  134 +-
 ...-file-execution-options-injection.asciidoc |  115 +-
 ...windows-update-auto-update-client.asciidoc |   87 +-
 ...to-an-unsecure-elasticsearch-node.asciidoc |   74 +-
 ...g-dcom-lateral-movement-via-mshta.asciidoc |  126 +-
 ...ng-dcom-lateral-movement-with-mmc.asciidoc |  101 +-
 ...hellbrowserwindow-or-shellwindows.asciidoc |  102 +-
 ...execution-via-powershell-remoting.asciidoc |   90 +-
 ...-execution-via-winrm-remote-shell.asciidoc |   85 +-
 ...ingress-transfer-via-windows-bits.asciidoc |   78 +
 ...allation-of-custom-shim-databases.asciidoc |   80 +-
 ...tion-of-security-support-provider.asciidoc |   94 +-
 ...rocess-making-network-connections.asciidoc |   82 +-
 ...nched-against-a-running-container.asciidoc |   79 +
 ...ractive-terminal-spawned-via-perl.asciidoc |   67 +-
 ...ctive-terminal-spawned-via-python.asciidoc |  106 +-
 ...ipsec-nat-traversal-port-activity.asciidoc |   81 +-
 ...rberos-cached-credentials-dumping.asciidoc |   63 +-
 ...-authentication-disabled-for-user.asciidoc |   84 +-
 ...eros-traffic-from-unusual-process.asciidoc |  201 +-
 ...load-or-unload-via-kexec-detected.asciidoc |   89 +
 .../kernel-module-load-via-insmod.asciidoc    |   52 +-
 .../kernel-module-removal.asciidoc            |   87 +-
 ...ssword-retrieval-via-command-line.asciidoc |   82 +-
 .../krbtgt-delegation-backdoor.asciidoc       |   55 +-
 ...etes-anonymous-request-authorized.asciidoc |   69 +-
 ...with-excessive-linux-capabilities.asciidoc |   67 +-
 ...es-denied-service-account-request.asciidoc |   48 +-
 ...ervice-created-with-type-nodeport.asciidoc |   64 +-
 ...-with-a-sensitive-hostpath-volume.asciidoc |  108 +-
 ...bernetes-pod-created-with-hostipc.asciidoc |   69 +-
 ...etes-pod-created-with-hostnetwork.asciidoc |   69 +-
 ...bernetes-pod-created-with-hostpid.asciidoc |   69 +-
 ...kubernetes-privileged-pod-created.asciidoc |   69 +-
 ...ent-of-controller-service-account.asciidoc |   68 +-
 ...es-suspicious-self-subject-review.asciidoc |   82 +-
 .../kubernetes-user-exec-into-pod.asciidoc    |   77 +-
 ...teral-movement-via-startup-folder.asciidoc |   83 +-
 ...odification-and-immediate-loading.asciidoc |   69 +-
 ...odification-and-immediate-loading.asciidoc |   78 +-
 .../linux-group-creation.asciidoc             |  118 ++
 ...shell-breakout-via-linux-binary-s.asciidoc |  184 ++
 ...inux-system-information-discovery.asciidoc |   65 +
 .../linux-user-account-creation.asciidoc      |  117 ++
 ...ux-user-added-to-privileged-group.asciidoc |  126 ++
 ...count-tokenfilter-policy-disabled.asciidoc |   47 +-
 .../local-scheduled-task-creation.asciidoc    |  198 +-
 .../lsass-memory-dump-creation.asciidoc       |  147 +-
 .../lsass-memory-dump-handle-access.asciidoc  |  144 +-
 ...ss-process-access-via-windows-api.asciidoc |   65 +
 ...ller-package-spawns-network-event.asciidoc |  113 +-
 .../malware-detected-elastic-endgame.asciidoc |   57 +-
 ...malware-prevented-elastic-endgame.asciidoc |   57 +-
 ...masquerading-space-after-filename.asciidoc |   45 +-
 ...for-google-workspace-organization.asciidoc |  139 +-
 ...change-anti-phish-policy-deletion.asciidoc |   66 +-
 ...ange-anti-phish-rule-modification.asciidoc |   66 +-
 ...im-signing-configuration-disabled.asciidoc |   69 +-
 ...t-365-exchange-dlp-policy-removed.asciidoc |   66 +-
 ...ge-malware-filter-policy-deletion.asciidoc |   66 +-
 ...-malware-filter-rule-modification.asciidoc |   66 +-
 ...-management-group-role-assignment.asciidoc |   66 +-
 ...nge-safe-attachment-rule-disabled.asciidoc |   66 +-
 ...xchange-safe-link-policy-disabled.asciidoc |   66 +-
 ...-exchange-transport-rule-creation.asciidoc |   69 +-
 ...hange-transport-rule-modification.asciidoc |   66 +-
 ...lobal-administrator-role-assigned.asciidoc |   61 +-
 ...ft-365-impossible-travel-activity.asciidoc |   70 +
 ...365-inbox-forwarding-rule-created.asciidoc |  113 +-
 ...65-mass-download-by-a-single-user.asciidoc |   66 +
 ...365-potential-ransomware-activity.asciidoc |   60 +-
 ...m-application-interaction-allowed.asciidoc |   63 +-
 ...365-teams-external-access-enabled.asciidoc |   70 +-
 ...ft-365-teams-guest-access-enabled.asciidoc |   67 +-
 ...5-unusual-volume-of-file-deletion.asciidoc |   57 +-
 ...ser-restricted-from-sending-email.asciidoc |   57 +-
 ...engine-started-an-unusual-process.asciidoc |  105 +-
 ...ngine-started-by-a-script-process.asciidoc |  111 +-
 ...ngine-started-by-a-system-process.asciidoc |  107 +-
 ...-started-by-an-office-application.asciidoc |  162 +-
 ...ld-engine-using-an-alternate-name.asciidoc |  172 +-
 ...-um-spawning-suspicious-processes.asciidoc |   76 +-
 ...erver-um-writing-suspicious-files.asciidoc |   96 +-
 ...ker-spawning-suspicious-processes.asciidoc |   70 +-
 ...iis-connection-strings-decryption.asciidoc |   85 +-
 ...s-service-account-password-dumped.asciidoc |   92 +-
 ...rosoft-windows-defender-tampering.asciidoc |  251 +--
 ...mimikatz-memssp-log-file-detected.asciidoc |  102 +-
 ...cation-of-amsienable-registry-key.asciidoc |  119 +-
 ...odification-of-boot-configuration.asciidoc |  142 +-
 ...-shared-object-inside-a-container.asciidoc |   65 +
 ...amic-linker-preload-shared-object.asciidoc |   54 +-
 ...nvironment-variable-via-launchctl.asciidoc |   98 +-
 .../modification-of-openssh-binaries.asciidoc |   89 +-
 ...ari-settings-via-defaults-command.asciidoc |   63 +-
 ...ntication-module-or-configuration.asciidoc |  125 +-
 ...on-of-the-mspkiaccountcredentials.asciidoc |   41 +-
 ...tion-of-wdigest-security-provider.asciidoc |  133 +-
 ...n-okta-application-sign-on-policy.asciidoc |   79 +-
 ...ng-hidden-or-webdav-remote-shares.asciidoc |  111 +-
 ...o-security-registry-modifications.asciidoc |  143 +-
 ...sbuild-making-network-connections.asciidoc |  149 +-
 ...build-network-connection-sequence.asciidoc |   69 +
 .../mshta-making-network-connections.asciidoc |   96 +-
 .../msxsl-making-network-connections.asciidoc |   64 +
 ...cation-disabled-for-an-azure-user.asciidoc |   94 +-
 ...t-att-ck-tactics-on-a-single-host.asciidoc |   28 +-
 .../multiple-alerts-involving-a-user.asciidoc |   45 +
 ...failure-followed-by-logon-success.asciidoc |  115 +-
 ...lure-from-the-same-source-address.asciidoc |  117 +-
 ...ltiple-vault-web-credentials-read.asciidoc |   71 +-
 .../rule-details/my-first-rule.asciidoc       |   72 +
 ...espace-manipulation-using-unshare.asciidoc |   42 +-
 ...er-established-inside-a-container.asciidoc |   74 +
 .../network-connection-via-certutil.asciidoc  |  152 +-
 ...connection-via-compiled-html-file.asciidoc |  184 +-
 .../network-connection-via-msxsl.asciidoc     |  100 +-
 ...nnection-via-registration-utility.asciidoc |  247 +--
 ...work-connection-via-signed-binary.asciidoc |  198 +-
 ...on-provider-registry-modification.asciidoc |   91 +-
 ...affic-to-rare-destination-country.asciidoc |   39 +-
 ...oweddeviceid-added-via-powershell.asciidoc |   86 +-
 ...new-or-modified-federation-domain.asciidoc |   74 +-
 ...ted-by-previously-unknown-process.asciidoc |   83 +
 .../new-systemd-timer-created.asciidoc        |  137 ++
 .../nping-process-activity.asciidoc           |   76 +-
 .../ntds-or-sam-database-file-copied.asciidoc |  107 +-
 ...sessionpipe-registry-modification.asciidoc |   68 +-
 ...orted-by-user-as-malware-or-phish.asciidoc |   61 +-
 ...ssive-single-sign-on-logon-errors.asciidoc |   69 +-
 ...spicious-mailbox-right-delegation.asciidoc |   83 +-
 ...o365-mailbox-audit-logging-bypass.asciidoc |   61 +-
 ...force-or-password-spraying-attack.asciidoc |  100 +-
 ...nsight-threat-suspected-promotion.asciidoc |   62 +
 .../okta-user-session-impersonation.asciidoc  |   78 +-
 .../onedrive-malware-file-upload.asciidoc     |   53 +-
 ...uled-task-activity-via-powershell.asciidoc |   93 +-
 .../parent-process-pid-spoofing.asciidoc      |  126 +-
 .../peripheral-device-discovery.asciidoc      |  113 +-
 ...on-theft-detected-elastic-endgame.asciidoc |   64 +-
 ...n-theft-prevented-elastic-endgame.asciidoc |   64 +-
 ...tence-via-bits-job-notify-cmdline.asciidoc |   63 +-
 ...ectoryservice-plugin-modification.asciidoc |   45 +-
 ...-via-docker-shortcut-modification.asciidoc |   59 +-
 ...sistence-via-folder-action-script.asciidoc |   98 +-
 ...tence-via-hidden-run-key-detected.asciidoc |  115 +-
 ...ript-or-desktop-file-modification.asciidoc |   90 +-
 ...sistence-via-login-or-logout-hook.asciidoc |   81 +-
 ...tence-via-microsoft-office-addins.asciidoc |   78 +-
 ...istence-via-microsoft-outlook-vba.asciidoc |   67 +-
 ...ersistence-via-powershell-profile.asciidoc |   45 +-
 ...stence-via-scheduled-job-creation.asciidoc |   60 +-
 ...ycontroller-scheduled-task-hijack.asciidoc |  112 +-
 ...pdate-orchestrator-service-hijack.asciidoc |  188 +-
 ...stence-via-wmi-event-subscription.asciidoc |   89 +-
 ...ia-wmi-standard-registry-provider.asciidoc |  195 +-
 ...-scripts-in-the-startup-directory.asciidoc |  143 +-
 .../port-forwarding-rule-addition.asciidoc    |  118 +-
 ...-via-azure-registered-application.asciidoc |  126 +-
 ...-dga-command-and-control-behavior.asciidoc |   83 +-
 .../possible-okta-dos-attack.asciidoc         |   81 +-
 ...f-repeated-mfa-push-notifications.asciidoc |   94 +-
 ...tial-admin-group-account-addition.asciidoc |   50 +-
 ...n-interface-bypass-via-powershell.asciidoc |  158 ++
 ...-application-shimming-via-sdbinst.asciidoc |  109 +-
 ...ial-code-execution-via-postgresql.asciidoc |   65 +
 ...and-control-via-internet-explorer.asciidoc |  133 +-
 ...okies-theft-via-browser-debugging.asciidoc |   86 +-
 ...tial-credential-access-via-dcsync.asciidoc |  156 +-
 ...cess-via-duplicatehandle-in-lsass.asciidoc |   80 +-
 ...tial-access-via-lsass-memory-dump.asciidoc |   96 +-
 ...cess-via-renamed-com-services-dll.asciidoc |   73 +-
 ...ess-via-trusted-developer-utility.asciidoc |  166 +-
 ...tial-access-via-windows-utilities.asciidoc |  197 +-
 ...otential-cross-site-scripting-xss.asciidoc |   62 +
 ...tential-defense-evasion-via-proot.asciidoc |   60 +
 .../potential-disabling-of-selinux.asciidoc   |   71 +-
 ...ft-antimalware-service-executable.asciidoc |   92 +-
 ...ng-via-trusted-microsoft-programs.asciidoc |  111 +-
 ...otential-dns-tunneling-via-iodine.asciidoc |   76 +-
 ...ential-dns-tunneling-via-nslookup.asciidoc |   99 +-
 ...ential-evasion-via-filter-manager.asciidoc |  152 +-
 ...otential-exfiltration-via-certreq.asciidoc |   74 +
 ...al-linux-ssh-brute-force-detected.asciidoc |  118 ++
 ...idden-local-user-account-creation.asciidoc |   50 +-
 ...-hidden-process-via-mount-hidepid.asciidoc |   62 +
 ...al-linux-ssh-brute-force-detected.asciidoc |  114 ++
 ...invoke-mimikatz-powershell-script.asciidoc |   99 +-
 ...al-java-jndi-exploitation-attempt.asciidoc |   94 +-
 ...ntial-kerberos-attack-via-bifrost.asciidoc |   70 +-
 ...teral-tool-transfer-via-smb-share.asciidoc |  121 +-
 ...ux-backdoor-user-account-creation.asciidoc |  121 ++
 ...ntial-dumping-via-proc-filesystem.asciidoc |   75 +
 ...x-credential-dumping-via-unshadow.asciidoc |   67 +
 ...ocal-account-brute-force-detected.asciidoc |   64 +
 ...ransomware-note-creation-detected.asciidoc |   75 +
 ...tential-local-ntlm-relay-via-http.asciidoc |   70 +-
 ...-lsa-authentication-package-abuse.asciidoc |   65 +-
 ...e-creation-via-psscapturesnapshot.asciidoc |   63 +-
 ...emory-dump-via-psscapturesnapshot.asciidoc |   67 +-
 ...al-macos-ssh-brute-force-detected.asciidoc |   46 +-
 ...file-downloaded-from-google-drive.asciidoc |   91 +
 ...asquerading-as-communication-apps.asciidoc |  101 +
 ...-microsoft-office-sandbox-evasion.asciidoc |   49 +-
 ...ication-of-accessibility-binaries.asciidoc |  216 +--
 .../potential-network-scan-detected.asciidoc  |   72 +
 .../potential-network-sweep-detected.asciidoc |   72 +
 ...andard-port-http-https-connection.asciidoc |   83 +
 ...-non-standard-port-ssh-connection.asciidoc |   46 +-
 ...openssh-backdoor-logging-activity.asciidoc |  117 +-
 ...tential-pass-the-hash-pth-attempt.asciidoc |   69 +
 ...ng-of-microsoft-365-user-accounts.asciidoc |  100 +-
 ...rsistence-through-init-d-detected.asciidoc |  136 ++
 ...rough-motd-file-creation-detected.asciidoc |  130 ++
 ...ence-through-run-control-detected.asciidoc |  137 ++
 ...via-atom-init-script-modification.asciidoc |   46 +-
 ...ential-persistence-via-login-hook.asciidoc |   69 +-
 ...al-persistence-via-periodic-tasks.asciidoc |   50 +-
 ...ce-via-time-provider-modification.asciidoc |   62 +-
 ...rint-processor-registration-abuse.asciidoc |   83 +-
 ...hacktool-script-by-function-names.asciidoc |  255 +++
 ...-bypass-via-localhost-secure-copy.asciidoc |   71 +-
 ...rol-bypass-via-tccdb-modification.asciidoc |   68 +-
 ...on-through-writable-docker-socket.asciidoc |   66 +
 ...alation-via-installerfiletakeover.asciidoc |  150 +-
 ...l-privilege-escalation-via-pkexec.asciidoc |   55 +-
 ...ion-via-sudoers-file-modification.asciidoc |   48 +-
 ...ation-via-samaccountname-spoofing.asciidoc |   66 +-
 ...tial-process-herpaderping-attempt.asciidoc |   74 +-
 ...a-ld-preload-environment-variable.asciidoc |  112 ++
 ...-process-injection-via-powershell.asciidoc |  136 +-
 ...-protocol-tunneling-via-earthworm.asciidoc |   53 +-
 ...-pspy-process-monitoring-detected.asciidoc |   93 +
 ...ote-code-execution-via-web-server.asciidoc |  151 ++
 ...te-credential-access-via-registry.asciidoc |  138 +-
 ...remote-desktop-shadowing-activity.asciidoc |   87 +-
 ...remote-desktop-tunneling-detected.asciidoc |  123 +-
 ...verse-shell-activity-via-terminal.asciidoc |  105 +-
 .../potential-reverse-shell-via-java.asciidoc |   78 +
 ...verse-shell-via-suspicious-binary.asciidoc |   89 +
 ...hell-via-suspicious-child-process.asciidoc |   86 +
 ...ell-via-suspicious-parent-process.asciidoc |   86 +
 .../potential-reverse-shell.asciidoc          |   78 +
 ...file-deletion-via-sdelete-utility.asciidoc |  112 +-
 ...ow-credentials-added-to-ad-object.asciidoc |   96 +-
 ...e-read-via-command-line-utilities.asciidoc |   77 +-
 .../potential-sharprdp-behavior.asciidoc      |  142 +-
 .../potential-ssh-password-guessing.asciidoc  |   67 +-
 ...x-ftp-brute-force-attack-detected.asciidoc |   94 +
 ...x-rdp-brute-force-attack-detected.asciidoc |   92 +
 .../potential-suspicious-file-edit.asciidoc   |  112 ++
 ...l-syn-based-network-scan-detected.asciidoc |   72 +
 ...indows-error-manager-masquerading.asciidoc |  130 +-
 ...owershell-invoke-ninjacopy-script.asciidoc |  143 ++
 ...owershell-kerberos-ticket-request.asciidoc |  116 +-
 .../powershell-keylogging-script.asciidoc     |  143 +-
 ...ershell-mailbox-collection-script.asciidoc |  140 ++
 .../powershell-minidump-script.asciidoc       |  110 +-
 .../powershell-psreflect-script.asciidoc      |  152 +-
 ...ell-script-block-logging-disabled.asciidoc |  104 +-
 ...-archive-compression-capabilities.asciidoc |   98 +
 ...cript-with-discovery-capabilities.asciidoc |  229 +++
 ...ncryption-decryption-capabilities.asciidoc |  122 ++
 ...cript-with-log-clear-capabilities.asciidoc |   94 +
 ...-token-impersonation-capabilities.asciidoc |   84 +-
 ...wershell-share-enumeration-script.asciidoc |   93 +-
 ...ery-related-windows-api-functions.asciidoc |  170 +-
 ...us-payload-encoded-and-compressed.asciidoc |  152 +-
 ...t-with-audio-capture-capabilities.asciidoc |  127 +-
 ...-clipboard-retrieval-capabilities.asciidoc |  138 ++
 ...ript-with-screenshot-capabilities.asciidoc |  115 +-
 ...tion-via-named-pipe-impersonation.asciidoc |  124 +-
 ...ia-rogue-named-pipe-impersonation.asciidoc |   58 +-
 ...ia-root-crontab-file-modification.asciidoc |   50 +-
 ...n-via-windir-environment-variable.asciidoc |   73 +-
 .../privileged-account-brute-force.asciidoc   |   97 +-
 ...n-via-parent-process-pid-spoofing.asciidoc |   79 +-
 ...s-activity-via-compiled-html-file.asciidoc |  183 +-
 ...ss-created-with-an-elevated-token.asciidoc |  126 +-
 ...cess-creation-via-secondary-logon.asciidoc |   77 +-
 ...scovery-via-built-in-applications.asciidoc |   70 +
 ...ecution-from-an-unusual-directory.asciidoc |  221 +--
 ...ion-by-the-microsoft-build-engine.asciidoc |   65 +-
 ...njection-detected-elastic-endgame.asciidoc |   64 +-
 ...jection-prevented-elastic-endgame.asciidoc |   64 +-
 ...-started-from-process-id-pid-file.asciidoc |   57 +-
 ...-termination-followed-by-deletion.asciidoc |  172 +-
 ...gram-files-directory-masquerading.asciidoc |   85 +-
 ...pt-for-credentials-with-osascript.asciidoc |   69 +-
 .../psexec-network-connection.asciidoc        |  152 +-
 ...script-execution-via-command-line.asciidoc |   78 +
 ...nsomware-detected-elastic-endgame.asciidoc |   55 +-
 ...somware-prevented-elastic-endgame.asciidoc |   55 +-
 .../rule-details/rare-aws-error-code.asciidoc |  106 +-
 .../rule-details/rare-user-logon.asciidoc     |   84 +-
 .../rdp-enabled-via-registry.asciidoc         |  115 +-
 ...esktop-protocol-from-the-internet.asciidoc |  166 +-
 ...istry-persistence-via-appcert-dll.asciidoc |   76 +-
 ...istry-persistence-via-appinit-dll.asciidoc |  142 +-
 ...mputer-account-dnshostname-update.asciidoc |  100 +-
 ...bled-in-windows-firewall-by-netsh.asciidoc |  102 +-
 .../remote-execution-via-file-shares.asciidoc |  104 +-
 ...emote-file-copy-to-a-hidden-share.asciidoc |   79 +-
 .../remote-file-copy-via-teamviewer.asciidoc  |  130 +-
 ...oad-via-desktopimgdownldr-utility.asciidoc |  144 +-
 ...remote-file-download-via-mpcmdrun.asciidoc |  134 +-
 ...mote-file-download-via-powershell.asciidoc |  152 +-
 ...e-download-via-script-interpreter.asciidoc |  123 +-
 ...llowed-by-scheduled-task-creation.asciidoc |   77 +-
 .../remote-scheduled-task-creation.asciidoc   |  132 +-
 ...n-enabled-via-systemsetup-command.asciidoc |   71 +-
 .../remote-system-discovery-commands.asciidoc |  118 +-
 .../remote-windows-service-installed.asciidoc |   99 +-
 ...remotely-started-services-via-rpc.asciidoc |  265 +--
 ...enamed-autoit-scripts-interpreter.asciidoc |  136 +-
 ...-executed-with-short-program-name.asciidoc |  123 ++
 ...file-downloaded-from-the-internet.asciidoc |  125 +-
 ...-procedure-call-from-the-internet.asciidoc |  154 +-
 ...te-procedure-call-to-the-internet.asciidoc |  154 +-
 ...-task-created-by-a-windows-script.asciidoc |  101 +-
 ...d-task-execution-at-scale-via-gpo.asciidoc |  114 +-
 ...cheduled-tasks-at-command-enabled.asciidoc |   97 +-
 ...le-modified-by-unexpected-process.asciidoc |   86 +-
 ...or-saved-credentials-via-vaultcmd.asciidoc |   79 +-
 ...ity-software-discovery-using-wmic.asciidoc |  110 +-
 ...urity-software-discovery-via-grep.asciidoc |  154 +-
 ...e-enabled-by-a-suspicious-process.asciidoc |   74 +-
 ...es-compression-inside-a-container.asciidoc |  107 +
 .../sensitive-files-compression.asciidoc      |  102 +-
 ...s-searched-for-inside-a-container.asciidoc |   77 +
 ...ationprivilege-assigned-to-a-user.asciidoc |   93 +-
 .../service-command-lateral-movement.asciidoc |   93 +-
 ...ol-spawned-via-script-interpreter.asciidoc |  165 +-
 ...via-local-kerberos-authentication.asciidoc |   75 +-
 .../setuid-setgid-bit-set-via-chmod.asciidoc  |  130 +-
 ...ged-by-previously-unknown-process.asciidoc |   68 +
 .../sharepoint-malware-file-upload.asciidoc   |   56 +-
 ...ell-execution-via-apple-scripting.asciidoc |   64 +-
 ...oxy-execution-via-ms-work-folders.asciidoc |   96 +-
 .../sip-provider-modification.asciidoc        |   81 +-
 ...-sharing-activity-to-the-internet.asciidoc |  156 +-
 .../rule-details/smtp-on-port-26-tcp.asciidoc |   87 +-
 ...reupdate-preferences-modification.asciidoc |   64 +-
 ...s-disabling-services-via-registry.asciidoc |  129 +-
 .../spike-in-aws-error-messages.asciidoc      |  109 +-
 .../spike-in-failed-logon-events.asciidoc     |   81 +-
 .../spike-in-firewall-denies.asciidoc         |   39 +-
 .../spike-in-logon-events.asciidoc            |   43 +-
 ...e-in-network-traffic-to-a-country.asciidoc |   73 +-
 .../spike-in-network-traffic.asciidoc         |   42 +-
 ...ful-logon-events-from-a-source-ip.asciidoc |  100 +
 ...authorized-keys-file-modification.asciidoc |  120 +-
 ...-file-modified-inside-a-container.asciidoc |   85 +
 ...lished-inside-a-running-container.asciidoc |   83 +
 ...-launched-from-inside-a-container.asciidoc |   77 +
 ...-persistence-via-unsigned-process.asciidoc |  152 +-
 ...ript-added-to-group-policy-object.asciidoc |  113 +-
 ...-or-run-key-registry-modification.asciidoc |  307 ++-
 ...rsistence-by-a-suspicious-process.asciidoc |  163 +-
 ...r-application-script-modification.asciidoc |   85 +-
 ...eap-based-buffer-overflow-attempt.asciidoc |   51 +-
 .../sudoers-file-modification.asciidoc        |   77 +-
 ...urst-command-and-control-activity.asciidoc |  178 +-
 ...us-activity-reported-by-okta-user.asciidoc |   81 +-
 ...us-antimalware-scan-interface-dll.asciidoc |  133 ++
 ...ous-automator-workflows-execution.asciidoc |   47 +-
 .../suspicious-browser-child-process.asciidoc |  102 +-
 ...icious-calendar-file-modification.asciidoc |   73 +-
 .../suspicious-certutil-commands.asciidoc     |  176 +-
 ...obe-acrobat-reader-update-service.asciidoc |   81 +-
 .../suspicious-cmd-execution-via-wmi.asciidoc |   77 +-
 ...racted-or-decompressed-via-funzip.asciidoc |   82 +
 ...-crontab-creation-or-modification.asciidoc |   57 +-
 ...ta-encryption-via-openssl-utility.asciidoc |   67 +
 ...rsistence-or-privilege-escalation.asciidoc |  157 +-
 .../suspicious-emond-child-process.asciidoc   |   76 +-
 ...-endpoint-security-parent-process.asciidoc |  104 +-
 ...s-execution-from-a-mounted-device.asciidoc |   76 +-
 ...tion-via-microsoft-office-add-ins.asciidoc |  121 ++
 ...ious-execution-via-scheduled-task.asciidoc |  167 +-
 ...n-via-windows-subsystem-for-linux.asciidoc |   87 +
 ...suspicious-explorer-child-process.asciidoc |  112 +-
 ...us-file-changes-activity-detected.asciidoc |   70 +
 ...e-creation-in-etc-for-persistence.asciidoc |  103 +-
 ...s-hidden-child-process-of-launchd.asciidoc |   57 +-
 .../suspicious-html-file-creation.asciidoc    |   93 +-
 ...-load-taskschd-dll-from-ms-office.asciidoc |   76 +
 ...icious-imagepath-service-creation.asciidoc |   64 +-
 ...process-communication-via-outlook.asciidoc |   78 +
 ...l-spawned-from-inside-a-container.asciidoc |   72 +
 .../suspicious-java-child-process.asciidoc    |  107 +-
 ...ious-lsass-access-via-malseclogon.asciidoc |   64 +-
 .../suspicious-lsass-process-access.asciidoc  |   92 +
 ...ous-macos-ms-office-child-process.asciidoc |  124 +-
 ...ious-managed-code-hosting-process.asciidoc |   93 +-
 ...ft-365-mail-access-by-clientappid.asciidoc |   69 +
 ...soft-diagnostics-wizard-execution.asciidoc |  112 +-
 ...ous-mining-process-creation-event.asciidoc |   66 +
 .../suspicious-modprobe-file-event.asciidoc   |   87 +
 ...suspicious-module-loaded-by-lsass.asciidoc |  137 ++
 ...uspicious-ms-office-child-process.asciidoc |  298 +--
 ...spicious-ms-outlook-child-process.asciidoc |  204 +-
 .../suspicious-net-code-compilation.asciidoc  |   76 +
 ...ous-net-reflection-via-powershell.asciidoc |  161 ++
 ...-by-previously-unknown-executable.asciidoc |  120 ++
 ...etwork-connection-attempt-by-root.asciidoc |   84 +-
 ...-tool-launched-inside-a-container.asciidoc |   82 +
 ...spicious-pdf-reader-child-process.asciidoc |  185 +-
 ...able-encoded-in-powershell-script.asciidoc |  121 +-
 ...cious-powershell-engine-imageload.asciidoc |  282 +--
 .../suspicious-powershell-script.asciidoc     |   64 +-
 ...cious-print-spooler-file-deletion.asciidoc |   61 +-
 ...print-spooler-point-and-print-dll.asciidoc |   72 +-
 ...us-print-spooler-spl-file-created.asciidoc |  145 +-
 ...-service-executable-file-creation.asciidoc |   79 +-
 ...oc-pseudo-file-system-enumeration.asciidoc |   89 +
 ...ess-access-via-direct-system-call.asciidoc |  151 +-
 ...icious-process-creation-calltrace.asciidoc |  135 +-
 ...ion-via-renamed-psexec-executable.asciidoc |  114 +-
 ...rocess-spawned-from-motd-detected.asciidoc |  131 ++
 ...picious-rdp-activex-client-loaded.asciidoc |  109 +-
 ...stry-access-via-sebackupprivilege.asciidoc |  113 +-
 ...suspicious-renaming-of-esxi-files.asciidoc |   66 +
 ...-renaming-of-esxi-index-html-file.asciidoc |   65 +
 ...uspicious-script-object-execution.asciidoc |  150 +-
 ...rvice-was-installed-in-the-system.asciidoc |   96 +-
 ...spicious-solarwinds-child-process.asciidoc |  108 +-
 ...startup-shell-folder-modification.asciidoc |  140 +-
 .../suspicious-sysctl-file-event.asciidoc     |   87 +
 ...-by-previously-unknown-executable.asciidoc |   76 +
 ...cious-termination-of-esxi-process.asciidoc |   61 +
 ...suspicious-werfault-child-process.asciidoc |  102 +-
 ...ous-wmi-image-load-from-ms-office.asciidoc |   95 +-
 ...picious-wmic-xsl-script-execution.asciidoc |   93 +-
 .../suspicious-zoom-child-process.asciidoc    |  153 +-
 .../svchost-spawning-cmd.asciidoc             |  196 +-
 ...bolic-link-to-shadow-copy-created.asciidoc |  111 +-
 .../system-hosts-file-access.asciidoc         |   61 +
 ...scovery-via-windows-command-shell.asciidoc |   77 +-
 .../system-log-file-deletion.asciidoc         |  104 +-
 ...tem-network-connections-discovery.asciidoc |   61 +
 ...system-owner-user-discovery-linux.asciidoc |   65 +
 ...hrough-built-in-windows-utilities.asciidoc |   67 +
 .../system-shells-via-services.asciidoc       |  172 +-
 .../system-time-discovery.asciidoc            |   67 +
 ...systemkey-access-via-command-line.asciidoc |   58 +-
 ...ring-of-bash-command-line-history.asciidoc |  117 +-
 ...-via-mounted-apfs-snapshot-access.asciidoc |   48 +-
 ...mporarily-scheduled-task-creation.asciidoc |   70 +-
 ...es-deleted-via-unexpected-process.asciidoc |  113 +-
 ...threat-intel-hash-indicator-match.asciidoc |  118 ++
 ...-intel-ip-address-indicator-match.asciidoc |  117 ++
 .../threat-intel-url-indicator-match.asciidoc |  120 ++
 ...-windows-registry-indicator-match.asciidoc |  113 ++
 .../timestomping-using-touch-command.asciidoc |   83 +-
 ...nternet-explorer-add-on-installer.asciidoc |   95 +-
 ...eged-ifileoperation-com-interface.asciidoc |   78 +-
 ...ia-windows-directory-masquerading.asciidoc |  121 +-
 ...ademanager-elevated-com-interface.asciidoc |   91 +-
 ...diskcleanup-scheduled-task-hijack.asciidoc |   93 +-
 ...icmluautil-elevated-com-interface.asciidoc |   78 +-
 ...a-windows-firewall-snap-in-hijack.asciidoc |  129 +-
 ...zed-access-to-an-okta-application.asciidoc |   63 +-
 ...ommon-registry-persistence-change.asciidoc |  297 +--
 ...ocess-of-macos-screensaver-engine.asciidoc |   57 +-
 .../unsigned-dll-loaded-by-svchost.asciidoc   |  152 ++
 ...-loading-from-a-suspicious-folder.asciidoc |  152 ++
 .../untrusted-driver-loaded.asciidoc          |  134 ++
 .../unusual-aws-command-for-a-user.asciidoc   |  104 +-
 ...ess-from-a-system-virtual-process.asciidoc |   79 +-
 .../unusual-child-process-of-dns-exe.asciidoc |  112 ++
 ...usual-child-processes-of-rundll32.asciidoc |   85 +-
 .../unusual-city-for-an-aws-command.asciidoc  |  104 +-
 ...nusual-country-for-an-aws-command.asciidoc |  110 +-
 .../unusual-dns-activity.asciidoc             |   55 +-
 ...tion-by-a-system-critical-process.asciidoc |  127 +-
 ...le-creation-alternate-data-stream.asciidoc |  205 +-
 ...sual-file-modification-by-dns-exe.asciidoc |   82 +
 .../unusual-hour-for-a-user-to-logon.asciidoc |   70 +-
 .../unusual-linux-network-activity.asciidoc   |   58 +-
 ...x-network-configuration-discovery.asciidoc |   49 +
 ...inux-network-connection-discovery.asciidoc |   45 +-
 ...usual-linux-network-port-activity.asciidoc |   54 +-
 ...cess-calling-the-metadata-service.asciidoc |   56 +-
 ...-linux-process-discovery-activity.asciidoc |   45 +-
 ...em-information-discovery-activity.asciidoc |   45 +-
 ...user-calling-the-metadata-service.asciidoc |   56 +-
 ...ual-linux-user-discovery-activity.asciidoc |   49 +
 .../unusual-linux-username.asciidoc           |   69 +-
 .../unusual-login-activity.asciidoc           |   55 +-
 ...vity-from-a-windows-system-binary.asciidoc |  207 +-
 ...al-network-connection-via-dllhost.asciidoc |   78 +-
 ...l-network-connection-via-rundll32.asciidoc |  205 +-
 ...l-network-destination-domain-name.asciidoc |   45 +-
 ...unusual-parent-child-relationship.asciidoc |  344 +---
 ...nusual-parent-process-for-cmd-exe.asciidoc |   95 +
 ...persistence-via-services-registry.asciidoc |  112 +-
 ...usual-print-spooler-child-process.asciidoc |  114 +-
 ...cution-path-alternate-data-stream.asciidoc |   76 +-
 .../unusual-process-for-a-linux-host.asciidoc |  113 +-
 ...nusual-process-for-a-windows-host.asciidoc |  155 +-
 ...nusual-process-network-connection.asciidoc |  150 +-
 ...t-child-process-childless-service.asciidoc |  142 +-
 ...ource-ip-for-a-user-to-logon-from.asciidoc |   43 +-
 .../unusual-sudo-activity.asciidoc            |   47 +-
 .../rule-details/unusual-web-request.asciidoc |   55 +-
 .../unusual-web-user-agent.asciidoc           |   55 +-
 .../unusual-windows-network-activity.asciidoc |   63 +-
 .../unusual-windows-path-activity.asciidoc    |   77 +-
 ...cess-calling-the-metadata-service.asciidoc |   56 +-
 .../unusual-windows-remote-user.asciidoc      |   63 +-
 .../unusual-windows-service.asciidoc          |   61 +-
 ...user-calling-the-metadata-service.asciidoc |   56 +-
 ...user-privilege-elevation-activity.asciidoc |   57 +-
 .../unusual-windows-username.asciidoc         |   77 +-
 .../user-account-creation.asciidoc            |  133 +-
 ...-account-exposed-to-kerberoasting.asciidoc |  103 +-
 ...ed-as-owner-for-azure-application.asciidoc |   67 +-
 ...owner-for-azure-service-principal.asciidoc |   69 +-
 .../user-added-to-privileged-group.asciidoc   |   99 +-
 ...l-machine-fingerprinting-via-grep.asciidoc |   71 +-
 .../virtual-machine-fingerprinting.asciidoc   |   79 +-
 ...rivate-network-connection-attempt.asciidoc |   59 +-
 ...twork-computing-from-the-internet.asciidoc |  158 +-
 ...network-computing-to-the-internet.asciidoc |  156 +-
 ...y-deleted-or-resized-via-vssadmin.asciidoc |  161 +-
 ...adow-copy-deletion-via-powershell.asciidoc |  115 +-
 ...ume-shadow-copy-deletion-via-wmic.asciidoc |  137 +-
 ...us-activity-post-request-declined.asciidoc |   62 +-
 ...icious-activity-sqlmap-user-agent.asciidoc |   59 +-
 ...ious-activity-unauthorized-method.asciidoc |   62 +-
 ...ess-child-of-common-web-processes.asciidoc |  116 +-
 .../webproxy-settings-modification.asciidoc   |   66 +-
 .../webserver-access-logs-deleted.asciidoc    |   79 +-
 .../whoami-process-activity.asciidoc          |  152 +-
 ...erability-cve-2020-0601-curveball.asciidoc |   64 +-
 ...isabled-via-registry-modification.asciidoc |  166 +-
 ...r-exclusions-added-via-powershell.asciidoc |  131 +-
 .../windows-event-logs-cleared.asciidoc       |   85 +-
 ...-firewall-disabled-via-powershell.asciidoc |   96 +-
 .../windows-network-enumeration.asciidoc      |  154 +-
 ...gistry-file-creation-in-smb-share.asciidoc |  100 +-
 ...ndows-script-executing-powershell.asciidoc |  136 +-
 ...rpreter-executing-process-via-wmi.asciidoc |  157 +-
 ...e-installed-via-an-unusual-client.asciidoc |   52 +-
 ...-for-linux-distribution-installed.asciidoc |   71 +
 ...or-linux-enabled-via-dism-utility.asciidoc |   66 +
 ...dows-system-information-discovery.asciidoc |   79 +
 .../windows-user-account-creation.asciidoc    |   69 +
 ...ntial-dumping-using-netsh-command.asciidoc |   83 +-
 .../wmi-incoming-lateral-movement.asciidoc    |  128 +-
 .../wpad-service-exploit.asciidoc             |   71 +
 .../zoom-meeting-with-no-passcode.asciidoc    |   61 +-
 861 files changed, 37991 insertions(+), 47215 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/rule-details/account-or-group-discovery-via-built-in-tools.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-credentials-searched-for-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/bypass-uac-via-sdclt.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/compression-dll-loaded-by-unusual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/container-management-utility-run-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/container-workload-protection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/downloaded-shortcut-files.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/downloaded-url-files.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/file-creation-time-changed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/file-made-executable-via-chmod-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/host-files-system-changes-via-windows-subsystem-for-linux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/interactive-exec-command-launched-against-a-running-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/linux-system-information-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/msbuild-network-connection-sequence.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/msxsl-making-network-connections.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/multiple-alerts-involving-a-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/netcat-listener-established-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-cross-site-scripting-xss.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-exfiltration-via-certreq.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-malicious-file-downloaded-from-google-drive.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-network-scan-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-network-sweep-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-pass-the-hash-pth-attempt.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-ld-preload-environment-variable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-parent-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-suspicious-file-edit.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-syn-based-network-scan-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/process-discovery-via-built-in-applications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/sensitive-files-compression-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/sensitive-keys-or-passwords-searched-for-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modified-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/ssh-connection-established-inside-a-running-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/ssh-process-launched-from-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-interactive-shell-spawned-from-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-network-tool-launched-inside-a-container.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-hosts-file-access.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-network-connections-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-owner-user-discovery-linux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-service-discovery-through-built-in-windows-utilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-linux-network-configuration-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-linux-user-discovery-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/windows-system-information-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/windows-user-account-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/wpad-service-exploit.asciidoc

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index e48b2f475b..f132f1e606 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -4,8 +4,9 @@
 
 This section lists all updates to prebuilt detection rules, made available with the *Prebuilt Security Detection Rules* integration in Fleet.
 
-To download the latest updates, follow the instructions in <<download-prebuilt-rules>>
+To update your installed rules to the latest versions, follow the instructions in <<update-prebuilt-rules>>.
 
+For previous rule updates, please navigate to the https://www.elastic.co/guide/en/security/8.7/prebuilt-rules-downloadable-updates.html[last version].
 
 [width="100%",options="header"]
 |==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index 980b406671..49b0bb6a3a 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -14,1450 +14,1720 @@ and their rule type is `machine_learning`.
 |Rule |Description |Tags |Added |Version
 
 
-|<<a-scheduled-task-was-created, A scheduled task was created>> |Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |8.5.0 |2 <<a-scheduled-task-was-created-history, Version history>>
+|<<a-scheduled-task-was-created, A scheduled task was created>> |Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |7
 
-|<<a-scheduled-task-was-updated, A scheduled task was updated>> |Indicates the update of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, by changing the configuration of a legit scheduled task. Some changes such as disabling or enabling a scheduled task are common and may may generate noise. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |8.5.0 |2 <<a-scheduled-task-was-updated-history, Version history>>
+|<<a-scheduled-task-was-updated, A scheduled task was updated>> |Indicates the update of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, by changing the configuration of a legit scheduled task. Some changes such as disabling or enabling a scheduled task are common and may may generate noise. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |8
 
-|<<aws-access-secret-in-secrets-manager, AWS Access Secret in Secrets Manager>> |An adversary may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] [Credential Access] [Investigation Guide]  |7.9.0 |103 <<aws-access-secret-in-secrets-manager-history, Version history>>
+|<<aws-cloudtrail-log-created, AWS CloudTrail Log Created>> |Identifies the creation of an AWS log trail that specifies the settings for delivery of log data. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Tactic: Collection] |8.3.0 |104
 
-|<<aws-cloudtrail-log-created, AWS CloudTrail Log Created>> |Identifies the creation of an AWS log trail that specifies the settings for delivery of log data. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.9.0 |101 <<aws-cloudtrail-log-created-history, Version history>>
+|<<aws-cloudtrail-log-deleted, AWS CloudTrail Log Deleted>> |Identifies the deletion of an AWS log trail. An adversary may delete trails in an attempt to evade defenses. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.3.0 |106
 
-|<<aws-cloudtrail-log-deleted, AWS CloudTrail Log Deleted>> |Identifies the deletion of an AWS log trail. An adversary may delete trails in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Investigation Guide]  |7.9.0 |103 <<aws-cloudtrail-log-deleted-history, Version history>>
+|<<aws-cloudtrail-log-suspended, AWS CloudTrail Log Suspended>> |Identifies suspending the recording of AWS API calls and log file delivery for the specified trail. An adversary may suspend trails in an attempt to evade defenses. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.3.0 |106
 
-|<<aws-cloudtrail-log-suspended, AWS CloudTrail Log Suspended>> |Identifies suspending the recording of AWS API calls and log file delivery for the specified trail. An adversary may suspend trails in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Investigation Guide]  |7.9.0 |103 <<aws-cloudtrail-log-suspended-history, Version history>>
+|<<aws-cloudtrail-log-updated, AWS CloudTrail Log Updated>> |Identifies an update to an AWS log trail setting that specifies the delivery of log files. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Resources: Investigation Guide], [Tactic: Impact] |8.3.0 |106
 
-|<<aws-cloudtrail-log-updated, AWS CloudTrail Log Updated>> |Identifies an update to an AWS log trail setting that specifies the delivery of log files. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Investigation Guide]  |7.9.0 |103 <<aws-cloudtrail-log-updated-history, Version history>>
+|<<aws-cloudwatch-alarm-deletion, AWS CloudWatch Alarm Deletion>> |Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alarms in an attempt to evade defenses. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.3.0 |106
 
-|<<aws-cloudwatch-alarm-deletion, AWS CloudWatch Alarm Deletion>> |Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alarms in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [Investigation Guide]  |7.9.0 |103 <<aws-cloudwatch-alarm-deletion-history, Version history>>
+|<<aws-cloudwatch-log-group-deletion, AWS CloudWatch Log Group Deletion>> |Identifies the deletion of a specified AWS CloudWatch log group. When a log group is deleted, all the archived log events associated with the log group are also permanently deleted. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Resources: Investigation Guide], [Tactic: Impact] |8.3.0 |106
 
-|<<aws-cloudwatch-log-group-deletion, AWS CloudWatch Log Group Deletion>> |Identifies the deletion of a specified AWS CloudWatch log group. When a log group is deleted, all the archived log events associated with the log group are also permanently deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Investigation Guide]  |7.9.0 |103 <<aws-cloudwatch-log-group-deletion-history, Version history>>
+|<<aws-cloudwatch-log-stream-deletion, AWS CloudWatch Log Stream Deletion>> |Identifies the deletion of an AWS CloudWatch log stream, which permanently deletes all associated archived log events with the stream. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Tactic: Impact], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<aws-cloudwatch-log-stream-deletion, AWS CloudWatch Log Stream Deletion>> |Identifies the deletion of an AWS CloudWatch log stream, which permanently deletes all associated archived log events with the stream. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Impact] [Investigation Guide]  |7.9.0 |103 <<aws-cloudwatch-log-stream-deletion-history, Version history>>
+|<<aws-config-resource-deletion, AWS Config Resource Deletion>> |Identifies attempts to delete an AWS Config Service resource. An adversary may tamper with Config services in order to reduce visibility into the security posture of an account and / or its workload instances. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.3.0 |106
 
-|<<aws-config-resource-deletion, AWS Config Resource Deletion>> |Identifies attempts to delete an AWS Config Service resource. An adversary may tamper with Config services in order to reduce visibility into the security posture of an account and / or its workload instances. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [Investigation Guide]  |7.9.0 |103 <<aws-config-resource-deletion-history, Version history>>
+|<<aws-configuration-recorder-stopped, AWS Configuration Recorder Stopped>> |Identifies an AWS configuration change to stop recording a designated set of resources. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-configuration-recorder-stopped, AWS Configuration Recorder Stopped>> |Identifies an AWS configuration change to stop recording a designated set of resources. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |101 <<aws-configuration-recorder-stopped-history, Version history>>
+|<<aws-credentials-searched-for-inside-a-container, AWS Credentials Searched For Inside A Container>> |This rule detects the use of system search utilities like grep and find to search for AWS credentials inside a container. Unauthorized access to these sensitive files could lead to further compromise of the container environment or facilitate a container breakout to the underlying cloud environment. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.8.0 |1
 
-|<<aws-deletion-of-rds-instance-or-cluster, AWS Deletion of RDS Instance or Cluster>> |Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora database cluster, global database cluster, or database instance. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.9.0 |101 <<aws-deletion-of-rds-instance-or-cluster-history, Version history>>
+|<<aws-deletion-of-rds-instance-or-cluster, AWS Deletion of RDS Instance or Cluster>> |Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora database cluster, global database cluster, or database instance. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-ec2-encryption-disabled, AWS EC2 Encryption Disabled>> |Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default in the current region. Disabling encryption by default does not change the encryption status of your existing volumes. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection]  |7.9.0 |101 <<aws-ec2-encryption-disabled-history, Version history>>
+|<<aws-ec2-encryption-disabled, AWS EC2 Encryption Disabled>> |Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default in the current region. Disabling encryption by default does not change the encryption status of your existing volumes. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-ec2-full-network-packet-capture-detected, AWS EC2 Full Network Packet Capture Detected>> |Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security]  |7.14.0 |101 <<aws-ec2-full-network-packet-capture-detected-history, Version history>>
+|<<aws-ec2-full-network-packet-capture-detected, AWS EC2 Full Network Packet Capture Detected>> |Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Exfiltration], [Tactic: Collection] |8.3.0 |103
 
-|<<aws-ec2-network-access-control-list-creation, AWS EC2 Network Access Control List Creation>> |Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access control list (ACL) or an entry in a network ACL with a specified rule number. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security]  |7.9.0 |101 <<aws-ec2-network-access-control-list-creation-history, Version history>>
+|<<aws-ec2-network-access-control-list-creation, AWS EC2 Network Access Control List Creation>> |Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access control list (ACL) or an entry in a network ACL with a specified rule number. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-ec2-network-access-control-list-deletion, AWS EC2 Network Access Control List Deletion>> |Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access control list (ACL) or one of its ingress/egress entries. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security]  |7.9.0 |101 <<aws-ec2-network-access-control-list-deletion-history, Version history>>
+|<<aws-ec2-network-access-control-list-deletion, AWS EC2 Network Access Control List Deletion>> |Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access control list (ACL) or one of its ingress/egress entries. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-ec2-snapshot-activity, AWS EC2 Snapshot Activity>> |An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data from an EC2 fleet. If the permissions were modified, verify the snapshot was not shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Exfiltration] [Investigation Guide]  |7.9.0 |103 <<aws-ec2-snapshot-activity-history, Version history>>
+|<<aws-ec2-snapshot-activity, AWS EC2 Snapshot Activity>> |An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data from an EC2 fleet. If the permissions were modified, verify the snapshot was not shared with an unauthorized or unexpected AWS account. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Exfiltration], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<aws-ec2-vm-export-failure, AWS EC2 VM Export Failure>> |Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.14.0 |101 <<aws-ec2-vm-export-failure-history, Version history>>
+|<<aws-ec2-vm-export-failure, AWS EC2 VM Export Failure>> |Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Exfiltration], [Tactic: Collection] |8.3.0 |103
 
-|<<aws-efs-file-system-or-mount-deleted, AWS EFS File System or Mount Deleted>> |Detects when an EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection]  |7.16.0 |101 <<aws-efs-file-system-or-mount-deleted-history, Version history>>
+|<<aws-efs-file-system-or-mount-deleted, AWS EFS File System or Mount Deleted>> |Detects when an EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-elasticache-security-group-created, AWS ElastiCache Security Group Created>> |Identifies when an ElastiCache security group has been created. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.16.0 |101 <<aws-elasticache-security-group-created-history, Version history>>
+|<<aws-elasticache-security-group-created, AWS ElastiCache Security Group Created>> |Identifies when an ElastiCache security group has been created. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-elasticache-security-group-modified-or-deleted, AWS ElastiCache Security Group Modified or Deleted>> |Identifies when an ElastiCache security group has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.16.0 |101 <<aws-elasticache-security-group-modified-or-deleted-history, Version history>>
+|<<aws-elasticache-security-group-modified-or-deleted, AWS ElastiCache Security Group Modified or Deleted>> |Identifies when an ElastiCache security group has been modified or deleted. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-eventbridge-rule-disabled-or-deleted, AWS EventBridge Rule Disabled or Deleted>> |Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or a break in the flow with other AWS services. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [Impact]  |7.16.0 |101 <<aws-eventbridge-rule-disabled-or-deleted-history, Version history>>
+|<<aws-eventbridge-rule-disabled-or-deleted, AWS EventBridge Rule Disabled or Deleted>> |Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or a break in the flow with other AWS services. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-execution-via-system-manager, AWS Execution via System Manager>> |Identifies the execution of commands and scripts via System Manager. Execution methods such as RunShellScript, RunPowerShellScript, and alike can be abused by an authenticated attacker to install a backdoor or to interact with a compromised instance via reverse-shell using system only commands. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Initial Access] [Investigation Guide]  |7.9.0 |103 <<aws-execution-via-system-manager-history, Version history>>
+|<<aws-execution-via-system-manager, AWS Execution via System Manager>> |Identifies the execution of commands and scripts via System Manager. Execution methods such as RunShellScript, RunPowerShellScript, and alike can be abused by an authenticated attacker to install a backdoor or to interact with a compromised instance via reverse-shell using system only commands. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Tactic: Initial Access], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<aws-guardduty-detector-deletion, AWS GuardDuty Detector Deletion>> |Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |101 <<aws-guardduty-detector-deletion-history, Version history>>
+|<<aws-guardduty-detector-deletion, AWS GuardDuty Detector Deletion>> |Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-iam-assume-role-policy-update, AWS IAM Assume Role Policy Update>> |Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may attempt to modify the AssumeRolePolicy of a misconfigured role in order to gain the privileges of that role. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.9.0 |103 <<aws-iam-assume-role-policy-update-history, Version history>>
+|<<aws-iam-assume-role-policy-update, AWS IAM Assume Role Policy Update>> |Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may attempt to modify the AssumeRolePolicy of a misconfigured role in order to gain the privileges of that role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Privilege Escalation] |8.3.0 |106
 
-|<<aws-iam-brute-force-of-assume-role-policy, AWS IAM Brute Force of Assume Role Policy>> |Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.9.0 |103 <<aws-iam-brute-force-of-assume-role-policy-history, Version history>>
+|<<aws-iam-brute-force-of-assume-role-policy, AWS IAM Brute Force of Assume Role Policy>> |Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Credential Access] |8.3.0 |106
 
-|<<aws-iam-deactivation-of-mfa-device, AWS IAM Deactivation of MFA Device>> |Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be deactivated before it can be deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [Investigation Guide]  |7.9.0 |103 <<aws-iam-deactivation-of-mfa-device-history, Version history>>
+|<<aws-iam-deactivation-of-mfa-device, AWS IAM Deactivation of MFA Device>> |Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be deactivated before it can be deleted. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Resources: Investigation Guide], [Tactic: Impact] |8.3.0 |106
 
-|<<aws-iam-group-creation, AWS IAM Group Creation>> |Identifies the creation of a group in AWS Identity and Access Management (IAM). Groups specify permissions for multiple users. Any user in a group automatically has the permissions that are assigned to the group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.9.0 |101 <<aws-iam-group-creation-history, Version history>>
+|<<aws-iam-group-creation, AWS IAM Group Creation>> |Identifies the creation of a group in AWS Identity and Access Management (IAM). Groups specify permissions for multiple users. Any user in a group automatically has the permissions that are assigned to the group. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-iam-group-deletion, AWS IAM Group Deletion>> |Identifies the deletion of a specified AWS Identity and Access Management (IAM) resource group. Deleting a resource group does not delete resources that are members of the group; it only deletes the group structure. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |101 <<aws-iam-group-deletion-history, Version history>>
+|<<aws-iam-group-deletion, AWS IAM Group Deletion>> |Identifies the deletion of a specified AWS Identity and Access Management (IAM) resource group. Deleting a resource group does not delete resources that are members of the group; it only deletes the group structure. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-iam-password-recovery-requested, AWS IAM Password Recovery Requested>> |Identifies AWS IAM password recovery requests. An adversary may attempt to gain unauthorized AWS access by abusing password recovery mechanisms. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.9.0 |101 <<aws-iam-password-recovery-requested-history, Version history>>
+|<<aws-iam-password-recovery-requested, AWS IAM Password Recovery Requested>> |Identifies AWS IAM password recovery requests. An adversary may attempt to gain unauthorized AWS access by abusing password recovery mechanisms. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.3.0 |103
 
-|<<aws-iam-user-addition-to-group, AWS IAM User Addition to Group>> |Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM). |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Credential Access] [Persistence] [Investigation Guide]  |7.9.0 |103 <<aws-iam-user-addition-to-group-history, Version history>>
+|<<aws-iam-user-addition-to-group, AWS IAM User Addition to Group>> |Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM). |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion, AWS KMS Customer Managed Key Disabled or Scheduled for Deletion>> |Identifies attempts to disable or schedule the deletion of an AWS KMS Customer Managed Key (CMK). Deleting an AWS KMS key is destructive and potentially dangerous. It deletes the key material and all metadata associated with the KMS key and is irreversible. After a KMS key is deleted, the data that was encrypted under that KMS key can no longer be decrypted, which means that data becomes unrecoverable. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Impact]  |8.6.0 |1
+|<<aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion, AWS KMS Customer Managed Key Disabled or Scheduled for Deletion>> |Identifies attempts to disable or schedule the deletion of an AWS KMS Customer Managed Key (CMK). Deleting an AWS KMS key is destructive and potentially dangerous. It deletes the key material and all metadata associated with the KMS key and is irreversible. After a KMS key is deleted, the data that was encrypted under that KMS key can no longer be decrypted, which means that data becomes unrecoverable. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Tactic: Impact] |8.3.0 |3
 
-|<<aws-management-console-brute-force-of-root-user-identity, AWS Management Console Brute Force of Root User Identity>> |Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |101 <<aws-management-console-brute-force-of-root-user-identity-history, Version history>>
+|<<aws-management-console-brute-force-of-root-user-identity, AWS Management Console Brute Force of Root User Identity>> |Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |103
 
-|<<aws-management-console-root-login, AWS Management Console Root Login>> |Identifies a successful login to the AWS Management Console by the Root user. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.9.0 |103 <<aws-management-console-root-login-history, Version history>>
+|<<aws-management-console-root-login, AWS Management Console Root Login>> |Identifies a successful login to the AWS Management Console by the Root user. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |106
 
-|<<aws-rds-cluster-creation, AWS RDS Cluster Creation>> |Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora DB cluster or global database spread across multiple regions. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.9.0 |101 <<aws-rds-cluster-creation-history, Version history>>
+|<<aws-rds-cluster-creation, AWS RDS Cluster Creation>> |Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora DB cluster or global database spread across multiple regions. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-rds-instance-creation, AWS RDS Instance Creation>> |Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Persistence]  |7.14.0 |101 <<aws-rds-instance-creation-history, Version history>>
+|<<aws-rds-instance-creation, AWS RDS Instance Creation>> |Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-rds-instance-cluster-stoppage, AWS RDS Instance/Cluster Stoppage>> |Identifies that an Amazon Relational Database Service (RDS) cluster or instance has been stopped. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.9.0 |101 <<aws-rds-instance-cluster-stoppage-history, Version history>>
+|<<aws-rds-instance-cluster-stoppage, AWS RDS Instance/Cluster Stoppage>> |Identifies that an Amazon Relational Database Service (RDS) cluster or instance has been stopped. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-rds-security-group-creation, AWS RDS Security Group Creation>> |Identifies the creation of an Amazon Relational Database Service (RDS) Security group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.14.0 |101 <<aws-rds-security-group-creation-history, Version history>>
+|<<aws-rds-security-group-creation, AWS RDS Security Group Creation>> |Identifies the creation of an Amazon Relational Database Service (RDS) Security group. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-rds-security-group-deletion, AWS RDS Security Group Deletion>> |Identifies the deletion of an Amazon Relational Database Service (RDS) Security group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring]  |7.14.0 |101 <<aws-rds-security-group-deletion-history, Version history>>
+|<<aws-rds-security-group-deletion, AWS RDS Security Group Deletion>> |Identifies the deletion of an Amazon Relational Database Service (RDS) Security group. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Impact] |8.3.0 |103
 
-|<<aws-rds-snapshot-export, AWS RDS Snapshot Export>> |Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Exfiltration]  |7.16.0 |101 <<aws-rds-snapshot-export-history, Version history>>
+|<<aws-rds-snapshot-export, AWS RDS Snapshot Export>> |Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Exfiltration] |8.3.0 |103
 
-|<<aws-rds-snapshot-restored, AWS RDS Snapshot Restored>> |Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data or evade detection after performing malicious activities. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Defense Evasion]  |7.16.0 |101 <<aws-rds-snapshot-restored-history, Version history>>
+|<<aws-rds-snapshot-restored, AWS RDS Snapshot Restored>> |Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data or evade detection after performing malicious activities. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-redshift-cluster-creation, AWS Redshift Cluster Creation>> |Identifies the creation of an Amazon Redshift cluster. Unexpected creation of this cluster by a non-administrative user may indicate a permission or role issue with current users. If unexpected, the resource may not properly be configured and could introduce security vulnerabilities. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Persistence]  |8.3.0 |101 <<aws-redshift-cluster-creation-history, Version history>>
+|<<aws-redshift-cluster-creation, AWS Redshift Cluster Creation>> |Identifies the creation of an Amazon Redshift cluster. Unexpected creation of this cluster by a non-administrative user may indicate a permission or role issue with current users. If unexpected, the resource may not properly be configured and could introduce security vulnerabilities. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-root-login-without-mfa, AWS Root Login Without MFA>> |Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.9.0 |103 <<aws-root-login-without-mfa-history, Version history>>
+|<<aws-root-login-without-mfa, AWS Root Login Without MFA>> |Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Privilege Escalation] |8.3.0 |106
 
-|<<aws-route-53-domain-transfer-lock-disabled, AWS Route 53 Domain Transfer Lock Disabled>> |Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.14.0 |101 <<aws-route-53-domain-transfer-lock-disabled-history, Version history>>
+|<<aws-route-53-domain-transfer-lock-disabled, AWS Route 53 Domain Transfer Lock Disabled>> |Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-route-53-domain-transferred-to-another-account, AWS Route 53 Domain Transferred to Another Account>> |Identifies when a request has been made to transfer a Route 53 domain to another AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.14.0 |101 <<aws-route-53-domain-transferred-to-another-account-history, Version history>>
+|<<aws-route-53-domain-transferred-to-another-account, AWS Route 53 Domain Transferred to Another Account>> |Identifies when a request has been made to transfer a Route 53 domain to another AWS account. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-route-table-created, AWS Route Table Created>> |Identifies when an AWS Route Table has been created. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] [Persistence]  |7.16.0 |101 <<aws-route-table-created-history, Version history>>
+|<<aws-route-table-created, AWS Route Table Created>> |Identifies when an AWS Route Table has been created. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-route-table-modified-or-deleted, AWS Route Table Modified or Deleted>> |Identifies when an AWS Route Table has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] [Persistence]  |7.16.0 |101 <<aws-route-table-modified-or-deleted-history, Version history>>
+|<<aws-route-table-modified-or-deleted, AWS Route Table Modified or Deleted>> |Identifies when an AWS Route Table has been modified or deleted. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-route53-private-hosted-zone-associated-with-a-vpc, AWS Route53 private hosted zone associated with a VPC>> |Identifies when a Route53 private hosted zone has been associated with VPC. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.16.0 |101 <<aws-route53-private-hosted-zone-associated-with-a-vpc-history, Version history>>
+|<<aws-route53-private-hosted-zone-associated-with-a-vpc, AWS Route53 private hosted zone associated with a VPC>> |Identifies when a Route53 private hosted zone has been associated with VPC. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-s3-bucket-configuration-deletion, AWS S3 Bucket Configuration Deletion>> |Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.9.0 |101 <<aws-s3-bucket-configuration-deletion-history, Version history>>
+|<<aws-s3-bucket-configuration-deletion, AWS S3 Bucket Configuration Deletion>> |Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<aws-saml-activity, AWS SAML Activity>> |Identifies when SAML activity has occurred in AWS. An adversary could manipulate SAML to maintain access to the target. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.16.0 |101 <<aws-saml-activity-history, Version history>>
+|<<aws-saml-activity, AWS SAML Activity>> |Identifies when SAML activity has occurred in AWS. An adversary could manipulate SAML to maintain access to the target. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-sts-getsessiontoken-abuse, AWS STS GetSessionToken Abuse>> |Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.16.0 |101 <<aws-sts-getsessiontoken-abuse-history, Version history>>
+|<<aws-sts-getsessiontoken-abuse, AWS STS GetSessionToken Abuse>> |Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.3.0 |103
 
-|<<aws-security-group-configuration-change-detection, AWS Security Group Configuration Change Detection>> |Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security]  |7.15.0 |101 <<aws-security-group-configuration-change-detection-history, Version history>>
+|<<aws-security-group-configuration-change-detection, AWS Security Group Configuration Change Detection>> |Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Persistence] |8.3.0 |103
 
-|<<aws-security-token-service-sts-assumerole-usage, AWS Security Token Service (STS) AssumeRole Usage>> |Identifies the use of AssumeRole. AssumeRole returns a set of temporary security credentials that can be used to access AWS resources. An adversary could use those credentials to move laterally and escalate privileges. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.16.0 |101 <<aws-security-token-service-sts-assumerole-usage-history, Version history>>
+|<<aws-security-token-service-sts-assumerole-usage, AWS Security Token Service (STS) AssumeRole Usage>> |Identifies the use of AssumeRole. AssumeRole returns a set of temporary security credentials that can be used to access AWS resources. An adversary could use those credentials to move laterally and escalate privileges. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.3.0 |103
 
-|<<aws-vpc-flow-logs-deletion, AWS VPC Flow Logs Deletion>> |Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Investigation Guide]  |7.9.0 |103 <<aws-vpc-flow-logs-deletion-history, Version history>>
+|<<aws-vpc-flow-logs-deletion, AWS VPC Flow Logs Deletion>> |Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Log Auditing], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.3.0 |106
 
-|<<aws-waf-access-control-list-deletion, AWS WAF Access Control List Deletion>> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) access control list. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security]  |7.9.0 |101 <<aws-waf-access-control-list-deletion-history, Version history>>
+|<<aws-waf-access-control-list-deletion, AWS WAF Access Control List Deletion>> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) access control list. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<aws-waf-rule-or-rule-group-deletion, AWS WAF Rule or Rule Group Deletion>> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule or rule group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security]  |7.9.0 |101 <<aws-waf-rule-or-rule-group-deletion-history, Version history>>
+|<<aws-waf-rule-or-rule-group-deletion, AWS WAF Rule or Rule Group Deletion>> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule or rule group. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<abnormal-process-id-or-lock-file-created, Abnormal Process ID or Lock File Created>> |Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [BPFDoor] [Investigation Guide]  |8.3.0 |102 <<abnormal-process-id-or-lock-file-created-history, Version history>>
+|<<abnormal-process-id-or-lock-file-created, Abnormal Process ID or Lock File Created>> |Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Threat: BPFDoor], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.6.0 |207
 
-|<<abnormally-large-dns-response, Abnormally Large DNS Response>> |Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service. |[Elastic] [Network] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.10.0 |102 <<abnormally-large-dns-response-history, Version history>>
+|<<abnormally-large-dns-response, Abnormally Large DNS Response>> |Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service. |[Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Use Case: Vulnerability] |8.3.0 |104
 
-|<<accepted-default-telnet-port-connection, Accepted Default Telnet Port Connection>> |This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. |[Elastic] [Host] [Network] [Threat Detection] [Command and Control] [Host] [Lateral Movement] [Initial Access]  |7.6.0 |101 <<accepted-default-telnet-port-connection-history, Version history>>
+|<<accepted-default-telnet-port-connection, Accepted Default Telnet Port Connection>> |This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Lateral Movement], [Tactic: Initial Access] |8.3.0 |103
 
-|<<access-of-stored-browser-credentials, Access of Stored Browser Credentials>> |Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<access-of-stored-browser-credentials-history, Version history>>
+|<<access-of-stored-browser-credentials, Access of Stored Browser Credentials>> |Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<access-to-keychain-credentials-directories, Access to Keychain Credentials Directories>> |Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.10.0 |100 <<access-to-keychain-credentials-directories-history, Version history>>
+|<<access-to-keychain-credentials-directories, Access to Keychain Credentials Directories>> |Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<access-to-a-sensitive-ldap-attribute, Access to a Sensitive LDAP Attribute>> |Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Active Directory]  |8.6.0 |1
+|<<access-to-a-sensitive-ldap-attribute, Access to a Sensitive LDAP Attribute>> |Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |6
 
-|<<account-configured-with-never-expiring-password, Account Configured with Never-Expiring Password>> |Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Active Directory] [Investigation Guide]  |8.2.0 |102 <<account-configured-with-never-expiring-password-history, Version history>>
+|<<account-configured-with-never-expiring-password, Account Configured with Never-Expiring Password>> |Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
 
-|<<account-discovery-command-via-system-account, Account Discovery Command via SYSTEM Account>> |Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide]  |7.7.0 |102 <<account-discovery-command-via-system-account-history, Version history>>
+|<<account-discovery-command-via-system-account, Account Discovery Command via SYSTEM Account>> |Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<account-password-reset-remotely, Account Password Reset Remotely>> |Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |8.0.0 |101 <<account-password-reset-remotely-history, Version history>>
+|<<account-password-reset-remotely, Account Password Reset Remotely>> |Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |106
 
-|<<adfind-command-activity, AdFind Command Activity>> |This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<adfind-command-activity-history, Version history>>
+|<<account-or-group-discovery-via-built-in-tools, Account or Group Discovery via Built-In Tools>> |Adversaries may use built-in applications to get a listing of local system or domain accounts and groups. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |1
 
-|<<adding-hidden-file-attribute-via-attrib, Adding Hidden File Attribute via Attrib>> |Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.6.0 |102 <<adding-hidden-file-attribute-via-attrib-history, Version history>>
+|<<adfind-command-activity, AdFind Command Activity>> |This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<adminsdholder-backdoor, AdminSDHolder Backdoor>> |Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their Administrative Privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Active Directory]  |8.1.0 |100 <<adminsdholder-backdoor-history, Version history>>
+|<<adding-hidden-file-attribute-via-attrib, Adding Hidden File Attribute via Attrib>> |Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |107
 
-|<<adminsdholder-sdprop-exclusion-added, AdminSDHolder SDProp Exclusion Added>> |Identifies a modification on the dsHeuristics attribute on the bit that holds the configuration of groups excluded from the SDProp process. The SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, meaning that groups excluded will remain unchanged. Attackers can abuse this misconfiguration to maintain long-term access to privileged accounts in these groups. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Active Directory] [Investigation Guide]  |8.2.0 |102 <<adminsdholder-sdprop-exclusion-added-history, Version history>>
+|<<adminsdholder-backdoor, AdminSDHolder Backdoor>> |Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their Administrative Privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |105
 
-|<<administrator-privileges-assigned-to-an-okta-group, Administrator Privileges Assigned to an Okta Group>> |Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |102 <<administrator-privileges-assigned-to-an-okta-group-history, Version history>>
+|<<adminsdholder-sdprop-exclusion-added, AdminSDHolder SDProp Exclusion Added>> |Identifies a modification on the dsHeuristics attribute on the bit that holds the configuration of groups excluded from the SDProp process. The SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, meaning that groups excluded will remain unchanged. Attackers can abuse this misconfiguration to maintain long-term access to privileged accounts in these groups. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
 
-|<<administrator-role-assigned-to-an-okta-user, Administrator Role Assigned to an Okta User>> |Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment. |[Elastic] [Okta] [SecOps] [Monitoring] [Continuous Monitoring]  |7.11.0 |102 <<administrator-role-assigned-to-an-okta-user-history, Version history>>
+|<<administrator-privileges-assigned-to-an-okta-group, Administrator Privileges Assigned to an Okta Group>> |Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Persistence] |8.3.0 |103
 
-|<<adobe-hijack-persistence, Adobe Hijack Persistence>> |Detects writing executable files that will be automatically launched by Adobe on launch. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.6.0 |102 <<adobe-hijack-persistence-history, Version history>>
+|<<administrator-role-assigned-to-an-okta-user, Administrator Role Assigned to an Okta User>> |Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment. |[Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |103
 
-|<<adversary-behavior-detected-elastic-endgame, Adversary Behavior - Detected - Elastic Endgame>> |Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame]  |7.6.0 |101 <<adversary-behavior-detected-elastic-endgame-history, Version history>>
+|<<adobe-hijack-persistence, Adobe Hijack Persistence>> |Detects writing executable files that will be automatically launched by Adobe on launch. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<agent-spoofing-mismatched-agent-id, Agent Spoofing - Mismatched Agent ID>> |Detects events that have a mismatch on the expected event agent ID. The status "agent_id_mismatch" occurs when the expected agent ID associated with the API key does not match the actual agent ID in an event. This could indicate attempts to spoof events in order to masquerade actual activity to evade detection. |[Elastic] [Threat Detection] [Defense Evasion]  |7.14.0 |100 <<agent-spoofing-mismatched-agent-id-history, Version history>>
+|<<adversary-behavior-detected-elastic-endgame, Adversary Behavior - Detected - Elastic Endgame>> |Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |102
 
-|<<agent-spoofing-multiple-hosts-using-same-agent, Agent Spoofing - Multiple Hosts Using Same Agent>> |Detects when multiple hosts are using the same agent ID. This could occur in the event of an agent being taken over and used to inject illegitimate documents into an instance as an attempt to spoof events in order to masquerade actual activity to evade detection. |[Elastic] [Threat Detection] [Defense Evasion]  |7.14.0 |100 <<agent-spoofing-multiple-hosts-using-same-agent-history, Version history>>
+|<<agent-spoofing-mismatched-agent-id, Agent Spoofing - Mismatched Agent ID>> |Detects events that have a mismatch on the expected event agent ID. The status "agent_id_mismatch" occurs when the expected agent ID associated with the API key does not match the actual agent ID in an event. This could indicate attempts to spoof events in order to masquerade actual activity to evade detection. |[Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |101
 
-|<<anomalous-linux-compiler-activity, Anomalous Linux Compiler Activity>> |Looks for compiler activity by a user context which does not normally run compilers. This can be the result of ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity. |[Elastic] [Host] [Linux] [Threat Detection] [ML] [Resource Development]  |7.10.0 |100 <<anomalous-linux-compiler-activity-history, Version history>>
+|<<agent-spoofing-multiple-hosts-using-same-agent, Agent Spoofing - Multiple Hosts Using Same Agent>> |Detects when multiple hosts are using the same agent ID. This could occur in the event of an agent being taken over and used to inject illegitimate documents into an instance as an attempt to spoof events in order to masquerade actual activity to evade detection. |[Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |101
 
-|<<anomalous-process-for-a-linux-population, Anomalous Process For a Linux Population>> |Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. |[Elastic] [Host] [Linux] [Threat Detection] [ML] [Persistence]  |7.7.0 |100 <<anomalous-process-for-a-linux-population-history, Version history>>
+|<<anomalous-linux-compiler-activity, Anomalous Linux Compiler Activity>> |Looks for compiler activity by a user context which does not normally run compilers. This can be the result of ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Resource Development] |8.3.0 |102
 
-|<<anomalous-process-for-a-windows-population, Anomalous Process For a Windows Population>> |Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Persistence]  |7.7.0 |100 <<anomalous-process-for-a-windows-population-history, Version history>>
+|<<anomalous-process-for-a-linux-population, Anomalous Process For a Linux Population>> |Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |103
 
-|<<anomalous-windows-process-creation, Anomalous Windows Process Creation>> |Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Persistence]  |7.7.0 |100 <<anomalous-windows-process-creation-history, Version history>>
+|<<anomalous-process-for-a-windows-population, Anomalous Process For a Windows Population>> |Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence], [Tactic: Execution] |8.3.0 |104
 
-|<<apple-script-execution-followed-by-network-connection, Apple Script Execution followed by Network Connection>> |Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. |[Elastic] [Host] [macOS] [Threat Detection] [Command and Control] [Execution]  |7.11.0 |100 <<apple-script-execution-followed-by-network-connection-history, Version history>>
+|<<anomalous-windows-process-creation, Anomalous Windows Process Creation>> |Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<apple-scripting-execution-with-administrator-privileges, Apple Scripting Execution with Administrator Privileges>> |Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges. |[Elastic] [Host] [macOS] [Threat Detection] [Execution] [Privilege Escalation]  |7.12.0 |100 <<apple-scripting-execution-with-administrator-privileges-history, Version history>>
+|<<apple-script-execution-followed-by-network-connection, Apple Script Execution followed by Network Connection>> |Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Execution] |8.3.0 |103
 
-|<<application-added-to-google-workspace-domain, Application Added to Google Workspace Domain>> |Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence]  |7.11.0 |101 <<application-added-to-google-workspace-domain-history, Version history>>
+|<<apple-scripting-execution-with-administrator-privileges, Apple Scripting Execution with Administrator Privileges>> |Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation] |8.3.0 |103
 
-|<<application-removed-from-blocklist-in-google-workspace, Application Removed from Blocklist in Google Workspace>> |Google Workspace administrators may be aware of malicious applications within the Google marketplace and block these applications for user security purposes. An adversary, with administrative privileges, may remove this application from the explicit block list to allow distribution of the application amongst users. This may also indicate the unauthorized use of an application that had been previously blocked before by a user with admin privileges. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Impair Defenses]  |8.5.0 |2 <<application-removed-from-blocklist-in-google-workspace-history, Version history>>
+|<<application-added-to-google-workspace-domain, Application Added to Google Workspace Domain>> |Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |205
 
-|<<attempt-to-create-okta-api-token, Attempt to Create Okta API Token>> |Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |102 <<attempt-to-create-okta-api-token-history, Version history>>
+|<<application-removed-from-blocklist-in-google-workspace, Application Removed from Blocklist in Google Workspace>> |Google Workspace administrators may be aware of malicious applications within the Google marketplace and block these applications for user security purposes. An adversary, with administrative privileges, may remove this application from the explicit block list to allow distribution of the application amongst users. This may also indicate the unauthorized use of an application that had been previously blocked before by a user with admin privileges. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.4.0 |106
 
-|<<attempt-to-deactivate-mfa-for-an-okta-user-account, Attempt to Deactivate MFA for an Okta User Account>> |Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.9.0 |102 <<attempt-to-deactivate-mfa-for-an-okta-user-account-history, Version history>>
+|<<attempt-to-create-okta-api-token, Attempt to Create Okta API Token>> |Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Persistence] |8.3.0 |103
 
-|<<attempt-to-deactivate-an-okta-application, Attempt to Deactivate an Okta Application>> |Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact]  |7.11.0 |102 <<attempt-to-deactivate-an-okta-application-history, Version history>>
+|<<attempt-to-deactivate-mfa-for-an-okta-user-account, Attempt to Deactivate MFA for an Okta User Account>> |Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |103
 
-|<<attempt-to-deactivate-an-okta-network-zone, Attempt to Deactivate an Okta Network Zone>> |Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion]  |7.11.0 |102 <<attempt-to-deactivate-an-okta-network-zone-history, Version history>>
+|<<attempt-to-deactivate-an-okta-application, Attempt to Deactivate an Okta Application>> |Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.3.0 |104
 
-|<<attempt-to-deactivate-an-okta-policy, Attempt to Deactivate an Okta Policy>> |Detects attempts to deactivate an Okta policy. An adversary may attempt to deactivate an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to deactivate an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion]  |7.9.0 |102 <<attempt-to-deactivate-an-okta-policy-history, Version history>>
+|<<attempt-to-deactivate-an-okta-network-zone, Attempt to Deactivate an Okta Network Zone>> |Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-deactivate-an-okta-policy-rule, Attempt to Deactivate an Okta Policy Rule>> |Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion]  |7.9.0 |102 <<attempt-to-deactivate-an-okta-policy-rule-history, Version history>>
+|<<attempt-to-deactivate-an-okta-policy, Attempt to Deactivate an Okta Policy>> |Detects attempts to deactivate an Okta policy. An adversary may attempt to deactivate an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to deactivate an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-delete-an-okta-application, Attempt to Delete an Okta Application>> |Detects attempts to delete an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact]  |7.11.0 |102 <<attempt-to-delete-an-okta-application-history, Version history>>
+|<<attempt-to-deactivate-an-okta-policy-rule, Attempt to Deactivate an Okta Policy Rule>> |Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-delete-an-okta-network-zone, Attempt to Delete an Okta Network Zone>> |Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion]  |7.11.0 |102 <<attempt-to-delete-an-okta-network-zone-history, Version history>>
+|<<attempt-to-delete-an-okta-application, Attempt to Delete an Okta Application>> |Detects attempts to delete an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.3.0 |103
 
-|<<attempt-to-delete-an-okta-policy, Attempt to Delete an Okta Policy>> |Detects attempts to delete an Okta policy. An adversary may attempt to delete an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to delete an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion]  |7.9.0 |102 <<attempt-to-delete-an-okta-policy-history, Version history>>
+|<<attempt-to-delete-an-okta-network-zone, Attempt to Delete an Okta Network Zone>> |Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-delete-an-okta-policy-rule, Attempt to Delete an Okta Policy Rule>> |Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion]  |7.11.0 |102 <<attempt-to-delete-an-okta-policy-rule-history, Version history>>
+|<<attempt-to-delete-an-okta-policy, Attempt to Delete an Okta Policy>> |Detects attempts to delete an Okta policy. An adversary may attempt to delete an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to delete an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-disable-gatekeeper, Attempt to Disable Gatekeeper>> |Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<attempt-to-disable-gatekeeper-history, Version history>>
+|<<attempt-to-delete-an-okta-policy-rule, Attempt to Delete an Okta Policy Rule>> |Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-disable-syslog-service, Attempt to Disable Syslog Service>> |Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.8.0 |100 <<attempt-to-disable-syslog-service-history, Version history>>
+|<<attempt-to-disable-gatekeeper, Attempt to Disable Gatekeeper>> |Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> |Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<attempt-to-enable-the-root-account-history, Version history>>
+|<<attempt-to-disable-iptables-or-firewall, Attempt to Disable IPTables or Firewall>> |Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |2
 
-|<<attempt-to-install-root-certificate, Attempt to Install Root Certificate>> |Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<attempt-to-install-root-certificate-history, Version history>>
+|<<attempt-to-disable-syslog-service, Attempt to Disable Syslog Service>> |Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<attempt-to-modify-an-okta-application, Attempt to Modify an Okta Application>> |Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact]  |7.11.0 |102 <<attempt-to-modify-an-okta-application-history, Version history>>
+|<<attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> |Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<attempt-to-modify-an-okta-network-zone, Attempt to Modify an Okta Network Zone>> |Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion]  |7.9.0 |102 <<attempt-to-modify-an-okta-network-zone-history, Version history>>
+|<<attempt-to-install-kali-linux-via-wsl, Attempt to Install Kali Linux via WSL>> |Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |4
 
-|<<attempt-to-modify-an-okta-policy, Attempt to Modify an Okta Policy>> |Detects attempts to modify an Okta policy. An adversary may attempt to modify an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to modify an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion]  |7.9.0 |102 <<attempt-to-modify-an-okta-policy-history, Version history>>
+|<<attempt-to-install-root-certificate, Attempt to Install Root Certificate>> |Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<attempt-to-modify-an-okta-policy-rule, Attempt to Modify an Okta Policy Rule>> |Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion]  |7.9.0 |102 <<attempt-to-modify-an-okta-policy-rule-history, Version history>>
+|<<attempt-to-modify-an-okta-application, Attempt to Modify an Okta Application>> |Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.3.0 |103
 
-|<<attempt-to-mount-smb-share-via-command-line, Attempt to Mount SMB Share via Command Line>> |Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB. |[Elastic] [Host] [macOS] [Threat Detection] [Lateral Movement]  |7.12.0 |100 <<attempt-to-mount-smb-share-via-command-line-history, Version history>>
+|<<attempt-to-modify-an-okta-network-zone, Attempt to Modify an Okta Network Zone>> |Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-remove-file-quarantine-attribute, Attempt to Remove File Quarantine Attribute>> |Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.11.0 |100 <<attempt-to-remove-file-quarantine-attribute-history, Version history>>
+|<<attempt-to-modify-an-okta-policy, Attempt to Modify an Okta Policy>> |Detects attempts to modify an Okta policy. An adversary may attempt to modify an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to modify an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-reset-mfa-factors-for-an-okta-user-account, Attempt to Reset MFA Factors for an Okta User Account>> |Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.9.0 |102 <<attempt-to-reset-mfa-factors-for-an-okta-user-account-history, Version history>>
+|<<attempt-to-modify-an-okta-policy-rule, Attempt to Modify an Okta Policy Rule>> |Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<attempt-to-revoke-okta-api-token, Attempt to Revoke Okta API Token>> |Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |102 <<attempt-to-revoke-okta-api-token-history, Version history>>
+|<<attempt-to-mount-smb-share-via-command-line, Attempt to Mount SMB Share via Command Line>> |Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |103
 
-|<<attempt-to-unload-elastic-endpoint-security-kernel-extension, Attempt to Unload Elastic Endpoint Security Kernel Extension>> |Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<attempt-to-unload-elastic-endpoint-security-kernel-extension-history, Version history>>
+|<<attempt-to-remove-file-quarantine-attribute, Attempt to Remove File Quarantine Attribute>> |Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<attempted-bypass-of-okta-mfa, Attempted Bypass of Okta MFA>> |Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.9.0 |102 <<attempted-bypass-of-okta-mfa-history, Version history>>
+|<<attempt-to-reset-mfa-factors-for-an-okta-user-account, Attempt to Reset MFA Factors for an Okta User Account>> |Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |103
 
-|<<attempts-to-brute-force-a-microsoft-365-user-account, Attempts to Brute Force a Microsoft 365 User Account>> |Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<attempts-to-brute-force-a-microsoft-365-user-account-history, Version history>>
+|<<attempt-to-revoke-okta-api-token, Attempt to Revoke Okta API Token>> |Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.3.0 |104
 
-|<<attempts-to-brute-force-an-okta-user-account, Attempts to Brute Force an Okta User Account>> |Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<attempts-to-brute-force-an-okta-user-account-history, Version history>>
+|<<attempt-to-unload-elastic-endpoint-security-kernel-extension, Attempt to Unload Elastic Endpoint Security Kernel Extension>> |Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<authorization-plugin-modification, Authorization Plugin Modification>> |Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<authorization-plugin-modification-history, Version history>>
+|<<attempted-bypass-of-okta-mfa, Attempted Bypass of Okta MFA>> |Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |104
 
-|<<azure-ad-global-administrator-role-assigned, Azure AD Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |8.1.0 |101 <<azure-ad-global-administrator-role-assigned-history, Version history>>
+|<<attempts-to-brute-force-a-microsoft-365-user-account, Attempts to Brute Force a Microsoft 365 User Account>> |Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |102
 
-|<<azure-active-directory-high-risk-sign-in, Azure Active Directory High Risk Sign-in>> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.12.0 |103 <<azure-active-directory-high-risk-sign-in-history, Version history>>
+|<<attempts-to-brute-force-an-okta-user-account, Attempts to Brute Force an Okta User Account>> |Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |104
 
-|<<azure-active-directory-high-risk-user-sign-in-heuristic, Azure Active Directory High Risk User Sign-in Heuristic>> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |8.0.0 |103 <<azure-active-directory-high-risk-user-sign-in-heuristic-history, Version history>>
+|<<authorization-plugin-modification, Authorization Plugin Modification>> |Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<azure-active-directory-powershell-sign-in, Azure Active Directory PowerShell Sign-in>> |Identifies a sign-in using the Azure Active Directory PowerShell module. PowerShell for Azure Active Directory allows for managing settings from the command line, which is intended for users who are members of an admin role. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.11.0 |103 <<azure-active-directory-powershell-sign-in-history, Version history>>
+|<<azure-ad-global-administrator-role-assigned, Azure AD Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<azure-alert-suppression-rule-created-or-modified, Azure Alert Suppression Rule Created or Modified>> |Identifies the creation of suppression rules in Azure. Suppression rules are a mechanism used to suppress alerts previously identified as false positives or too noisy to be in production. This mechanism can be abused or mistakenly configured, resulting in defense evasions and loss of security visibility. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit]  |8.0.0 |101 <<azure-alert-suppression-rule-created-or-modified-history, Version history>>
+|<<azure-active-directory-high-risk-sign-in, Azure Active Directory High Risk Sign-in>> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |105
 
-|<<azure-application-credential-modification, Azure Application Credential Modification>> |Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<azure-application-credential-modification-history, Version history>>
+|<<azure-active-directory-high-risk-user-sign-in-heuristic, Azure Active Directory High Risk User Sign-in Heuristic>> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |105
 
-|<<azure-automation-account-created, Azure Automation Account Created>> |Identifies when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. An adversary may create an Automation account in order to maintain persistence in their target's environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |101 <<azure-automation-account-created-history, Version history>>
+|<<azure-active-directory-powershell-sign-in, Azure Active Directory PowerShell Sign-in>> |Identifies a sign-in using the Azure Active Directory PowerShell module. PowerShell for Azure Active Directory allows for managing settings from the command line, which is intended for users who are members of an admin role. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |105
 
-|<<azure-automation-runbook-created-or-modified, Azure Automation Runbook Created or Modified>> |Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure Automation runbook to execute malicious code and maintain persistence in their target's environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |101 <<azure-automation-runbook-created-or-modified-history, Version history>>
+|<<azure-alert-suppression-rule-created-or-modified, Azure Alert Suppression Rule Created or Modified>> |Identifies the creation of suppression rules in Azure. Suppression rules are a mechanism used to suppress alerts previously identified as false positives or too noisy to be in production. This mechanism can be abused or mistakenly configured, resulting in defense evasions and loss of security visibility. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-automation-runbook-deleted, Azure Automation Runbook Deleted>> |Identifies when an Azure Automation runbook is deleted. An adversary may delete an Azure Automation runbook in order to disrupt their target's automated business operations or to remove a malicious runbook for defense evasion. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |7.10.0 |101 <<azure-automation-runbook-deleted-history, Version history>>
+|<<azure-application-credential-modification, Azure Application Credential Modification>> |Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-automation-webhook-created, Azure Automation Webhook Created>> |Identifies when an Azure Automation webhook is created. Azure Automation runbooks can be configured to execute via a webhook. A webhook uses a custom URL passed to Azure Automation along with a data payload specific to the runbook. An adversary may create a webhook in order to trigger a runbook that contains malicious code. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |101 <<azure-automation-webhook-created-history, Version history>>
+|<<azure-automation-account-created, Azure Automation Account Created>> |Identifies when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. An adversary may create an Automation account in order to maintain persistence in their target's environment. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<azure-blob-container-access-level-modification, Azure Blob Container Access Level Modification>> |Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.10.0 |101 <<azure-blob-container-access-level-modification-history, Version history>>
+|<<azure-automation-runbook-created-or-modified, Azure Automation Runbook Created or Modified>> |Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure Automation runbook to execute malicious code and maintain persistence in their target's environment. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<azure-blob-permissions-modification, Azure Blob Permissions Modification>> |Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.16.0 |101 <<azure-blob-permissions-modification-history, Version history>>
+|<<azure-automation-runbook-deleted, Azure Automation Runbook Deleted>> |Identifies when an Azure Automation runbook is deleted. An adversary may delete an Azure Automation runbook in order to disrupt their target's automated business operations or to remove a malicious runbook for defense evasion. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-command-execution-on-virtual-machine, Azure Command Execution on Virtual Machine>> |Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machine Contributor role lets you manage virtual machines, but not access them, nor access the virtual network or storage account they’re connected to. However, commands can be run via PowerShell on the VM, which execute as System. Other roles, such as certain Administrator roles may be able to execute commands on a VM as well. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |101 <<azure-command-execution-on-virtual-machine-history, Version history>>
+|<<azure-automation-webhook-created, Azure Automation Webhook Created>> |Identifies when an Azure Automation webhook is created. Azure Automation runbooks can be configured to execute via a webhook. A webhook uses a custom URL passed to Azure Automation along with a data payload specific to the runbook. An adversary may create a webhook in order to trigger a runbook that contains malicious code. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<azure-conditional-access-policy-modified, Azure Conditional Access Policy Modified>> |Identifies when an Azure Conditional Access policy is modified. Azure Conditional Access policies control access to resources via if-then statements. For example, if a user wants to access a resource, then they must complete an action such as using multi-factor authentication to access it. An adversary may modify a Conditional Access policy in order to weaken their target's security controls. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |101 <<azure-conditional-access-policy-modified-history, Version history>>
+|<<azure-blob-container-access-level-modification, Azure Blob Container Access Level Modification>> |Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously. |[Domain: Cloud], [Data Source: Azure], [Use Case: Asset Visibility], [Tactic: Discovery] |8.3.0 |102
 
-|<<azure-diagnostic-settings-deletion, Azure Diagnostic Settings Deletion>> |Identifies the deletion of diagnostic settings in Azure, which send platform logs and metrics to different destinations. An adversary may delete diagnostic settings in an attempt to evade defenses. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Monitoring]  |7.10.0 |101 <<azure-diagnostic-settings-deletion-history, Version history>>
+|<<azure-blob-permissions-modification, Azure Blob Permissions Modification>> |Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-event-hub-authorization-rule-created-or-updated, Azure Event Hub Authorization Rule Created or Updated>> |Identifies when an Event Hub Authorization Rule is created or updated in Azure. An authorization rule is associated with specific rights, and carries a pair of cryptographic keys. When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is created for the namespace. This has manage permissions for the entire namespace and it's recommended that you treat this rule like an administrative root account and don't use it in your application. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |101 <<azure-event-hub-authorization-rule-created-or-updated-history, Version history>>
+|<<azure-command-execution-on-virtual-machine, Azure Command Execution on Virtual Machine>> |Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machine Contributor role lets you manage virtual machines, but not access them, nor access the virtual network or storage account they’re connected to. However, commands can be run via PowerShell on the VM, which execute as System. Other roles, such as certain Administrator roles may be able to execute commands on a VM as well. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Execution] |8.3.0 |102
 
-|<<azure-event-hub-deletion, Azure Event Hub Deletion>> |Identifies an Event Hub deletion in Azure. An Event Hub is an event processing service that ingests and processes large volumes of events and data. An adversary may delete an Event Hub in an attempt to evade detection. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |101 <<azure-event-hub-deletion-history, Version history>>
+|<<azure-conditional-access-policy-modified, Azure Conditional Access Policy Modified>> |Identifies when an Azure Conditional Access policy is modified. Azure Conditional Access policies control access to resources via if-then statements. For example, if a user wants to access a resource, then they must complete an action such as using multi-factor authentication to access it. An adversary may modify a Conditional Access policy in order to weaken their target's security controls. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<azure-external-guest-user-invitation, Azure External Guest User Invitation>> |Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account. Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users could potentially be overlooked indefinitely leading to a potential vulnerability. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |101 <<azure-external-guest-user-invitation-history, Version history>>
+|<<azure-diagnostic-settings-deletion, Azure Diagnostic Settings Deletion>> |Identifies the deletion of diagnostic settings in Azure, which send platform logs and metrics to different destinations. An adversary may delete diagnostic settings in an attempt to evade defenses. |[Domain: Cloud], [Data Source: Azure], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-firewall-policy-deletion, Azure Firewall Policy Deletion>> |Identifies the deletion of a firewall policy in Azure. An adversary may delete a firewall policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security]  |7.10.0 |101 <<azure-firewall-policy-deletion-history, Version history>>
+|<<azure-event-hub-authorization-rule-created-or-updated, Azure Event Hub Authorization Rule Created or Updated>> |Identifies when an Event Hub Authorization Rule is created or updated in Azure. An authorization rule is associated with specific rights, and carries a pair of cryptographic keys. When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is created for the namespace. This has manage permissions for the entire namespace and it's recommended that you treat this rule like an administrative root account and don't use it in your application. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Collection] |8.3.0 |103
 
-|<<azure-frontdoor-web-application-firewall-waf-policy-deleted, Azure Frontdoor Web Application Firewall (WAF) Policy Deleted>> |Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security]  |7.16.0 |101 <<azure-frontdoor-web-application-firewall-waf-policy-deleted-history, Version history>>
+|<<azure-event-hub-deletion, Azure Event Hub Deletion>> |Identifies an Event Hub deletion in Azure. An Event Hub is an event processing service that ingests and processes large volumes of events and data. An adversary may delete an Event Hub in an attempt to evade detection. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-full-network-packet-capture-detected, Azure Full Network Packet Capture Detected>> |Identifies potential full network packet capture in Azure. Packet Capture is an Azure Network Watcher feature that can be used to inspect network traffic. This feature can potentially be abused to read sensitive data from unencrypted internal traffic. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Monitoring]  |7.16.0 |101 <<azure-full-network-packet-capture-detected-history, Version history>>
+|<<azure-external-guest-user-invitation, Azure External Guest User Invitation>> |Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account. Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users could potentially be overlooked indefinitely leading to a potential vulnerability. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.3.0 |102
 
-|<<azure-global-administrator-role-addition-to-pim-user, Azure Global Administrator Role Addition to PIM User>> |Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |101 <<azure-global-administrator-role-addition-to-pim-user-history, Version history>>
+|<<azure-firewall-policy-deletion, Azure Firewall Policy Deletion>> |Identifies the deletion of a firewall policy in Azure. An adversary may delete a firewall policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Domain: Cloud], [Data Source: Azure], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-key-vault-modified, Azure Key Vault Modified>> |Identifies modifications to a Key Vault in Azure. The Key Vault is a service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. Because this data is sensitive and business critical, access to key vaults should be secured to allow only authorized applications and users. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Data Protection]  |7.10.0 |102 <<azure-key-vault-modified-history, Version history>>
+|<<azure-frontdoor-web-application-firewall-waf-policy-deleted, Azure Frontdoor Web Application Firewall (WAF) Policy Deleted>> |Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Domain: Cloud], [Data Source: Azure], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-kubernetes-events-deleted, Azure Kubernetes Events Deleted>> |Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes. Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.16.0 |101 <<azure-kubernetes-events-deleted-history, Version history>>
+|<<azure-full-network-packet-capture-detected, Azure Full Network Packet Capture Detected>> |Identifies potential full network packet capture in Azure. Packet Capture is an Azure Network Watcher feature that can be used to inspect network traffic. This feature can potentially be abused to read sensitive data from unencrypted internal traffic. |[Domain: Cloud], [Data Source: Azure], [Tactic: Credential Access] |8.3.0 |103
 
-|<<azure-kubernetes-pods-deleted, Azure Kubernetes Pods Deleted>> |Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kubernetes pod to disrupt the normal behavior of the environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Asset Visibility]  |7.16.0 |101 <<azure-kubernetes-pods-deleted-history, Version history>>
+|<<azure-global-administrator-role-addition-to-pim-user, Azure Global Administrator Role Addition to PIM User>> |Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<azure-kubernetes-rolebindings-created, Azure Kubernetes Rolebindings Created>> |Identifies the creation of role binding or cluster role bindings. You can assign these roles to Kubernetes subjects (users, groups, or service accounts) with role bindings and cluster role bindings. An adversary who has permissions to create bindings and cluster-bindings in the cluster can create a binding to the cluster-admin ClusterRole or to other high privileges roles. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |8.0.0 |101 <<azure-kubernetes-rolebindings-created-history, Version history>>
+|<<azure-key-vault-modified, Azure Key Vault Modified>> |Identifies modifications to a Key Vault in Azure. The Key Vault is a service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. Because this data is sensitive and business critical, access to key vaults should be secured to allow only authorized applications and users. |[Domain: Cloud], [Data Source: Azure], [Tactic: Credential Access] |8.3.0 |103
 
-|<<azure-network-watcher-deletion, Azure Network Watcher Deletion>> |Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security]  |7.10.0 |101 <<azure-network-watcher-deletion-history, Version history>>
+|<<azure-kubernetes-events-deleted, Azure Kubernetes Events Deleted>> |Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes. Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-privilege-identity-management-role-modified, Azure Privilege Identity Management Role Modified>> |Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator. An adversary may add a user to a PIM role in order to maintain persistence in their target's environment or modify a PIM role to weaken their target's security controls. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.10.0 |103 <<azure-privilege-identity-management-role-modified-history, Version history>>
+|<<azure-kubernetes-pods-deleted, Azure Kubernetes Pods Deleted>> |Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kubernetes pod to disrupt the normal behavior of the environment. |[Domain: Cloud], [Data Source: Azure], [Use Case: Asset Visibility], [Tactic: Impact] |8.3.0 |102
 
-|<<azure-resource-group-deletion, Azure Resource Group Deletion>> |Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |101 <<azure-resource-group-deletion-history, Version history>>
+|<<azure-kubernetes-rolebindings-created, Azure Kubernetes Rolebindings Created>> |Identifies the creation of role binding or cluster role bindings. You can assign these roles to Kubernetes subjects (users, groups, or service accounts) with role bindings and cluster role bindings. An adversary who has permissions to create bindings and cluster-bindings in the cluster can create a binding to the cluster-admin ClusterRole or to other high privileges roles. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<azure-service-principal-addition, Azure Service Principal Addition>> |Identifies when a new service principal is added in Azure. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.11.0 |103 <<azure-service-principal-addition-history, Version history>>
+|<<azure-network-watcher-deletion, Azure Network Watcher Deletion>> |Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses. |[Domain: Cloud], [Data Source: Azure], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<azure-service-principal-credentials-added, Azure Service Principal Credentials Added>> |Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.14.0 |101 <<azure-service-principal-credentials-added-history, Version history>>
+|<<azure-privilege-identity-management-role-modified, Azure Privilege Identity Management Role Modified>> |Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator. An adversary may add a user to a PIM role in order to maintain persistence in their target's environment or modify a PIM role to weaken their target's security controls. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |8.3.0 |105
 
-|<<azure-storage-account-key-regenerated, Azure Storage Account Key Regenerated>> |Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |101 <<azure-storage-account-key-regenerated-history, Version history>>
+|<<azure-resource-group-deletion, Azure Resource Group Deletion>> |Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Impact] |8.3.0 |102
 
-|<<azure-virtual-network-device-modified-or-deleted, Azure Virtual Network Device Modified or Deleted>> |Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub, or virtual router. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] [Impact]  |7.16.0 |101 <<azure-virtual-network-device-modified-or-deleted-history, Version history>>
+|<<azure-service-principal-addition, Azure Service Principal Addition>> |Identifies when a new service principal is added in Azure. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.3.0 |105
 
-|<<bpf-filter-applied-using-tc, BPF filter applied using TC>> |Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [TripleCross]  |8.4.0 |100 <<bpf-filter-applied-using-tc-history, Version history>>
+|<<azure-service-principal-credentials-added, Azure Service Principal Credentials Added>> |Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Impact] |8.3.0 |102
 
-|<<base16-or-base32-encoding-decoding-activity, Base16 or Base32 Encoding/Decoding Activity>> |Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.8.0 |100 <<base16-or-base32-encoding-decoding-activity-history, Version history>>
+|<<azure-storage-account-key-regenerated, Azure Storage Account Key Regenerated>> |Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |102
 
-|<<bash-shell-profile-modification, Bash Shell Profile Modification>> |Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are run when Bash is invoked. These files are executed in a user's context, either interactively or non-interactively, when a user logs in so that their environment is set correctly. Adversaries may abuse this to establish persistence by executing malicious content triggered by a user’s shell. |[Elastic] [Host] [macOS] [Linux] [Threat Detection] [Persistence]  |7.12.0 |100 <<bash-shell-profile-modification-history, Version history>>
+|<<azure-virtual-network-device-modified-or-deleted, Azure Virtual Network Device Modified or Deleted>> |Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub, or virtual router. |[Domain: Cloud], [Data Source: Azure], [Use Case: Network Security Monitoring], [Tactic: Impact] |8.3.0 |102
 
-|<<binary-executed-from-shared-memory-directory, Binary Executed from Shared Memory Directory>> |Identifies the execution of a binary by root in Linux shared memory directories: (/dev/shm/, /run/shm/, /var/run/, /var/lock/). This activity is to be considered highly abnormal and should be investigated. Threat actors have placed executables used for persistence on high-uptime servers in these directories as system backdoors. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [BPFDoor]  |8.3.0 |101 <<binary-executed-from-shared-memory-directory-history, Version history>>
+|<<bpf-filter-applied-using-tc, BPF filter applied using TC>> |Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Threat: TripleCross], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |7.7.0 |102 <<bypass-uac-via-event-viewer-history, Version history>>
+|<<base16-or-base32-encoding-decoding-activity, Base16 or Base32 Encoding/Decoding Activity>> |Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<chkconfig-service-add, Chkconfig Service Add>> |Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence] [Lightning Framework]  |8.4.0 |100 <<chkconfig-service-add-history, Version history>>
+|<<bash-shell-profile-modification, Bash Shell Profile Modification>> |Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are run when Bash is invoked. These files are executed in a user's context, either interactively or non-interactively, when a user logs in so that their environment is set correctly. Adversaries may abuse this to establish persistence by executing malicious content triggered by a user’s shell. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |102
 
-|<<clearing-windows-console-history, Clearing Windows Console History>> |Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |8.0.0 |102 <<clearing-windows-console-history-history, Version history>>
+|<<binary-executed-from-shared-memory-directory, Binary Executed from Shared Memory Directory>> |Identifies the execution of a binary by root in Linux shared memory directories: (/dev/shm/, /run/shm/, /var/run/, /var/lock/). This activity is to be considered highly abnormal and should be investigated. Threat actors have placed executables used for persistence on high-uptime servers in these directories as system backdoors. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Threat: BPFDoor], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<clearing-windows-event-logs, Clearing Windows Event Logs>> |Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.6.0 |102 <<clearing-windows-event-logs-history, Version history>>
+|<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<cobalt-strike-command-and-control-beacon, Cobalt Strike Command and Control Beacon>> |Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. |[Elastic] [Network] [Threat Detection] [Command and Control] [Host]  |7.10.0 |101 <<cobalt-strike-command-and-control-beacon-history, Version history>>
+|<<bypass-uac-via-sdclt, Bypass UAC via Sdclt>> |Identifies User Account Control (UAC) bypass via sdclt.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |None |1
 
-|<<command-execution-via-solarwinds-process, Command Execution via SolarWinds Process>> |A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.11.0 |102 <<command-execution-via-solarwinds-process-history, Version history>>
+|<<chkconfig-service-add, Chkconfig Service Add>> |Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Lightning Framework], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<command-prompt-network-connection, Command Prompt Network Connection>> |Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL. |[Elastic] [Host] [Windows] [Threat Detection] [Execution]  |7.6.0 |100 <<command-prompt-network-connection-history, Version history>>
+|<<clearing-windows-console-history, Clearing Windows Console History>> |Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<command-shell-activity-started-via-rundll32, Command Shell Activity Started via RunDLL32>> |Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.11.0 |101 <<command-shell-activity-started-via-rundll32-history, Version history>>
+|<<clearing-windows-event-logs, Clearing Windows Event Logs>> |Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<component-object-model-hijacking, Component Object Model Hijacking>> |Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.11.0 |102 <<component-object-model-hijacking-history, Version history>>
+|<<cobalt-strike-command-and-control-beacon, Cobalt Strike Command and Control Beacon>> |Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |103
 
-|<<conhost-spawned-by-suspicious-parent-process, Conhost Spawned By Suspicious Parent Process>> |Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<conhost-spawned-by-suspicious-parent-process-history, Version history>>
+|<<code-signing-policy-modification-through-built-in-tools, Code Signing Policy Modification Through Built-in tools>> |Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |4
 
-|<<connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> |Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control]  |7.11.0 |100 <<connection-to-commonly-abused-free-ssl-certificate-providers-history, Version history>>
+|<<code-signing-policy-modification-through-registry, Code Signing Policy Modification Through Registry>> |Identifies attempts to disable/modify the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |4
 
-|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide]  |7.11.0 |102 <<connection-to-commonly-abused-web-services-history, Version history>>
+|<<command-execution-via-solarwinds-process, Command Execution via SolarWinds Process>> |A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<connection-to-external-network-via-telnet, Connection to External Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. |[Elastic] [Host] [Linux] [Threat Detection] [Lateral Movement]  |7.8.0 |100 <<connection-to-external-network-via-telnet-history, Version history>>
+|<<command-prompt-network-connection, Command Prompt Network Connection>> |Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<connection-to-internal-network-via-telnet, Connection to Internal Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to non-publicly routable IP addresses. |[Elastic] [Host] [Linux] [Threat Detection] [Lateral Movement]  |7.8.0 |100 <<connection-to-internal-network-via-telnet-history, Version history>>
+|<<command-shell-activity-started-via-rundll32, Command Shell Activity Started via RunDLL32>> |Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> |Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.16.0 |102 <<control-panel-process-with-unusual-arguments-history, Version history>>
+|<<component-object-model-hijacking, Component Object Model Hijacking>> |Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> |Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.9.0 |100 <<creation-of-hidden-files-and-directories-via-commandline-history, Version history>>
+|<<compression-dll-loaded-by-unusual-process, Compression DLL Loaded by Unusual Process>> |Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |1
 
-|<<creation-of-hidden-launch-agent-or-daemon, Creation of Hidden Launch Agent or Daemon>> |Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence] [Defense Evasion]  |7.12.0 |100 <<creation-of-hidden-launch-agent-or-daemon-history, Version history>>
+|<<conhost-spawned-by-suspicious-parent-process, Conhost Spawned By Suspicious Parent Process>> |Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<creation-of-hidden-login-item-via-apple-script, Creation of Hidden Login Item via Apple Script>> |Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence] [Execution]  |7.12.0 |101 <<creation-of-hidden-login-item-via-apple-script-history, Version history>>
+|<<connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> |Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control] |8.3.0 |103
 
-|<<creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> |Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |8.4.0 |100 <<creation-of-hidden-shared-object-file-history, Version history>>
+|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> |Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.12.0 |102 <<creation-of-a-hidden-local-user-account-history, Version history>>
+|<<connection-to-external-network-via-telnet, Connection to External Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |103
 
-|<<creation-or-modification-of-domain-backup-dpapi-private-key, Creation or Modification of Domain Backup DPAPI private key>> |Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |7.10.0 |101 <<creation-or-modification-of-domain-backup-dpapi-private-key-history, Version history>>
+|<<connection-to-internal-network-via-telnet, Connection to Internal Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to non-publicly routable IP addresses. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |103
 
-|<<creation-or-modification-of-root-certificate, Creation or Modification of Root Certificate>> |Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.12.0 |102 <<creation-or-modification-of-root-certificate-history, Version history>>
+|<<container-management-utility-run-inside-a-container, Container Management Utility Run Inside A Container>> |This rule detects when a container management binary is run from inside a container. These binaries are critical components of many containerized environments, and their presence and execution in unauthorized containers could indicate compromise or a misconfiguration. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
-|<<creation-or-modification-of-a-new-gpo-scheduled-task-or-service, Creation or Modification of a new GPO Scheduled Task or Service>> |Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.10.0 |101 <<creation-or-modification-of-a-new-gpo-scheduled-task-or-service-history, Version history>>
+|<<container-workload-protection, Container Workload Protection>> |Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts. |[Data Source: Elastic Defend for Containers], [Domain: Container] |8.8.0 |3
 
-|<<credential-acquisition-via-registry-hive-dumping, Credential Acquisition via Registry Hive Dumping>> |Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<credential-acquisition-via-registry-hive-dumping-history, Version history>>
+|<<control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> |Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<credential-dumping-detected-elastic-endgame, Credential Dumping - Detected - Elastic Endgame>> |Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Credential Access]  |7.6.0 |100 <<credential-dumping-detected-elastic-endgame-history, Version history>>
+|<<creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> |Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<credential-dumping-prevented-elastic-endgame, Credential Dumping - Prevented - Elastic Endgame>> |Elastic Endgame prevented Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Credential Access]  |7.6.0 |100 <<credential-dumping-prevented-elastic-endgame-history, Version history>>
+|<<creation-of-hidden-launch-agent-or-daemon, Creation of Hidden Launch Agent or Daemon>> |Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<credential-manipulation-detected-elastic-endgame, Credential Manipulation - Detected - Elastic Endgame>> |Elastic Endgame detected Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation]  |7.6.0 |100 <<credential-manipulation-detected-elastic-endgame-history, Version history>>
+|<<creation-of-hidden-login-item-via-apple-script, Creation of Hidden Login Item via Apple Script>> |Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution] |8.3.0 |104
 
-|<<credential-manipulation-prevented-elastic-endgame, Credential Manipulation - Prevented - Elastic Endgame>> |Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation]  |7.6.0 |100 <<credential-manipulation-prevented-elastic-endgame-history, Version history>>
+|<<creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> |Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<cyberark-privileged-access-security-error, CyberArk Privileged Access Security Error>> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error level audit event. The event.code correlates to the CyberArk Vault Audit Action Code. |[Elastic] [cyberarkpas] [SecOps] [Log Auditing] [Threat Detection] [Privilege Escalation]  |7.14.0 |101 <<cyberark-privileged-access-security-error-history, Version history>>
+|<<creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> |Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<cyberark-privileged-access-security-recommended-monitor, CyberArk Privileged Access Security Recommended Monitor>> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code. |[Elastic] [cyberarkpas] [SecOps] [Log Auditing] [Threat Detection] [Privilege Escalation]  |7.14.0 |101 <<cyberark-privileged-access-security-recommended-monitor-history, Version history>>
+|<<creation-or-modification-of-domain-backup-dpapi-private-key, Creation or Modification of Domain Backup DPAPI private key>> |Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<dns-tunneling, DNS Tunneling>> |A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data. |[Elastic] [Network] [Threat Detection] [ML] [Command and Control]  |7.7.0 |100 <<dns-tunneling-history, Version history>>
+|<<creation-or-modification-of-root-certificate, Creation or Modification of Root Certificate>> |Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<dns-over-https-enabled-via-registry, DNS-over-HTTPS Enabled via Registry>> |Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.16.0 |101 <<dns-over-https-enabled-via-registry-history, Version history>>
+|<<creation-or-modification-of-a-new-gpo-scheduled-task-or-service, Creation or Modification of a new GPO Scheduled Task or Service>> |Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> |This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. |[Command and Control] [Post-Execution] [Threat Detection] [Elastic] [Network] [Host]  |7.11.0 |101 <<default-cobalt-strike-team-server-certificate-history, Version history>>
+|<<credential-acquisition-via-registry-hive-dumping, Credential Acquisition via Registry Hive Dumping>> |Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<delete-volume-usn-journal-with-fsutil, Delete Volume USN Journal with Fsutil>> |Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.6.0 |102 <<delete-volume-usn-journal-with-fsutil-history, Version history>>
+|<<credential-dumping-detected-elastic-endgame, Credential Dumping - Detected - Elastic Endgame>> |Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |101
 
-|<<deleting-backup-catalogs-with-wbadmin, Deleting Backup Catalogs with Wbadmin>> |Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide]  |7.6.0 |102 <<deleting-backup-catalogs-with-wbadmin-history, Version history>>
+|<<credential-dumping-prevented-elastic-endgame, Credential Dumping - Prevented - Elastic Endgame>> |Elastic Endgame prevented Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |101
 
-|<<direct-outbound-smb-connection, Direct Outbound SMB Connection>> |Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.6.0 |102 <<direct-outbound-smb-connection-history, Version history>>
+|<<credential-manipulation-detected-elastic-endgame, Credential Manipulation - Detected - Elastic Endgame>> |Elastic Endgame detected Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> |Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.14.0 |102 <<disable-windows-event-and-security-logs-using-built-in-tools-history, Version history>>
+|<<credential-manipulation-prevented-elastic-endgame, Credential Manipulation - Prevented - Elastic Endgame>> |Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<disable-windows-firewall-rules-via-netsh, Disable Windows Firewall Rules via Netsh>> |Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.6.0 |102 <<disable-windows-firewall-rules-via-netsh-history, Version history>>
+|<<cron-job-created-or-changed-by-previously-unknown-process, Cron Job Created or Changed by Previously Unknown Process>> |Linux cron jobs are scheduled tasks that can be leveraged by malicious actors for persistence, privilege escalation and command execution. By creating or modifying cron job configurations, attackers can execute malicious commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Execution], [Data Source: Elastic Endgame] |8.6.0 |2
 
-|<<disabling-user-account-control-via-registry-modification, Disabling User Account Control via Registry Modification>> |User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |7.12.0 |102 <<disabling-user-account-control-via-registry-modification-history, Version history>>
+|<<cyberark-privileged-access-security-error, CyberArk Privileged Access Security Error>> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error level audit event. The event.code correlates to the CyberArk Vault Audit Action Code. |[Data Source: CyberArk PAS], [Use Case: Log Auditing], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.14.0 |102 <<disabling-windows-defender-security-settings-via-powershell-history, Version history>>
+|<<cyberark-privileged-access-security-recommended-monitor, CyberArk Privileged Access Security Recommended Monitor>> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code. |[Data Source: CyberArk PAS], [Use Case: Log Auditing], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<domain-added-to-google-workspace-trusted-domains, Domain Added to Google Workspace Trusted Domains>> |Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |7.11.0 |101 <<domain-added-to-google-workspace-trusted-domains-history, Version history>>
+|<<dns-tunneling, DNS Tunneling>> |A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.3.0 |102
 
-|<<dumping-account-hashes-via-built-in-commands, Dumping Account Hashes via Built-In Commands>> |Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<dumping-account-hashes-via-built-in-commands-history, Version history>>
+|<<dns-over-https-enabled-via-registry, DNS-over-HTTPS Enabled via Registry>> |Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<dumping-of-keychain-content-via-security-command, Dumping of Keychain Content via Security Command>> |Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<dumping-of-keychain-content-via-security-command-history, Version history>>
+|<<default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> |This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. |[Tactic: Command and Control], [Threat: Cobalt Strike], [Use Case: Threat Detection], [Domain: Endpoint] |8.3.0 |103
 
-|<<dynamic-linker-copy, Dynamic Linker Copy>> |Detects the copying of the Linux dynamic loader binary and subsequent file creation for the purpose of creating a backup copy. This technique was seen recently being utilized by Linux malware prior to patching the dynamic loader in order to inject and preload a malicious shared object file. This activity should never occur and if it does then it should be considered highly suspicious or malicious. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence] [Orbit]  |8.4.0 |100 <<dynamic-linker-copy-history, Version history>>
+|<<delete-volume-usn-journal-with-fsutil, Delete Volume USN Journal with Fsutil>> |Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<eggshell-backdoor-execution, EggShell Backdoor Execution>> |Identifies the execution of and EggShell Backdoor. EggShell is a known post exploitation tool for macOS and Linux. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Execution]  |7.12.0 |100 <<eggshell-backdoor-execution-history, Version history>>
+|<<deleting-backup-catalogs-with-wbadmin, Deleting Backup Catalogs with Wbadmin>> |Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<elastic-agent-service-terminated, Elastic Agent Service Terminated>> |Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a stable state. |[Elastic] [Host] [Linux] [Windows] [macOS] [Threat Detection] [Defense Evasion]  |8.3.0 |100 <<elastic-agent-service-terminated-history, Version history>>
+|<<direct-outbound-smb-connection, Direct Outbound SMB Connection>> |Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<emond-rules-creation-or-modification, Emond Rules Creation or Modification>> |Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<emond-rules-creation-or-modification-history, Version history>>
+|<<disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> |Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<enable-host-network-discovery-via-netsh, Enable Host Network Discovery via Netsh>> |Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.14.0 |102 <<enable-host-network-discovery-via-netsh-history, Version history>>
+|<<disable-windows-firewall-rules-via-netsh, Disable Windows Firewall Rules via Netsh>> |Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<encoded-executable-stored-in-the-registry, Encoded Executable Stored in the Registry>> |Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |101 <<encoded-executable-stored-in-the-registry-history, Version history>>
+|<<disabling-user-account-control-via-registry-modification, Disabling User Account Control via Registry Modification>> |User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> |Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Elastic] [Host] [Windows] [Threat Detection] [Collection] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<encrypting-files-with-winrar-or-7z-history, Version history>>
+|<<disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<endpoint-security, Endpoint Security>> |Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts. |[Elastic] [Endpoint Security]  |7.9.0 |100 <<endpoint-security-history, Version history>>
+|<<domain-added-to-google-workspace-trusted-domains, Domain Added to Google Workspace Trusted Domains>> |Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.4.0 |205
 
-|<<enumerating-domain-trusts-via-nltest.exe, Enumerating Domain Trusts via NLTEST.EXE>> |Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Elastic Endgame]  |8.4.0 |102 <<enumerating-domain-trusts-via-nltest.exe-history, Version history>>
+|<<downloaded-shortcut-files, Downloaded Shortcut Files>> |Identifies .lnk shortcut file downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution] |None |1
 
-|<<enumeration-command-spawned-via-wmiprvse, Enumeration Command Spawned via WMIPrvSE>> |Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.12.0 |102 <<enumeration-command-spawned-via-wmiprvse-history, Version history>>
+|<<downloaded-url-files, Downloaded URL Files>> |Identifies .url shortcut files downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution] |None |1
 
-|<<enumeration-of-administrator-accounts, Enumeration of Administrator Accounts>> |Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<enumeration-of-administrator-accounts-history, Version history>>
+|<<dumping-account-hashes-via-built-in-commands, Dumping Account Hashes via Built-In Commands>> |Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<enumeration-of-kernel-modules, Enumeration of Kernel Modules>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module. |[Elastic] [Host] [Linux] [Threat Detection] [Discovery]  |7.8.0 |100 <<enumeration-of-kernel-modules-history, Version history>>
+|<<dumping-of-keychain-content-via-security-command, Dumping of Keychain Content via Security Command>> |Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> |Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide]  |8.0.0 |102 <<enumeration-of-privileged-local-groups-membership-history, Version history>>
+|<<dynamic-linker-copy, Dynamic Linker Copy>> |Detects the copying of the Linux dynamic loader binary and subsequent file creation for the purpose of creating a backup copy. This technique was seen recently being utilized by Linux malware prior to patching the dynamic loader in order to inject and preload a malicious shared object file. This activity should never occur and if it does then it should be considered highly suspicious or malicious. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Orbit] |8.3.0 |103
 
-|<<enumeration-of-users-or-groups-via-built-in-commands, Enumeration of Users or Groups via Built-in Commands>> |Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Elastic] [Host] [macOS] [Threat Detection] [Discovery]  |7.12.0 |100 <<enumeration-of-users-or-groups-via-built-in-commands-history, Version history>>
+|<<esxi-discovery-via-find, ESXI Discovery via Find>> |Identifies instances where the 'find' command is started on a Linux system with arguments targeting specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the find command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM-related files and configurations on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.5.0 |2
 
-|<<executable-file-creation-with-multiple-extensions, Executable File Creation with Multiple Extensions>> |Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.12.0 |101 <<executable-file-creation-with-multiple-extensions-history, Version history>>
+|<<esxi-discovery-via-grep, ESXI Discovery via Grep>> |Identifies instances where a process named 'grep', 'egrep', or 'pgrep' is started on a Linux system with arguments related to virtual machine (VM) files, such as "vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", or "vmem". These file extensions are associated with VM-related file formats, and their presence in grep command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM files on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.5.0 |2
 
-|<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<execution-from-unusual-directory-command-line-history, Version history>>
+|<<esxi-timestomping-using-touch-command, ESXI Timestomping using Touch Command>> |Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.5.0 |2
 
-|<<execution-of-com-object-via-xwizard, Execution of COM object via Xwizard>> |Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.12.0 |102 <<execution-of-com-object-via-xwizard-history, Version history>>
+|<<eggshell-backdoor-execution, EggShell Backdoor Execution>> |Identifies the execution of and EggShell Backdoor. EggShell is a known post exploitation tool for macOS and Linux. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |102
 
-|<<execution-of-file-written-or-modified-by-microsoft-office, Execution of File Written or Modified by Microsoft Office>> |Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<execution-of-file-written-or-modified-by-microsoft-office-history, Version history>>
+|<<elastic-agent-service-terminated, Elastic Agent Service Terminated>> |Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a stable state. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<execution-of-file-written-or-modified-by-pdf-reader, Execution of File Written or Modified by PDF Reader>> |Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<execution-of-file-written-or-modified-by-pdf-reader-history, Version history>>
+|<<emond-rules-creation-or-modification, Emond Rules Creation or Modification>> |Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> |Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |101 <<execution-of-persistent-suspicious-program-history, Version history>>
+|<<enable-host-network-discovery-via-netsh, Enable Host Network Discovery via Netsh>> |Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<execution-via-electron-child-process-node.js-module, Execution via Electron Child Process Node.js Module>> |Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion] [Execution]  |7.12.0 |100 <<execution-via-electron-child-process-node.js-module-history, Version history>>
+|<<encoded-executable-stored-in-the-registry, Encoded Executable Stored in the Registry>> |Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<execution-via-mssql-xp_cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> |Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<execution-via-mssql-xp_cmdshell-stored-procedure-history, Version history>>
+|<<encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> |Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<execution-via-tsclient-mountpoint, Execution via TSClient Mountpoint>> |Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<execution-via-tsclient-mountpoint-history, Version history>>
+|<<endpoint-security, Endpoint Security>> |Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts. |[Data Source: Elastic Defend] |8.3.0 |102
 
-|<<execution-via-local-sxs-shared-module, Execution via local SxS Shared Module>> |Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.11.0 |101 <<execution-via-local-sxs-shared-module-history, Version history>>
+|<<enumerating-domain-trusts-via-dsquery-exe, Enumerating Domain Trusts via DSQUERY.EXE>> |Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |4
 
-|<<execution-with-explicit-credentials-via-scripting, Execution with Explicit Credentials via Scripting>> |Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials. |[Elastic] [Host] [macOS] [Threat Detection] [Execution] [Privilege Escalation]  |7.11.0 |100 <<execution-with-explicit-credentials-via-scripting-history, Version history>>
+|<<enumerating-domain-trusts-via-nltest-exe, Enumerating Domain Trusts via NLTEST.EXE>> |Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<exploit-detected-elastic-endgame, Exploit - Detected - Elastic Endgame>> |Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Execution] [Privilege Escalation]  |7.6.0 |100 <<exploit-detected-elastic-endgame-history, Version history>>
+|<<enumeration-command-spawned-via-wmiprvse, Enumeration Command Spawned via WMIPrvSE>> |Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<exploit-prevented-elastic-endgame, Exploit - Prevented - Elastic Endgame>> |Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Execution] [Privilege Escalation]  |7.6.0 |100 <<exploit-prevented-elastic-endgame-history, Version history>>
+|<<enumeration-of-administrator-accounts, Enumeration of Administrator Accounts>> |Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<exporting-exchange-mailbox-via-powershell, Exporting Exchange Mailbox via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Elastic] [Host] [Windows] [Threat Detection] [Collection] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<exporting-exchange-mailbox-via-powershell-history, Version history>>
+|<<enumeration-of-kernel-modules, Enumeration of Kernel Modules>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |104
 
-|<<external-alerts, External Alerts>> |Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app. |[Elastic] [Network] [Windows] [APM] [macOS] [Linux]  |7.9.0 |100 <<external-alerts-history, Version history>>
+|<<enumeration-of-kernel-modules-via-proc, Enumeration of Kernel Modules via Proc>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |1
 
-|<<external-ip-lookup-from-non-browser-process, External IP Lookup from Non-Browser Process>> |Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide]  |7.10.0 |102 <<external-ip-lookup-from-non-browser-process-history, Version history>>
+|<<enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> |Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.3.0 |108
 
-|<<file-deletion-via-shred, File Deletion via Shred>> |Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.8.0 |100 <<file-deletion-via-shred-history, Version history>>
+|<<enumeration-of-users-or-groups-via-built-in-commands, Enumeration of Users or Groups via Built-in Commands>> |Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |103
 
-|<<file-permission-modification-in-writable-directory, File Permission Modification in Writable Directory>> |Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.8.0 |100 <<file-permission-modification-in-writable-directory-history, Version history>>
+|<<exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |4
 
-|<<file-transfer-or-listener-established-via-netcat, File Transfer or Listener Established via Netcat>> |A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [Investigation Guide]  |7.6.0 |102 <<file-transfer-or-listener-established-via-netcat-history, Version history>>
+|<<executable-file-creation-with-multiple-extensions, Executable File Creation with Multiple Extensions>> |Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<file-made-immutable-by-chattr, File made Immutable by Chattr>> |Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Threat actors will commonly utilize this to prevent tampering or modification of their malicious files or any system files they have modified for purposes of persistence (e.g .ssh, /etc/passwd, etc.). |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |8.4.0 |100 <<file-made-immutable-by-chattr-history, Version history>>
+|<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<finder-sync-plugin-registered-and-enabled, Finder Sync Plugin Registered and Enabled>> |Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<finder-sync-plugin-registered-and-enabled-history, Version history>>
+|<<execution-of-com-object-via-xwizard, Execution of COM object via Xwizard>> |Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<full-user-mode-dumps-enabled-system-wide, Full User-Mode Dumps Enabled System-Wide>> |Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<execution-of-file-written-or-modified-by-microsoft-office, Execution of File Written or Modified by Microsoft Office>> |Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<gcp-firewall-rule-creation, GCP Firewall Rule Creation>> |Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |102 <<gcp-firewall-rule-creation-history, Version history>>
+|<<execution-of-file-written-or-modified-by-pdf-reader, Execution of File Written or Modified by PDF Reader>> |Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<gcp-firewall-rule-deletion, GCP Firewall Rule Deletion>> |Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule in order to weaken their target's security controls. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |102 <<gcp-firewall-rule-deletion-history, Version history>>
+|<<execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> |Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<gcp-firewall-rule-modification, GCP Firewall Rule Modification>> |Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be modified to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may modify an existing firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |102 <<gcp-firewall-rule-modification-history, Version history>>
+|<<execution-via-electron-child-process-node-js-module, Execution via Electron Child Process Node.js Module>> |Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution] |8.3.0 |103
 
-|<<gcp-iam-custom-role-creation, GCP IAM Custom Role Creation>> |Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-iam-custom-role-creation-history, Version history>>
+|<<execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> |Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<gcp-iam-role-deletion, GCP IAM Role Deletion>> |Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-iam-role-deletion-history, Version history>>
+|<<execution-via-tsclient-mountpoint, Execution via TSClient Mountpoint>> |Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<gcp-iam-service-account-key-deletion, GCP IAM Service Account Key Deletion>> |Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-iam-service-account-key-deletion-history, Version history>>
+|<<execution-via-windows-subsystem-for-linux, Execution via Windows Subsystem for Linux>> |Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |3
 
-|<<gcp-logging-bucket-deletion, GCP Logging Bucket Deletion>> |Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-logging-bucket-deletion-history, Version history>>
+|<<execution-via-local-sxs-shared-module, Execution via local SxS Shared Module>> |Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<gcp-logging-sink-deletion, GCP Logging Sink Deletion>> |Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a log entry arrives, Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may delete a Logging sink to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-logging-sink-deletion-history, Version history>>
+|<<execution-with-explicit-credentials-via-scripting, Execution with Explicit Credentials via Scripting>> |Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation] |8.3.0 |103
 
-|<<gcp-logging-sink-modification, GCP Logging Sink Modification>> |Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may update a Logging sink to exfiltrate logs to a different export destination. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-logging-sink-modification-history, Version history>>
+|<<expired-or-revoked-driver-loaded, Expired or Revoked Driver Loaded>> |Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Rule Type: BBR] |8.3.0 |1
 
-|<<gcp-pub-sub-subscription-creation, GCP Pub/Sub Subscription Creation>> |Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-pub-sub-subscription-creation-history, Version history>>
+|<<exploit-detected-elastic-endgame, Exploit - Detected - Elastic Endgame>> |Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<gcp-pub-sub-subscription-deletion, GCP Pub/Sub Subscription Deletion>> |Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-pub-sub-subscription-deletion-history, Version history>>
+|<<exploit-prevented-elastic-endgame, Exploit - Prevented - Elastic Endgame>> |Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<gcp-pub-sub-topic-creation, GCP Pub/Sub Topic Creation>> |Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A topic is used to forward messages from publishers to subscribers. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-pub-sub-topic-creation-history, Version history>>
+|<<exporting-exchange-mailbox-via-powershell, Exporting Exchange Mailbox via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<gcp-pub-sub-topic-deletion, GCP Pub/Sub Topic Deletion>> |Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing]  |7.10.0 |102 <<gcp-pub-sub-topic-deletion-history, Version history>>
+|<<external-alerts, External Alerts>> |Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app. |[OS: Windows], [Data Source: APM], [OS: macOS], [OS: Linux] |8.3.0 |102
 
-|<<gcp-service-account-creation, GCP Service Account Creation>> |Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create a new service account to use during their operations in order to avoid using a standard user account and attempt to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-service-account-creation-history, Version history>>
+|<<external-ip-lookup-from-non-browser-process, External IP Lookup from Non-Browser Process>> |Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<gcp-service-account-deletion, GCP Service Account Deletion>> |Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-service-account-deletion-history, Version history>>
+|<<external-user-added-to-google-workspace-group, External User Added to Google Workspace Group>> |Detects an external Google Workspace user account being added to an existing group. Adversaries may add external user accounts as a means to intercept shared files or emails with that specific group. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |8.4.0 |2
 
-|<<gcp-service-account-disabled, GCP Service Account Disabled>> |Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-service-account-disabled-history, Version history>>
+|<<file-creation-time-changed, File Creation Time Changed>> |Identifies modification of a file creation time. Adversaries may modify file time attributes to blend malicious content with existing files. Timestomping is a technique that modifies the timestamps of a file often to mimic files that are in trusted directories. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |3
 
-|<<gcp-service-account-key-creation, GCP Service Account Key Creation>> |Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions assigned to that account and evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-service-account-key-creation-history, Version history>>
+|<<file-deletion-via-shred, File Deletion via Shred>> |Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<gcp-storage-bucket-configuration-modification, GCP Storage Bucket Configuration Modification>> |Identifies when the configuration is modified for a storage bucket in Google Cloud Platform (GCP). An adversary may modify the configuration of a storage bucket in order to weaken the security controls of their target's environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion]  |7.10.0 |102 <<gcp-storage-bucket-configuration-modification-history, Version history>>
+|<<file-made-executable-via-chmod-inside-a-container, File Made Executable via Chmod Inside A Container>> |This rule detects when chmod is used to add the execute permission to a file inside a container. Modifying file permissions to make a file executable could indicate malicious activity, as an attacker may attempt to run unauthorized or malicious code inside the container. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion] |8.8.0 |2
 
-|<<gcp-storage-bucket-deletion, GCP Storage Bucket Deletion>> |Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Monitoring]  |7.10.0 |102 <<gcp-storage-bucket-deletion-history, Version history>>
+|<<file-permission-modification-in-writable-directory, File Permission Modification in Writable Directory>> |Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<gcp-storage-bucket-permissions-modification, GCP Storage Bucket Permissions Modification>> |Identifies when the Identity and Access Management (IAM) permissions are modified for a Google Cloud Platform (GCP) storage bucket. An adversary may modify the permissions on a storage bucket to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<gcp-storage-bucket-permissions-modification-history, Version history>>
+|<<file-transfer-or-listener-established-via-netcat, File Transfer or Listener Established via Netcat>> |A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<gcp-virtual-private-cloud-network-deletion, GCP Virtual Private Cloud Network Deletion>> |Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud Platform (GCP). A VPC network is a virtual version of a physical network within a GCP project. Each VPC network has its own subnets, routes, and firewall, as well as other elements. An adversary may delete a VPC network in order to disrupt their target's network and business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |7.10.0 |102 <<gcp-virtual-private-cloud-network-deletion-history, Version history>>
+|<<file-made-immutable-by-chattr, File made Immutable by Chattr>> |Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Threat actors will commonly utilize this to prevent tampering or modification of their malicious files or any system files they have modified for purposes of persistence (e.g .ssh, /etc/passwd, etc.). |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<gcp-virtual-private-cloud-route-creation, GCP Virtual Private Cloud Route Creation>> |Identifies when a virtual private cloud (VPC) route is created in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may create a route in order to impact the flow of network traffic in their target's cloud environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |7.10.0 |102 <<gcp-virtual-private-cloud-route-creation-history, Version history>>
+|<<finder-sync-plugin-registered-and-enabled, Finder Sync Plugin Registered and Enabled>> |Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<gcp-virtual-private-cloud-route-deletion, GCP Virtual Private Cloud Route Deletion>> |Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may delete a route in order to impact the flow of network traffic in their target's cloud environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |7.10.0 |102 <<gcp-virtual-private-cloud-route-deletion-history, Version history>>
+|<<first-time-seen-aws-secret-value-accessed-in-secrets-manager, First Time Seen AWS Secret Value Accessed in Secrets Manager>> |An adversary equipped with compromised credentials may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Credential Access], [Resources: Investigation Guide] |8.6.0 |206
 
-|<<google-drive-ownership-transferred-via-google-workspace, Google Drive Ownership Transferred via Google Workspace>> |Drive and Docs is a Google Workspace service that allows users to leverage Google Drive and Google Docs. Access to files is based on inherited permissions from the child organizational unit the user belongs to which is scoped by administrators. Typically if a user is removed, their files can be transferred to another user by the administrator. This service can also be abused by adversaries to transfer files to an adversary account for potential exfiltration. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Collection]  |8.5.0 |2 <<google-drive-ownership-transferred-via-google-workspace-history, Version history>>
+|<<first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> |Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |8.4.0 |3
 
-|<<google-workspace-2sv-policy-disabled, Google Workspace 2SV Policy Disabled>> |Google Workspace admins may setup 2-step verification (2SV) to add an extra layer of security to user accounts by asking users to verify their identity when they use login credentials. Admins have the ability to enforce 2SV from the admin console as well as the methods acceptable for verification and enrollment period. 2SV requires enablement on admin accounts prior to it being enabled for users within organization units. Adversaries may disable 2SV to lower the security requirements to access a valid account. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence]  |8.5.0 |2 <<google-workspace-2sv-policy-disabled-history, Version history>>
+|<<first-time-seen-driver-loaded, First Time Seen Driver Loaded>> |Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.6.0 |4
 
-|<<google-workspace-api-access-granted-via-domain-wide-delegation-of-authority, Google Workspace API Access Granted via Domain-Wide Delegation of Authority>> |Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<google-workspace-api-access-granted-via-domain-wide-delegation-of-authority-history, Version history>>
+|<<first-time-seen-google-workspace-oauth-login-from-third-party-application, First Time Seen Google Workspace OAuth Login from Third-Party Application>> |Detects the first time a third-party application logs in and authenticated with OAuth. OAuth is used to grant permissions to specific resources and services in Google Workspace. Compromised credentials or service accounts could allow an adversary to authenticate to Google Workspace as a valid user and inherit their privileges. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Defense Evasion], [Tactic: Initial Access] |8.4.0 |2
 
-|<<google-workspace-admin-role-assigned-to-a-user, Google Workspace Admin Role Assigned to a User>> |Assigning the administrative role to a user will grant them access to the Google Admin console and grant them administrator privileges which allow them to access and manage various resources and applications. An adversary may create a new administrator account for persistence or apply the admin role to an existing user to carry out further intrusion efforts. Users with super-admin privileges can bypass single-sign on if enabled in Google Workspace. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence]  |7.11.0 |102 <<google-workspace-admin-role-assigned-to-a-user-history, Version history>>
+|<<first-time-seen-removable-device, First Time Seen Removable Device>> |Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Exfiltration], [Data Source: Elastic Endgame] |8.4.0 |1
 
-|<<google-workspace-admin-role-deletion, Google Workspace Admin Role Deletion>> |Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Impact]  |7.11.0 |101 <<google-workspace-admin-role-deletion-history, Version history>>
+|<<firsttime-seen-account-performing-dcsync, FirstTime Seen Account Performing DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Resources: Investigation Guide] |8.4.0 |5
 
-|<<google-workspace-bitlocker-setting-disabled, Google Workspace Bitlocker Setting Disabled>> |Google Workspace administrators whom manage Windows devices and have Windows device management enabled may also enable BitLocker drive encryption to mitigate unauthorized data access on lost or stolen computers. Adversaries with valid account access may disable BitLocker to access sensitive data on an endpoint added to Google Workspace device management. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |8.5.0 |2 <<google-workspace-bitlocker-setting-disabled-history, Version history>>
+|<<forwarded-google-workspace-security-alert, Forwarded Google Workspace Security Alert>> |Identifies the occurrence of a security alert from the Google Workspace alerts center. Google Workspace's security alert center provides an overview of actionable alerts that may be affecting an organization's domain. An alert is a warning of a potential security issue that Google has detected. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Log Auditing], [Use Case: Threat Detection] |8.4.0 |2
 
-|<<google-workspace-custom-admin-role-created, Google Workspace Custom Admin Role Created>> |Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<google-workspace-custom-admin-role-created-history, Version history>>
+|<<full-user-mode-dumps-enabled-system-wide, Full User-Mode Dumps Enabled System-Wide>> |Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |4
 
-|<<google-workspace-custom-gmail-route-created-or-modified, Google Workspace Custom Gmail Route Created or Modified>> |Detects when a custom Gmail route is added or modified in Google Workspace. Adversaries can add a custom e-mail route for outbound mail to route these e-mails to their own inbox of choice for data gathering. This allows adversaries to capture sensitive information from e-mail and potential attachments, such as invoices or payment documents. By default, all email from current Google Workspace users with accounts are routed through a domain's mail server for inbound and outbound mail. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Collection]  |8.5.0 |2 <<google-workspace-custom-gmail-route-created-or-modified-history, Version history>>
+|<<gcp-firewall-rule-creation, GCP Firewall Rule Creation>> |Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<google-workspace-mfa-enforcement-disabled, Google Workspace MFA Enforcement Disabled>> |Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Impact] [Investigation Guide]  |7.11.0 |103 <<google-workspace-mfa-enforcement-disabled-history, Version history>>
+|<<gcp-firewall-rule-deletion, GCP Firewall Rule Deletion>> |Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule in order to weaken their target's security controls. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<google-workspace-password-policy-modified, Google Workspace Password Policy Modified>> |Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence]  |7.11.0 |101 <<google-workspace-password-policy-modified-history, Version history>>
+|<<gcp-firewall-rule-modification, GCP Firewall Rule Modification>> |Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be modified to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may modify an existing firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app, Google Workspace Restrictions for Google Marketplace Modified to Allow Any App>> |Detects when the Google Marketplace restrictions are changed to allow any application for users in Google Workspace. Malicious APKs created by adversaries may be uploaded to the Google marketplace but not installed on devices managed within Google Workspace. Administrators should set restrictions to not allow any application from the marketplace for security reasons. Adversaries may enable any app to be installed and executed on mobile devices within a Google Workspace environment prior to distributing the malicious APK to the end user. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion]  |8.5.0 |2 <<google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app-history, Version history>>
+|<<gcp-iam-custom-role-creation, GCP IAM Custom Role Creation>> |Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.3.0 |104
 
-|<<google-workspace-role-modified, Google Workspace Role Modified>> |Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<google-workspace-role-modified-history, Version history>>
+|<<gcp-iam-role-deletion, GCP IAM Role Deletion>> |Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Impact] |8.3.0 |104
 
-|<<google-workspace-user-group-access-modified-to-allow-external-access, Google Workspace User Group Access Modified to Allow External Access>> |User groups in Google Workspace are created to help manage users permissions and access to various resources and applications. The security label is only applied to a group when users within that group are expected to access sensitive data and/or resources so administrators add this label to easily manage security groups better. Adversaries with administrator access may modify a security group to allow external access from members outside the organization. This detection does not capture all modifications to security groups, but only those that could increase the risk associated with them. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence]  |8.5.0 |2 <<google-workspace-user-group-access-modified-to-allow-external-access-history, Version history>>
+|<<gcp-iam-service-account-key-deletion, GCP IAM Service Account Key Deletion>> |Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |104
 
-|<<google-workspace-user-organizational-unit-changed, Google Workspace User Organizational Unit Changed>> |Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence]  |8.5.0 |2 <<google-workspace-user-organizational-unit-changed-history, Version history>>
+|<<gcp-logging-bucket-deletion, GCP Logging Bucket Deletion>> |Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<group-policy-abuse-for-privilege-addition, Group Policy Abuse for Privilege Addition>> |Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Active Directory] [Investigation Guide]  |8.0.0 |102 <<group-policy-abuse-for-privilege-addition-history, Version history>>
+|<<gcp-logging-sink-deletion, GCP Logging Sink Deletion>> |Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a log entry arrives, Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may delete a Logging sink to evade detection. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<halfbaked-command-and-control-beacon, Halfbaked Command and Control Beacon>> |Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. |[Elastic] [Network] [Threat Detection] [Command and Control] [Host]  |7.10.0 |100 <<halfbaked-command-and-control-beacon-history, Version history>>
+|<<gcp-logging-sink-modification, GCP Logging Sink Modification>> |Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may update a Logging sink to exfiltrate logs to a different export destination. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Exfiltration] |8.3.0 |104
 
-|<<high-number-of-okta-user-password-reset-or-unlock-attempts, High Number of Okta User Password Reset or Unlock Attempts>> |Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.10.0 |102 <<high-number-of-okta-user-password-reset-or-unlock-attempts-history, Version history>>
+|<<gcp-pub-sub-subscription-creation, GCP Pub/Sub Subscription Creation>> |Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Collection] |8.3.0 |105
 
-|<<high-number-of-process-terminations, High Number of Process Terminations>> |This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period. |[Elastic] [Host] [Linux] [Threat Detection] [Impact] [Investigation Guide]  |8.4.0 |102 <<high-number-of-process-terminations-history, Version history>>
+|<<gcp-pub-sub-subscription-deletion, GCP Pub/Sub Subscription Deletion>> |Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<high-number-of-process-and-or-service-terminations, High Number of Process and/or Service Terminations>> |This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide]  |7.11.0 |102 <<high-number-of-process-and-or-service-terminations-history, Version history>>
+|<<gcp-pub-sub-topic-creation, GCP Pub/Sub Topic Creation>> |Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A topic is used to forward messages from publishers to subscribers. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Collection] |8.3.0 |105
 
-|<<hosts-file-modified, Hosts File Modified>> |The hosts file on endpoints is used to control manual IP address to hostname resolutions. The hosts file is the first point of lookup for DNS hostname resolution so if adversaries can modify the endpoint hosts file, they can route traffic to malicious infrastructure. This rule detects modifications to the hosts file on Microsoft Windows, Linux (Ubuntu or RHEL) and macOS systems. |[Elastic] [Host] [Linux] [Windows] [macOS] [Threat Detection] [Impact] [Investigation Guide]  |7.10.0 |102 <<hosts-file-modified-history, Version history>>
+|<<gcp-pub-sub-topic-deletion, GCP Pub/Sub Topic Deletion>> |Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<hping-process-activity, Hping Process Activity>> |Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing. |[Elastic] [Host] [Linux] [Threat Detection] [Discovery]  |7.6.0 |100 <<hping-process-activity-history, Version history>>
+|<<gcp-service-account-creation, GCP Service Account Creation>> |Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create a new service account to use during their operations in order to avoid using a standard user account and attempt to evade detection. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |104
 
-|<<iis-http-logging-disabled, IIS HTTP Logging Disabled>> |Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<iis-http-logging-disabled-history, Version history>>
+|<<gcp-service-account-deletion, GCP Service Account Deletion>> |Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Impact] |8.3.0 |104
 
-|<<ipsec-nat-traversal-port-activity, IPSEC NAT Traversal Port Activity>> |This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. |[Elastic] [Host] [Network] [Threat Detection] [Command and Control] [Host]  |7.6.0 |100 <<ipsec-nat-traversal-port-activity-history, Version history>>
+|<<gcp-service-account-disabled, GCP Service Account Disabled>> |Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Impact] |8.3.0 |104
 
-|<<image-file-execution-options-injection, Image File Execution Options Injection>> |The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<image-file-execution-options-injection-history, Version history>>
+|<<gcp-service-account-key-creation, GCP Service Account Key Creation>> |Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions assigned to that account and evade detection. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |104
 
-|<<imageload-via-windows-update-auto-update-client, ImageLoad via Windows Update Auto Update Client>> |Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |102 <<imageload-via-windows-update-auto-update-client-history, Version history>>
+|<<gcp-storage-bucket-configuration-modification, GCP Storage Bucket Configuration Modification>> |Identifies when the configuration is modified for a storage bucket in Google Cloud Platform (GCP). An adversary may modify the configuration of a storage bucket in order to weaken the security controls of their target's environment. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<inbound-connection-to-an-unsecure-elasticsearch-node, Inbound Connection to an Unsecure Elasticsearch Node>> |Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port. |[Elastic] [Network] [Threat Detection] [Initial Access] [Host]  |7.10.0 |100 <<inbound-connection-to-an-unsecure-elasticsearch-node-history, Version history>>
+|<<gcp-storage-bucket-deletion, GCP Storage Bucket Deletion>> |Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Tactic: Impact] |8.3.0 |104
 
-|<<incoming-dcom-lateral-movement-via-mshta, Incoming DCOM Lateral Movement via MSHTA>> |Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<incoming-dcom-lateral-movement-via-mshta-history, Version history>>
+|<<gcp-storage-bucket-permissions-modification, GCP Storage Bucket Permissions Modification>> |Identifies when the Identity and Access Management (IAM) permissions are modified for a Google Cloud Platform (GCP) storage bucket. An adversary may modify the permissions on a storage bucket to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<incoming-dcom-lateral-movement-with-mmc, Incoming DCOM Lateral Movement with MMC>> |Identifies the use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the MMC20 Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<incoming-dcom-lateral-movement-with-mmc-history, Version history>>
+|<<gcp-virtual-private-cloud-network-deletion, GCP Virtual Private Cloud Network Deletion>> |Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud Platform (GCP). A VPC network is a virtual version of a physical network within a GCP project. Each VPC network has its own subnets, routes, and firewall, as well as other elements. An adversary may delete a VPC network in order to disrupt their target's network and business operations. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows, Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows>> |Identifies use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the ShellBrowserWindow or ShellWindows Application COM Object. This behavior may indicate an attacker abusing a DCOM application to stealthily move laterally. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows-history, Version history>>
+|<<gcp-virtual-private-cloud-route-creation, GCP Virtual Private Cloud Route Creation>> |Identifies when a virtual private cloud (VPC) route is created in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may create a route in order to impact the flow of network traffic in their target's cloud environment. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<incoming-execution-via-powershell-remoting, Incoming Execution via PowerShell Remoting>> |Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |100 <<incoming-execution-via-powershell-remoting-history, Version history>>
+|<<gcp-virtual-private-cloud-route-deletion, GCP Virtual Private Cloud Route Deletion>> |Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may delete a route in order to impact the flow of network traffic in their target's cloud environment. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<incoming-execution-via-winrm-remote-shell, Incoming Execution via WinRM Remote Shell>> |Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an indication of lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |100 <<incoming-execution-via-winrm-remote-shell-history, Version history>>
+|<<google-drive-ownership-transferred-via-google-workspace, Google Drive Ownership Transferred via Google Workspace>> |Drive and Docs is a Google Workspace service that allows users to leverage Google Drive and Google Docs. Access to files is based on inherited permissions from the child organizational unit the user belongs to which is scoped by administrators. Typically if a user is removed, their files can be transferred to another user by the administrator. This service can also be abused by adversaries to transfer files to an adversary account for potential exfiltration. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Collection], [Resources: Investigation Guide] |8.4.0 |106
 
-|<<installutil-process-making-network-connections, InstallUtil Process Making Network Connections>> |Identifies InstallUtil.exe making outbound network connections. This may indicate adversarial activity as InstallUtil is often leveraged by adversaries to execute code and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |101 <<installutil-process-making-network-connections-history, Version history>>
+|<<google-workspace-2sv-policy-disabled, Google Workspace 2SV Policy Disabled>> |Google Workspace admins may setup 2-step verification (2SV) to add an extra layer of security to user accounts by asking users to verify their identity when they use login credentials. Admins have the ability to enforce 2SV from the admin console as well as the methods acceptable for verification and enrollment period. 2SV requires enablement on admin accounts prior to it being enabled for users within organization units. Adversaries may disable 2SV to lower the security requirements to access a valid account. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |106
 
-|<<installation-of-custom-shim-databases, Installation of Custom Shim Databases>> |Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.10.0 |101 <<installation-of-custom-shim-databases-history, Version history>>
+|<<google-workspace-api-access-granted-via-domain-wide-delegation-of-authority, Google Workspace API Access Granted via Domain-Wide Delegation of Authority>> |Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |8.4.0 |205
 
-|<<installation-of-security-support-provider, Installation of Security Support Provider>> |Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<installation-of-security-support-provider-history, Version history>>
+|<<google-workspace-admin-role-assigned-to-a-user, Google Workspace Admin Role Assigned to a User>> |Assigning the administrative role to a user will grant them access to the Google Admin console and grant them administrator privileges which allow them to access and manage various resources and applications. An adversary may create a new administrator account for persistence or apply the admin role to an existing user to carry out further intrusion efforts. Users with super-admin privileges can bypass single-sign on if enabled in Google Workspace. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |206
 
-|<<interactive-terminal-spawned-via-perl, Interactive Terminal Spawned via Perl>> |Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host. |[Elastic] [Host] [Linux] [Threat Detection] [Execution]  |7.8.0 |100 <<interactive-terminal-spawned-via-perl-history, Version history>>
+|<<google-workspace-admin-role-deletion, Google Workspace Admin Role Deletion>> |Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Impact], [Resources: Investigation Guide] |8.4.0 |205
 
-|<<interactive-terminal-spawned-via-python, Interactive Terminal Spawned via Python>> |Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host. |[Elastic] [Host] [Linux] [Threat Detection] [Execution]  |7.8.0 |100 <<interactive-terminal-spawned-via-python-history, Version history>>
+|<<google-workspace-bitlocker-setting-disabled, Google Workspace Bitlocker Setting Disabled>> |Google Workspace administrators whom manage Windows devices and have Windows device management enabled may also enable BitLocker drive encryption to mitigate unauthorized data access on lost or stolen computers. Adversaries with valid account access may disable BitLocker to access sensitive data on an endpoint added to Google Workspace device management. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.4.0 |106
 
-|<<krbtgt-delegation-backdoor, KRBTGT Delegation Backdoor>> |Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT. Attackers can use this technique to maintain persistence to the domain by having the ability to request tickets for the KRBTGT service. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Active Directory]  |8.1.0 |100 <<krbtgt-delegation-backdoor-history, Version history>>
+|<<google-workspace-custom-admin-role-created, Google Workspace Custom Admin Role Created>> |Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |8.4.0 |205
 
-|<<kerberos-cached-credentials-dumping, Kerberos Cached Credentials Dumping>> |Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.10.0 |100 <<kerberos-cached-credentials-dumping-history, Version history>>
+|<<google-workspace-custom-gmail-route-created-or-modified, Google Workspace Custom Gmail Route Created or Modified>> |Detects when a custom Gmail route is added or modified in Google Workspace. Adversaries can add a custom e-mail route for outbound mail to route these e-mails to their own inbox of choice for data gathering. This allows adversaries to capture sensitive information from e-mail and potential attachments, such as invoices or payment documents. By default, all email from current Google Workspace users with accounts are routed through a domain's mail server for inbound and outbound mail. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Collection], [Resources: Investigation Guide] |8.4.0 |106
 
-|<<kerberos-pre-authentication-disabled-for-user, Kerberos Pre-authentication Disabled for User>> |Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |8.1.0 |102 <<kerberos-pre-authentication-disabled-for-user-history, Version history>>
+|<<google-workspace-drive-encryption-key-s-accessed-from-anonymous-user, Google Workspace Drive Encryption Key(s) Accessed from Anonymous User>> |Detects when an external (anonymous) user has viewed, copied or downloaded an encryption key file from a Google Workspace drive. Adversaries may gain access to encryption keys stored in private drives from rogue access links that do not have an expiration. Access to encryption keys may allow adversaries to access sensitive data or authenticate on behalf of users. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Credential Access] |8.4.0 |2
 
-|<<kerberos-traffic-from-unusual-process, Kerberos Traffic from Unusual Process>> |Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |7.11.0 |102 <<kerberos-traffic-from-unusual-process-history, Version history>>
+|<<google-workspace-mfa-enforcement-disabled, Google Workspace MFA Enforcement Disabled>> |Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Impact], [Resources: Investigation Guide] |8.4.0 |207
 
-|<<kernel-module-removal, Kernel Module Removal>> |Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.8.0 |100 <<kernel-module-removal-history, Version history>>
+|<<google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application, Google Workspace Object Copied from External Drive and Access Granted to Custom Application>> |Detects when a user copies a Google spreadsheet, form, document or script from an external drive. Sequence logic has been added to also detect when a user grants a custom Google application permission via OAuth shortly after. An adversary may send a phishing email to the victim with a Drive object link where "copy" is included in the URI, thus copying the object to the victim's drive. If a container-bound script exists within the object, execution will require permission access via OAuth in which the user has to accept. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Initial Access], [Resources: Investigation Guide] |8.4.0 |3
 
-|<<kernel-module-load-via-insmod, Kernel module load via insmod>> |Detects the use of the insmod binary to load a Linux kernel object file. Threat actors can use this binary, given they have root privileges, to load a rootkit on a system providing them with complete control and the ability to hide from security products. Manually loading a kernel module in this manner should not be at all common and can indicate suspcious or malicious behavior. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence] [Rootkit]  |8.4.0 |100 <<kernel-module-load-via-insmod-history, Version history>>
+|<<google-workspace-password-policy-modified, Google Workspace Password Policy Modified>> |Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |205
 
-|<<keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> |Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<keychain-password-retrieval-via-command-line-history, Version history>>
+|<<google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app, Google Workspace Restrictions for Google Marketplace Modified to Allow Any App>> |Detects when the Google Marketplace restrictions are changed to allow any application for users in Google Workspace. Malicious APKs created by adversaries may be uploaded to the Google marketplace but not installed on devices managed within Google Workspace. Administrators should set restrictions to not allow any application from the marketplace for security reasons. Adversaries may enable any app to be installed and executed on mobile devices within a Google Workspace environment prior to distributing the malicious APK to the end user. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.4.0 |106
 
-|<<kubernetes-anonymous-request-authorized, Kubernetes Anonymous Request Authorized>> |This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Initial Access] [Defense Evasion]  |8.5.0 |2 <<kubernetes-anonymous-request-authorized-history, Version history>>
+|<<google-workspace-role-modified, Google Workspace Role Modified>> |Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |8.4.0 |205
 
-|<<kubernetes-container-created-with-excessive-linux-capabilities, Kubernetes Container Created with Excessive Linux Capabilities>> |This rule detects a container deployed with one or more dangerously permissive Linux capabilities. An attacker with the ability to deploy a container with added capabilities could use this for further execution, lateral movement, or privilege escalation within a cluster. The capabilities detected in this rule have been used in container escapes to the host machine. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.6.0 |1
+|<<google-workspace-suspended-user-account-renewed, Google Workspace Suspended User Account Renewed>> |Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended user account to maintain access to the Google Workspace organization with a valid account. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.4.0 |2
 
-|<<kubernetes-denied-service-account-request, Kubernetes Denied Service Account Request>> |This rule detects when a service account makes an unauthorized request for resources from the API server. Service accounts follow a very predictable pattern of behavior. A service account should never send an unauthorized request to the API server. This behavior is likely an indicator of compromise or of a problem within the cluster. An adversary may have gained access to credentials/tokens and this could be an attempt to access or create resources to facilitate further movement or execution within the cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Discovery]  |8.5.0 |2 <<kubernetes-denied-service-account-request-history, Version history>>
+|<<google-workspace-user-organizational-unit-changed, Google Workspace User Organizational Unit Changed>> |Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |106
 
-|<<kubernetes-exposed-service-created-with-type-nodeport, Kubernetes Exposed Service Created With Type NodePort>> |This rule detects an attempt to create or modify a service as type NodePort. The NodePort service allows a user to externally expose a set of labeled pods to the internet. This creates an open port on every worker node in the cluster that has a pod for that service. When external traffic is received on that open port, it directs it to the specific pod through the service representing it. A malicious user can configure a service as type Nodeport in order to intercept traffic from other pods or nodes, bypassing firewalls and other network security measures configured for load balancers within a cluster. This creates a direct method of communication between the cluster and the outside world, which could be used for more malicious behavior and certainly widens the attack surface of your cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Persistence]  |8.4.0 |200 <<kubernetes-exposed-service-created-with-type-nodeport-history, Version history>>
+|<<group-policy-abuse-for-privilege-addition, Group Policy Abuse for Privilege Addition>> |Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
 
-|<<kubernetes-pod-created-with-hostipc, Kubernetes Pod Created With HostIPC>> |This rule detects an attempt to create or modify a pod using the host IPC namespace. This gives access to data used by any pod that also use the hosts IPC namespace. If any process on the host or any processes in a pod uses the hosts inter-process communication mechanisms (shared memory, semaphore arrays, message queues, etc.), an attacker can read/write to those same mechanisms. They may look for files in /dev/shm or use ipcs to check for any IPC facilities being used. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.4.0 |200 <<kubernetes-pod-created-with-hostipc-history, Version history>>
+|<<group-policy-discovery-via-microsoft-gpresult-utility, Group Policy Discovery via Microsoft GPResult Utility>> |Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame] |8.3.0 |3
 
-|<<kubernetes-pod-created-with-hostnetwork, Kubernetes Pod Created With HostNetwork>> |This rules detects an attempt to create or modify a pod attached to the host network. HostNetwork allows a pod to use the node network namespace. Doing so gives the pod access to any service running on localhost of the host. An attacker could use this access to snoop on network activity of other pods on the same node or bypass restrictive network policies applied to its given namespace. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.4.0 |200 <<kubernetes-pod-created-with-hostnetwork-history, Version history>>
+|<<halfbaked-command-and-control-beacon, Halfbaked Command and Control Beacon>> |Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |102
 
-|<<kubernetes-pod-created-with-hostpid, Kubernetes Pod Created With HostPID>> |This rule detects an attempt to create or modify a pod attached to the host PID namespace. HostPID allows a pod to access all the processes running on the host and could allow an attacker to take malicious action. When paired with ptrace this can be used to escalate privileges outside of the container. When paired with a privileged container, the pod can see all of the processes on the host. An attacker can enter the init system (PID 1) on the host. From there, they could execute a shell and continue to escalate privileges to root. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.4.0 |200 <<kubernetes-pod-created-with-hostpid-history, Version history>>
+|<<high-number-of-okta-user-password-reset-or-unlock-attempts, High Number of Okta User Password Reset or Unlock Attempts>> |Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<kubernetes-pod-created-with-a-sensitive-hostpath-volume, Kubernetes Pod created with a Sensitive hostPath Volume>> |This rule detects when a pod is created with a sensitive volume of type hostPath. A hostPath volume type mounts a sensitive file or folder from the node to the container. If the container gets compromised, the attacker can use this mount for gaining access to the node. There are many ways a container with unrestricted access to the host filesystem can escalate privileges, including reading data from other containers, and accessing tokens of more privileged pods. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.4.0 |200 <<kubernetes-pod-created-with-a-sensitive-hostpath-volume-history, Version history>>
+|<<high-number-of-process-terminations, High Number of Process Terminations>> |This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<kubernetes-privileged-pod-created, Kubernetes Privileged Pod Created>> |This rule detects when a user creates a pod/container running in privileged mode. A highly privileged container has access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the privileged container to gain access to the underlying host. Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.4.0 |200 <<kubernetes-privileged-pod-created-history, Version history>>
+|<<high-number-of-process-and-or-service-terminations, High Number of Process and/or Service Terminations>> |This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<kubernetes-suspicious-assignment-of-controller-service-account, Kubernetes Suspicious Assignment of Controller Service Account>> |This rule detects a request to attach a controller service account to an existing or new pod running in the kube-system namespace. By default, controllers running as part of the API Server utilize admin-equivalent service accounts hosted in the kube-system namespace. Controller service accounts aren't normally assigned to running pods and could indicate adversary behavior within the cluster. An attacker that can create or modify pods or pod controllers in the kube-system namespace, can assign one of these admin-equivalent service accounts to a pod and abuse their powerful token to escalate privileges and gain complete cluster control. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation]  |8.5.0 |3 <<kubernetes-suspicious-assignment-of-controller-service-account-history, Version history>>
+|<<host-files-system-changes-via-windows-subsystem-for-linux, Host Files System Changes via Windows Subsystem for Linux>> |Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |3
 
-|<<kubernetes-suspicious-self-subject-review, Kubernetes Suspicious Self-Subject Review>> |This rule detects when a service account or node attempts to enumerate their own permissions via the selfsubjectaccessreview or selfsubjectrulesreview APIs. This is highly unusual behavior for non-human identities like service accounts and nodes. An adversary may have gained access to credentials/tokens and this could be an attempt to determine what privileges they have to facilitate further movement or execution within the cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Discovery]  |8.4.0 |200 <<kubernetes-suspicious-self-subject-review-history, Version history>>
+|<<hosts-file-modified, Hosts File Modified>> |The hosts file on endpoints is used to control manual IP address to hostname resolutions. The hosts file is the first point of lookup for DNS hostname resolution so if adversaries can modify the endpoint hosts file, they can route traffic to malicious infrastructure. This rule detects modifications to the hosts file on Microsoft Windows, Linux (Ubuntu or RHEL) and macOS systems. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<kubernetes-user-exec-into-pod, Kubernetes User Exec into Pod>> |This rule detects a user attempt to establish a shell session into a pod using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod. An adversary may call bash to gain a persistent interactive shell which will allow access to any data the pod has permissions to, including secrets. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution]  |8.3.0 |200 <<kubernetes-user-exec-into-pod-history, Version history>>
+|<<hping-process-activity, Hping Process Activity>> |Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<lsass-memory-dump-creation, LSASS Memory Dump Creation>> |Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |7.11.0 |101 <<lsass-memory-dump-creation-history, Version history>>
+|<<iis-http-logging-disabled, IIS HTTP Logging Disabled>> |Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<lsass-memory-dump-handle-access, LSASS Memory Dump Handle Access>> |Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |8.2.0 |102 <<lsass-memory-dump-handle-access-history, Version history>>
+|<<ipsec-nat-traversal-port-activity, IPSEC NAT Traversal Port Activity>> |This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |102
 
-|<<lateral-movement-via-startup-folder, Lateral Movement via Startup Folder>> |Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |100 <<lateral-movement-via-startup-folder-history, Version history>>
+|<<image-file-execution-options-injection, Image File Execution Options Injection>> |The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<launch-agent-creation-or-modification-and-immediate-loading, Launch Agent Creation or Modification and Immediate Loading>> |An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.11.0 |100 <<launch-agent-creation-or-modification-and-immediate-loading-history, Version history>>
+|<<imageload-via-windows-update-auto-update-client, ImageLoad via Windows Update Auto Update Client>> |Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<launchdaemon-creation-or-modification-and-immediate-loading, LaunchDaemon Creation or Modification and Immediate Loading>> |Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.11.0 |100 <<launchdaemon-creation-or-modification-and-immediate-loading-history, Version history>>
+|<<inbound-connection-to-an-unsecure-elasticsearch-node, Inbound Connection to an Unsecure Elasticsearch Node>> |Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port. |[Use Case: Threat Detection], [Tactic: Initial Access], [Domain: Endpoint] |8.3.0 |102
 
-|<<linux-restricted-shell-breakout-via-linux-binarys, Linux Restricted Shell Breakout via  Linux Binary(s)>> |Identifies Linux binary(s) abuse to breakout of restricted shells or environments by spawning an interactive system shell. The linux utility(s) activity of spawning shell is not a standard use of the binary for a user or system administrator. It may indicates an attempt to improve the capabilities or stability of an adversary access. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [GTFOBins]  |8.3.0 |100 <<linux-restricted-shell-breakout-via-linux-binarys-history, Version history>>
+|<<incoming-dcom-lateral-movement-via-mshta, Incoming DCOM Lateral Movement via MSHTA>> |Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |104
 
-|<<local-account-tokenfilter-policy-disabled, Local Account TokenFilter Policy Disabled>> |Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Privilege Escalation] [Elastic Endgame]  |8.6.0 |1
+|<<incoming-dcom-lateral-movement-with-mmc, Incoming DCOM Lateral Movement with MMC>> |Identifies the use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the MMC20 Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |104
 
-|<<local-scheduled-task-creation, Local Scheduled Task Creation>> |Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.6.0 |101 <<local-scheduled-task-creation-history, Version history>>
+|<<incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows, Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows>> |Identifies use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the ShellBrowserWindow or ShellWindows Application COM Object. This behavior may indicate an attacker abusing a DCOM application to stealthily move laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |104
 
-|<<mfa-disabled-for-google-workspace-organization, MFA Disabled for Google Workspace Organization>> |Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence]  |7.11.0 |101 <<mfa-disabled-for-google-workspace-organization-history, Version history>>
+|<<incoming-execution-via-powershell-remoting, Incoming Execution via PowerShell Remoting>> |Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |105
 
-|<<ms-office-macro-security-registry-modifications, MS Office Macro Security Registry Modifications>> |Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |8.1.0 |102 <<ms-office-macro-security-registry-modifications-history, Version history>>
+|<<incoming-execution-via-winrm-remote-shell, Incoming Execution via WinRM Remote Shell>> |Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an indication of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |105
 
-|<<macos-installer-package-spawns-network-event, MacOS Installer Package Spawns Network Event>> |Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package. |[Elastic] [Host] [macOS] [Threat Detection] [Execution] [Command and Control]  |7.12.0 |100 <<macos-installer-package-spawns-network-event-history, Version history>>
+|<<ingress-transfer-via-windows-bits, Ingress Transfer via Windows BITS>> |Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control] |8.3.0 |3
 
-|<<malware-detected-elastic-endgame, Malware - Detected - Elastic Endgame>> |Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame]  |7.6.0 |100 <<malware-detected-elastic-endgame-history, Version history>>
+|<<installutil-process-making-network-connections, InstallUtil Process Making Network Connections>> |Identifies InstallUtil.exe making outbound network connections. This may indicate adversarial activity as InstallUtil is often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<malware-prevented-elastic-endgame, Malware - Prevented - Elastic Endgame>> |Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame]  |7.6.0 |100 <<malware-prevented-elastic-endgame-history, Version history>>
+|<<installation-of-custom-shim-databases, Installation of Custom Shim Databases>> |Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |104
 
-|<<masquerading-space-after-filename, Masquerading Space After Filename>> |This rules identifies a process created from an executable with a space appended to the end of the filename. This may indicate an attempt to masquerade a malicious file as benign to gain user execution. When a space is added to the end of certain files, the OS will execute the file according to it's true filetype instead of it's extension. Adversaries can hide a program's true filetype by changing the extension of the file. They can then add a space to the end of the name so that the OS automatically executes the file when it's double-clicked. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Defense Evasion]  |8.6.0 |1
+|<<installation-of-security-support-provider, Installation of Security Support Provider>> |Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<microsoft-365-exchange-anti-phish-policy-deletion, Microsoft 365 Exchange Anti-Phish Policy Deletion>> |Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-anti-phish-policy-deletion-history, Version history>>
+|<<interactive-exec-command-launched-against-a-running-container, Interactive Exec Command Launched Against A Running Container>> |This rule detects interactive 'exec' events launched against a container using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/command inside the container. This rule specifically targets higher-risk interactive commands that allow real-time interaction with a container's shell. A malicious actor could use this level of access to further compromise the container environment or attempt a container breakout. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
-|<<microsoft-365-exchange-anti-phish-rule-modification, Microsoft 365 Exchange Anti-Phish Rule Modification>> |Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-anti-phish-rule-modification-history, Version history>>
+|<<interactive-terminal-spawned-via-perl, Interactive Terminal Spawned via Perl>> |Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<microsoft-365-exchange-dkim-signing-configuration-disabled, Microsoft 365 Exchange DKIM Signing Configuration Disabled>> |Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Data Protection] [Persistence]  |7.11.0 |101 <<microsoft-365-exchange-dkim-signing-configuration-disabled-history, Version history>>
+|<<interactive-terminal-spawned-via-python, Interactive Terminal Spawned via Python>> |Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<microsoft-365-exchange-dlp-policy-removed, Microsoft 365 Exchange DLP Policy Removed>> |Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365. An adversary may remove a DLP policy to evade existing DLP monitoring. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-dlp-policy-removed-history, Version history>>
+|<<krbtgt-delegation-backdoor, KRBTGT Delegation Backdoor>> |Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT. Attackers can use this technique to maintain persistence to the domain by having the ability to request tickets for the KRBTGT service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |105
 
-|<<microsoft-365-exchange-malware-filter-policy-deletion, Microsoft 365 Exchange Malware Filter Policy Deletion>> |Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-malware-filter-policy-deletion-history, Version history>>
+|<<kerberos-cached-credentials-dumping, Kerberos Cached Credentials Dumping>> |Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<microsoft-365-exchange-malware-filter-rule-modification, Microsoft 365 Exchange Malware Filter Rule Modification>> |Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-malware-filter-rule-modification-history, Version history>>
+|<<kerberos-pre-authentication-disabled-for-user, Kerberos Pre-authentication Disabled for User>> |Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |107
 
-|<<microsoft-365-exchange-management-group-role-assignment, Microsoft 365 Exchange Management Group Role Assignment>> |Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<microsoft-365-exchange-management-group-role-assignment-history, Version history>>
+|<<kerberos-traffic-from-unusual-process, Kerberos Traffic from Unusual Process>> |Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<microsoft-365-exchange-safe-attachment-rule-disabled, Microsoft 365 Exchange Safe Attachment Rule Disabled>> |Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-safe-attachment-rule-disabled-history, Version history>>
+|<<kernel-load-or-unload-via-kexec-detected, Kernel Load or Unload via Kexec Detected>> |This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion] |8.3.0 |1
 
-|<<microsoft-365-exchange-safe-link-policy-disabled, Microsoft 365 Exchange Safe Link Policy Disabled>> |Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<microsoft-365-exchange-safe-link-policy-disabled-history, Version history>>
+|<<kernel-module-removal, Kernel Module Removal>> |Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<microsoft-365-exchange-transport-rule-creation, Microsoft 365 Exchange Transport Rule Creation>> |Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-transport-rule-creation-history, Version history>>
+|<<kernel-module-load-via-insmod, Kernel module load via insmod>> |Detects the use of the insmod binary to load a Linux kernel object file. Threat actors can use this binary, given they have root privileges, to load a rootkit on a system providing them with complete control and the ability to hide from security products. Manually loading a kernel module in this manner should not be at all common and can indicate suspcious or malicious behavior. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Rootkit], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<microsoft-365-exchange-transport-rule-modification, Microsoft 365 Exchange Transport Rule Modification>> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-exchange-transport-rule-modification-history, Version history>>
+|<<keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> |Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |8.1.0 |101 <<microsoft-365-global-administrator-role-assigned-history, Version history>>
+|<<kubernetes-anonymous-request-authorized, Kubernetes Anonymous Request Authorized>> |This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Initial Access], [Tactic: Defense Evasion] |8.4.0 |5
 
-|<<microsoft-365-inbox-forwarding-rule-created, Microsoft 365 Inbox Forwarding Rule Created>> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.13.0 |101 <<microsoft-365-inbox-forwarding-rule-created-history, Version history>>
+|<<kubernetes-container-created-with-excessive-linux-capabilities, Kubernetes Container Created with Excessive Linux Capabilities>> |This rule detects a container deployed with one or more dangerously permissive Linux capabilities. An attacker with the ability to deploy a container with added capabilities could use this for further execution, lateral movement, or privilege escalation within a cluster. The capabilities detected in this rule have been used in container escapes to the host machine. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |3
 
-|<<microsoft-365-potential-ransomware-activity, Microsoft 365 Potential ransomware activity>> |Identifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.16.0 |101 <<microsoft-365-potential-ransomware-activity-history, Version history>>
+|<<kubernetes-denied-service-account-request, Kubernetes Denied Service Account Request>> |This rule detects when a service account makes an unauthorized request for resources from the API server. Service accounts follow a very predictable pattern of behavior. A service account should never send an unauthorized request to the API server. This behavior is likely an indicator of compromise or of a problem within the cluster. An adversary may have gained access to credentials/tokens and this could be an attempt to access or create resources to facilitate further movement or execution within the cluster. |[Data Source: Kubernetes], [Tactic: Discovery] |8.4.0 |4
 
-|<<microsoft-365-teams-custom-application-interaction-allowed, Microsoft 365 Teams Custom Application Interaction Allowed>> |Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence]  |7.11.0 |101 <<microsoft-365-teams-custom-application-interaction-allowed-history, Version history>>
+|<<kubernetes-exposed-service-created-with-type-nodeport, Kubernetes Exposed Service Created With Type NodePort>> |This rule detects an attempt to create or modify a service as type NodePort. The NodePort service allows a user to externally expose a set of labeled pods to the internet. This creates an open port on every worker node in the cluster that has a pod for that service. When external traffic is received on that open port, it directs it to the specific pod through the service representing it. A malicious user can configure a service as type Nodeport in order to intercept traffic from other pods or nodes, bypassing firewalls and other network security measures configured for load balancers within a cluster. This creates a direct method of communication between the cluster and the outside world, which could be used for more malicious behavior and certainly widens the attack surface of your cluster. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Persistence] |8.4.0 |202
 
-|<<microsoft-365-teams-external-access-enabled, Microsoft 365 Teams External Access Enabled>> |Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-teams-external-access-enabled-history, Version history>>
+|<<kubernetes-pod-created-with-hostipc, Kubernetes Pod Created With HostIPC>> |This rule detects an attempt to create or modify a pod using the host IPC namespace. This gives access to data used by any pod that also use the hosts IPC namespace. If any process on the host or any processes in a pod uses the hosts inter-process communication mechanisms (shared memory, semaphore arrays, message queues, etc.), an attacker can read/write to those same mechanisms. They may look for files in /dev/shm or use ipcs to check for any IPC facilities being used. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |202
 
-|<<microsoft-365-teams-guest-access-enabled, Microsoft 365 Teams Guest Access Enabled>> |Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.11.0 |101 <<microsoft-365-teams-guest-access-enabled-history, Version history>>
+|<<kubernetes-pod-created-with-hostnetwork, Kubernetes Pod Created With HostNetwork>> |This rules detects an attempt to create or modify a pod attached to the host network. HostNetwork allows a pod to use the node network namespace. Doing so gives the pod access to any service running on localhost of the host. An attacker could use this access to snoop on network activity of other pods on the same node or bypass restrictive network policies applied to its given namespace. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |202
 
-|<<microsoft-365-unusual-volume-of-file-deletion, Microsoft 365 Unusual Volume of File Deletion>> |Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.16.0 |101 <<microsoft-365-unusual-volume-of-file-deletion-history, Version history>>
+|<<kubernetes-pod-created-with-hostpid, Kubernetes Pod Created With HostPID>> |This rule detects an attempt to create or modify a pod attached to the host PID namespace. HostPID allows a pod to access all the processes running on the host and could allow an attacker to take malicious action. When paired with ptrace this can be used to escalate privileges outside of the container. When paired with a privileged container, the pod can see all of the processes on the host. An attacker can enter the init system (PID 1) on the host. From there, they could execute a shell and continue to escalate privileges to root. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |202
 
-|<<microsoft-365-user-restricted-from-sending-email, Microsoft 365 User Restricted from Sending Email>> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.16.0 |101 <<microsoft-365-user-restricted-from-sending-email-history, Version history>>
+|<<kubernetes-pod-created-with-a-sensitive-hostpath-volume, Kubernetes Pod created with a Sensitive hostPath Volume>> |This rule detects when a pod is created with a sensitive volume of type hostPath. A hostPath volume type mounts a sensitive file or folder from the node to the container. If the container gets compromised, the attacker can use this mount for gaining access to the node. There are many ways a container with unrestricted access to the host filesystem can escalate privileges, including reading data from other containers, and accessing tokens of more privileged pods. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |202
 
-|<<microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> |An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.7.0 |102 <<microsoft-build-engine-started-an-unusual-process-history, Version history>>
+|<<kubernetes-privileged-pod-created, Kubernetes Privileged Pod Created>> |This rule detects when a user creates a pod/container running in privileged mode. A highly privileged container has access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the privileged container to gain access to the underlying host. Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |202
 
-|<<microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.7.0 |101 <<microsoft-build-engine-started-by-a-script-process-history, Version history>>
+|<<kubernetes-suspicious-assignment-of-controller-service-account, Kubernetes Suspicious Assignment of Controller Service Account>> |This rule detects a request to attach a controller service account to an existing or new pod running in the kube-system namespace. By default, controllers running as part of the API Server utilize admin-equivalent service accounts hosted in the kube-system namespace. Controller service accounts aren't normally assigned to running pods and could indicate adversary behavior within the cluster. An attacker that can create or modify pods or pod controllers in the kube-system namespace, can assign one of these admin-equivalent service accounts to a pod and abuse their powerful token to escalate privileges and gain complete cluster control. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Privilege Escalation] |8.4.0 |5
 
-|<<microsoft-build-engine-started-by-a-system-process, Microsoft Build Engine Started by a System Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.7.0 |102 <<microsoft-build-engine-started-by-a-system-process-history, Version history>>
+|<<kubernetes-suspicious-self-subject-review, Kubernetes Suspicious Self-Subject Review>> |This rule detects when a service account or node attempts to enumerate their own permissions via the selfsubjectaccessreview or selfsubjectrulesreview APIs. This is highly unusual behavior for non-human identities like service accounts and nodes. An adversary may have gained access to credentials/tokens and this could be an attempt to determine what privileges they have to facilitate further movement or execution within the cluster. |[Data Source: Kubernetes], [Tactic: Discovery] |8.4.0 |202
 
-|<<microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> |An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.7.0 |102 <<microsoft-build-engine-started-by-an-office-application-history, Version history>>
+|<<kubernetes-user-exec-into-pod, Kubernetes User Exec into Pod>> |This rule detects a user attempt to establish a shell session into a pod using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod. An adversary may call bash to gain a persistent interactive shell which will allow access to any data the pod has permissions to, including secrets. |[Data Source: Kubernetes], [Tactic: Execution] |8.4.0 |202
 
-|<<microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> |An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.7.0 |102 <<microsoft-build-engine-using-an-alternate-name-history, Version history>>
+|<<lsass-memory-dump-creation, LSASS Memory Dump Creation>> |Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |7.12.0 |100 <<microsoft-exchange-server-um-spawning-suspicious-processes-history, Version history>>
+|<<lsass-memory-dump-handle-access, LSASS Memory Dump Handle Access>> |Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |108
 
-|<<microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> |Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |7.12.0 |100 <<microsoft-exchange-server-um-writing-suspicious-files-history, Version history>>
+|<<lsass-process-access-via-windows-api, LSASS Process Access via Windows API>> |Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access] |8.7.0 |2
 
-|<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |7.12.0 |100 <<microsoft-exchange-worker-spawning-suspicious-processes-history, Version history>>
+|<<lateral-movement-via-startup-folder, Lateral Movement via Startup Folder>> |Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> |Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |7.10.0 |102 <<microsoft-iis-connection-strings-decryption-history, Version history>>
+|<<launch-agent-creation-or-modification-and-immediate-loading, Launch Agent Creation or Modification and Immediate Loading>> |An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> |Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |7.10.0 |102 <<microsoft-iis-service-account-password-dumped-history, Version history>>
+|<<launchdaemon-creation-or-modification-and-immediate-loading, LaunchDaemon Creation or Modification and Immediate Loading>> |Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<microsoft-windows-defender-tampering, Microsoft Windows Defender Tampering>> |Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |8.0.0 |102 <<microsoft-windows-defender-tampering-history, Version history>>
+|<<linux-group-creation, Linux Group Creation>> |Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |2
 
-|<<mimikatz-memssp-log-file-detected, Mimikatz Memssp Log File Detected>> |Identifies the password log file from the default Mimikatz memssp module. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<mimikatz-memssp-log-file-detected-history, Version history>>
+|<<linux-restricted-shell-breakout-via-linux-binary-s, Linux Restricted Shell Breakout via Linux Binary(s)>> |Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<modification-of-amsienable-registry-key, Modification of AmsiEnable Registry Key>> |Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.14.0 |102 <<modification-of-amsienable-registry-key-history, Version history>>
+|<<linux-system-information-discovery, Linux System Information Discovery>> |Enrich process events with uname and other command lines that imply Linux system information discovery. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |1
 
-|<<modification-of-boot-configuration, Modification of Boot Configuration>> |Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide]  |7.7.0 |102 <<modification-of-boot-configuration-history, Version history>>
+|<<linux-user-account-creation, Linux User Account Creation>> |Identifies attempts to create new users. Attackers may add new users to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |2
 
-|<<modification-of-dynamic-linker-preload-shared-object, Modification of Dynamic Linker Preload Shared Object>> |Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries. |[Elastic] [Host] [Linux] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<modification-of-dynamic-linker-preload-shared-object-history, Version history>>
+|<<linux-user-added-to-privileged-group, Linux User Added to Privileged Group>> |Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |2
 
-|<<modification-of-environment-variable-via-launchctl, Modification of Environment Variable via Launchctl>> |Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<modification-of-environment-variable-via-launchctl-history, Version history>>
+|<<local-account-tokenfilter-policy-disabled, Local Account TokenFilter Policy Disabled>> |Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |4
 
-|<<modification-of-openssh-binaries, Modification of OpenSSH Binaries>> |Adversaries may modify SSH related binaries for persistence or credential access by patching sensitive functions to enable unauthorized access or by logging SSH credentials for exfiltration. |[Elastic] [Host] [Linux] [Threat Detection] [Credential Access] [Persistence]  |7.12.0 |100 <<modification-of-openssh-binaries-history, Version history>>
+|<<local-scheduled-task-creation, Local Scheduled Task Creation>> |Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |104
 
-|<<modification-of-safari-settings-via-defaults-command, Modification of Safari Settings via Defaults Command>> |Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<modification-of-safari-settings-via-defaults-command-history, Version history>>
+|<<mfa-disabled-for-google-workspace-organization, MFA Disabled for Google Workspace Organization>> |Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |205
 
-|<<modification-of-standard-authentication-module-or-configuration, Modification of Standard Authentication Module or Configuration>> |Adversaries may modify the standard authentication module for persistence via patching the normal authorization process or modifying the login configuration to allow unauthorized access or elevate privileges. |[Elastic] [Host] [macOS] [Linux] [Threat Detection] [Credential Access] [Persistence]  |7.12.0 |100 <<modification-of-standard-authentication-module-or-configuration-history, Version history>>
+|<<ms-office-macro-security-registry-modifications, MS Office Macro Security Registry Modifications>> |Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide] [Elastic Endgame]  |7.12.0 |102 <<modification-of-wdigest-security-provider-history, Version history>>
+|<<macos-installer-package-spawns-network-event, MacOS Installer Package Spawns Network Event>> |Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Command and Control] |8.3.0 |103
 
-|<<modification-of-the-mspkiaccountcredentials, Modification of the msPKIAccountCredentials>> |Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys, certificates, and certificate requests. |[Elastic] [Host] [Windows] [Threat Detection] [Active Directory] [Privilege Escalation]  |8.6.0 |1
+|<<malware-detected-elastic-endgame, Malware - Detected - Elastic Endgame>> |Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |101
 
-|<<modification-or-removal-of-an-okta-application-sign-on-policy, Modification or Removal of an Okta Application Sign-On Policy>> |Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence]  |7.9.0 |102 <<modification-or-removal-of-an-okta-application-sign-on-policy-history, Version history>>
+|<<malware-prevented-elastic-endgame, Malware - Prevented - Elastic Endgame>> |Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |101
 
-|<<mounting-hidden-or-webdav-remote-shares, Mounting Hidden or WebDav Remote Shares>> |Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access] [Lateral Movement]  |7.11.0 |102 <<mounting-hidden-or-webdav-remote-shares-history, Version history>>
+|<<masquerading-space-after-filename, Masquerading Space After Filename>> |This rules identifies a process created from an executable with a space appended to the end of the filename. This may indicate an attempt to masquerade a malicious file as benign to gain user execution. When a space is added to the end of certain files, the OS will execute the file according to it's true filetype instead of it's extension. Adversaries can hide a program's true filetype by changing the extension of the file. They can then add a space to the end of the name so that the OS automatically executes the file when it's double-clicked. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |3
 
-|<<msbuild-making-network-connections, MsBuild Making Network Connections>> |Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.6.0 |100 <<msbuild-making-network-connections-history, Version history>>
+|<<microsoft-365-exchange-anti-phish-policy-deletion, Microsoft 365 Exchange Anti-Phish Policy Deletion>> |Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |102
 
-|<<mshta-making-network-connections, Mshta Making Network Connections>> |Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |101 <<mshta-making-network-connections-history, Version history>>
+|<<microsoft-365-exchange-anti-phish-rule-modification, Microsoft 365 Exchange Anti-Phish Rule Modification>> |Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |102
 
-|<<multi-factor-authentication-disabled-for-an-azure-user, Multi-Factor Authentication Disabled for an Azure User>> |Identifies when multi-factor authentication (MFA) is disabled for an Azure user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.10.0 |103 <<multi-factor-authentication-disabled-for-an-azure-user-history, Version history>>
+|<<microsoft-365-exchange-dkim-signing-configuration-disabled, Microsoft 365 Exchange DKIM Signing Configuration Disabled>> |Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Persistence] |8.3.0 |102
 
-|<<multiple-alerts-in-different-att-ck-tactics-on-a-single-host, Multiple Alerts in Different ATT&CK Tactics on a Single Host>> |This rule uses alert data to determine when multiple alerts in different phases of an attack involving the same host are triggered. Analysts can use this to prioritize triage and response, as these hosts are more likely to be compromised. |[Elastic] [Threat Detection] [Higher-Order Rules]  |8.6.0 |1
+|<<microsoft-365-exchange-dlp-policy-removed, Microsoft 365 Exchange DLP Policy Removed>> |Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365. An adversary may remove a DLP policy to evade existing DLP monitoring. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<multiple-logon-failure-followed-by-logon-success, Multiple Logon Failure Followed by Logon Success>> |Identifies multiple logon failures followed by a successful one from the same source address. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<microsoft-365-exchange-malware-filter-policy-deletion, Microsoft 365 Exchange Malware Filter Policy Deletion>> |Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<multiple-logon-failure-from-the-same-source-address, Multiple Logon Failure from the same Source Address>> |Identifies multiple consecutive logon failures from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<microsoft-365-exchange-malware-filter-rule-modification, Microsoft 365 Exchange Malware Filter Rule Modification>> |Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<multiple-vault-web-credentials-read, Multiple Vault Web Credentials Read>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access]  |8.5.0 |2 <<multiple-vault-web-credentials-read-history, Version history>>
+|<<microsoft-365-exchange-management-group-role-assignment, Microsoft 365 Exchange Management Group Role Assignment>> |Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<my-first-alert, My First Alert>> |This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity. |[Elastic] [Example] [Guided Onboarding] [Network] [APM] [Windows] [Elastic Endgame]  |8.6.0 |1
+|<<microsoft-365-exchange-safe-attachment-rule-disabled, Microsoft 365 Exchange Safe Attachment Rule Disabled>> |Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<ntds-or-sam-database-file-copied, NTDS or SAM Database File Copied>> |Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |7.11.0 |102 <<ntds-or-sam-database-file-copied-history, Version history>>
+|<<microsoft-365-exchange-safe-link-policy-disabled, Microsoft 365 Exchange Safe Link Policy Disabled>> |Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.3.0 |102
 
-|<<namespace-manipulation-using-unshare, Namespace Manipulation Using Unshare>> |Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges. |[Elastic] [Host] [Linux] [Threat Detection] [Privilege Escalation]  |8.5.0 |1
+|<<microsoft-365-exchange-transport-rule-creation, Microsoft 365 Exchange Transport Rule Creation>> |Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |8.3.0 |102
 
-|<<network-connection-via-certutil, Network Connection via Certutil>> |Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide]  |7.7.0 |102 <<network-connection-via-certutil-history, Version history>>
+|<<microsoft-365-exchange-transport-rule-modification, Microsoft 365 Exchange Transport Rule Modification>> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |8.3.0 |102
 
-|<<network-connection-via-compiled-html-file, Network Connection via Compiled HTML File>> |Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). |[Elastic] [Host] [Windows] [Threat Detection] [Execution]  |7.6.0 |100 <<network-connection-via-compiled-html-file-history, Version history>>
+|<<microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<network-connection-via-msxsl, Network Connection via MsXsl>> |Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.7.0 |100 <<network-connection-via-msxsl-history, Version history>>
+|<<microsoft-365-impossible-travel-activity, Microsoft 365 Impossible travel activity>> |Identifies when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |None |1
 
-|<<network-connection-via-registration-utility, Network Connection via Registration Utility>> |Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or RegAsm.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary. |[Elastic] [Host] [Windows] [Threat Detection] [Execution]  |7.6.0 |100 <<network-connection-via-registration-utility-history, Version history>>
+|<<microsoft-365-inbox-forwarding-rule-created, Microsoft 365 Inbox Forwarding Rule Created>> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Collection] |8.3.0 |102
 
-|<<network-connection-via-signed-binary, Network Connection via Signed Binary>> |Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.6.0 |100 <<network-connection-via-signed-binary-history, Version history>>
+|<<microsoft-365-mass-download-by-a-single-user, Microsoft 365 Mass download by a single user>> |Identifies when Microsoft Cloud App Security reports that a single user performs more than 50 downloads within 1 minute. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |None |1
 
-|<<network-logon-provider-registry-modification, Network Logon Provider Registry Modification>> |Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Credential Access] [Elastic Endgame]  |7.13.0 |101 <<network-logon-provider-registry-modification-history, Version history>>
+|<<microsoft-365-potential-ransomware-activity, Microsoft 365 Potential ransomware activity>> |Identifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Impact] |8.3.0 |102
 
-|<<network-traffic-to-rare-destination-country, Network Traffic to Rare Destination Country>> |A machine learning job detected a rare destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. |[Elastic] [Network] [Threat Detection] [ML]  |7.13.0 |100 <<network-traffic-to-rare-destination-country-history, Version history>>
+|<<microsoft-365-teams-custom-application-interaction-allowed, Microsoft 365 Teams Custom Application Interaction Allowed>> |Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<new-activesyncalloweddeviceid-added-via-powershell, New ActiveSyncAllowedDeviceID Added via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |101 <<new-activesyncalloweddeviceid-added-via-powershell-history, Version history>>
+|<<microsoft-365-teams-external-access-enabled, Microsoft 365 Teams External Access Enabled>> |Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<new-or-modified-federation-domain, New or Modified Federation Domain>> |Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.16.0 |101 <<new-or-modified-federation-domain-history, Version history>>
+|<<microsoft-365-teams-guest-access-enabled, Microsoft 365 Teams Guest Access Enabled>> |Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<nping-process-activity, Nping Process Activity>> |Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing. |[Elastic] [Host] [Linux] [Threat Detection] [Discovery]  |7.6.0 |100 <<nping-process-activity-history, Version history>>
+|<<microsoft-365-unusual-volume-of-file-deletion, Microsoft 365 Unusual Volume of File Deletion>> |Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Impact] |8.3.0 |102
 
-|<<nullsessionpipe-registry-modification, NullSessionPipe Registry Modification>> |Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.13.0 |101 <<nullsessionpipe-registry-modification-history, Version history>>
+|<<microsoft-365-user-restricted-from-sending-email, Microsoft 365 User Restricted from Sending Email>> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |102
 
-|<<o365-email-reported-by-user-as-malware-or-phish, O365 Email Reported by User as Malware or Phish>> |Detects the occurrence of emails reported as Phishing or Malware by Users. Security Awareness training is essential to stay ahead of scammers and threat actors, as security products can be bypassed, and the user can still receive a malicious message. Educating users to report suspicious messages can help identify gaps in security controls and prevent malware infections and Business Email Compromise attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Initial Access]  |8.1.0 |101 <<o365-email-reported-by-user-as-malware-or-phish-history, Version history>>
+|<<microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> |An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<o365-excessive-single-sign-on-logon-errors, O365 Excessive Single Sign-On Logon Errors>> |Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.14.0 |101 <<o365-excessive-single-sign-on-logon-errors-history, Version history>>
+|<<microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<o365-exchange-suspicious-mailbox-right-delegation, O365 Exchange Suspicious Mailbox Right Delegation>> |Identifies the assignment of rights to access content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target organization while creating inbox rules, so messages can evade spam/phishing detection mechanisms. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.16.0 |101 <<o365-exchange-suspicious-mailbox-right-delegation-history, Version history>>
+|<<microsoft-build-engine-started-by-a-system-process, Microsoft Build Engine Started by a System Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<o365-mailbox-audit-logging-bypass, O365 Mailbox Audit Logging Bypass>> |Detects the occurrence of mailbox audit bypass associations. The mailbox audit is responsible for logging specified mailbox events (like accessing a folder or a message or permanently deleting a message). However, actions taken by some authorized accounts, such as accounts used by third-party tools or accounts used for lawful monitoring, can create a large number of mailbox audit log entries and may not be of interest to your organization. Because of this, administrators can create bypass associations, allowing certain accounts to perform their tasks without being logged. Attackers can abuse this allowlist mechanism to conceal actions taken, as the mailbox audit will log no activity done by the account. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Initial Access]  |8.0.0 |101 <<o365-mailbox-audit-logging-bypass-history, Version history>>
+|<<microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> |An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<okta-brute-force-or-password-spraying-attack, Okta Brute Force or Password Spraying Attack>> |Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.9.0 |102 <<okta-brute-force-or-password-spraying-attack-history, Version history>>
+|<<microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> |An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<okta-user-session-impersonation, Okta User Session Impersonation>> |A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Credential Access]  |8.2.0 |102 <<okta-user-session-impersonation-history, Version history>>
+|<<microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<onedrive-malware-file-upload, OneDrive Malware File Upload>> |Identifies the occurence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Lateral Movement]  |8.1.0 |101 <<onedrive-malware-file-upload-history, Version history>>
+|<<microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> |Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> |Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. |[Elastic] [Host] [Windows] [Threat Detection] [Execution]  |7.11.0 |100 <<outbound-scheduled-task-activity-via-powershell-history, Version history>>
+|<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<parent-process-pid-spoofing, Parent Process PID Spoofing>> |Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.14.0 |100 <<parent-process-pid-spoofing-history, Version history>>
+|<<microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> |Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<peripheral-device-discovery, Peripheral Device Discovery>> |Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<peripheral-device-discovery-history, Version history>>
+|<<microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> |Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<permission-theft-detected-elastic-endgame, Permission Theft - Detected - Elastic Endgame>> |Elastic Endgame detected Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation]  |7.6.0 |100 <<permission-theft-detected-elastic-endgame-history, Version history>>
+|<<microsoft-windows-defender-tampering, Microsoft Windows Defender Tampering>> |Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<permission-theft-prevented-elastic-endgame, Permission Theft - Prevented - Elastic Endgame>> |Elastic Endgame prevented Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation]  |7.6.0 |100 <<permission-theft-prevented-elastic-endgame-history, Version history>>
+|<<mimikatz-memssp-log-file-detected, Mimikatz Memssp Log File Detected>> |Identifies the password log file from the default Mimikatz memssp module. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<persistence-via-bits-job-notify-cmdline, Persistence via BITS Job Notify Cmdline>> |An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.13.0 |100 <<persistence-via-bits-job-notify-cmdline-history, Version history>>
+|<<modification-of-amsienable-registry-key, Modification of AmsiEnable Registry Key>> |Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<persistence-via-directoryservice-plugin-modification, Persistence via DirectoryService Plugin Modification>> |Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<persistence-via-directoryservice-plugin-modification-history, Version history>>
+|<<modification-of-boot-configuration, Modification of Boot Configuration>> |Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<persistence-via-docker-shortcut-modification, Persistence via Docker Shortcut Modification>> |An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<persistence-via-docker-shortcut-modification-history, Version history>>
+|<<modification-of-dynamic-linker-preload-shared-object, Modification of Dynamic Linker Preload Shared Object>> |Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<persistence-via-folder-action-script, Persistence via Folder Action Script>> |Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. |[Elastic] [Host] [macOS] [Threat Detection] [Execution] [Persistence]  |7.11.0 |100 <<persistence-via-folder-action-script-history, Version history>>
+|<<modification-of-dynamic-linker-preload-shared-object-inside-a-container, Modification of Dynamic Linker Preload Shared Object Inside A Container>> |This rule detects the creation or modification of the dynamic linker preload shared object (ld.so.preload) inside a container. The Linux dynamic linker is used to load libraries needed by a program at runtime. Adversaries may hijack the dynamic linker by modifying the /etc/ld.so.preload file to point to malicious libraries. This behavior can be used to grant unauthorized access to system resources and has been used to evade detection of malicious processes in container environments. |[Data Source: Elastic Defend for Containers], [Domain: Container], [Tactic: Defense Evasion] |8.8.0 |1
 
-|<<persistence-via-hidden-run-key-detected, Persistence via Hidden Run Key Detected>> |Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit). |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<persistence-via-hidden-run-key-detected-history, Version history>>
+|<<modification-of-environment-variable-via-launchctl, Modification of Environment Variable via Launchctl>> |Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<persistence-via-kde-autostart-script-or-desktop-file-modification, Persistence via KDE AutoStart Script or Desktop File Modification>> |Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence]  |7.12.0 |100 <<persistence-via-kde-autostart-script-or-desktop-file-modification-history, Version history>>
+|<<modification-of-openssh-binaries, Modification of OpenSSH Binaries>> |Adversaries may modify SSH related binaries for persistence or credential access by patching sensitive functions to enable unauthorized access or by logging SSH credentials for exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<persistence-via-login-or-logout-hook, Persistence via Login or Logout Hook>> |Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.11.0 |100 <<persistence-via-login-or-logout-hook-history, Version history>>
+|<<modification-of-safari-settings-via-defaults-command, Modification of Safari Settings via Defaults Command>> |Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<persistence-via-microsoft-office-addins, Persistence via Microsoft Office AddIns>> |Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<persistence-via-microsoft-office-addins-history, Version history>>
+|<<modification-of-standard-authentication-module-or-configuration, Modification of Standard Authentication Module or Configuration>> |Adversaries may modify the standard authentication module for persistence via patching the normal authorization process or modifying the login configuration to allow unauthorized access or elevate privileges. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence] |8.3.0 |103
 
-|<<persistence-via-microsoft-outlook-vba, Persistence via Microsoft Outlook VBA>> |Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<persistence-via-microsoft-outlook-vba-history, Version history>>
+|<<modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<persistence-via-powershell-profile, Persistence via PowerShell profile>> |Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |8.6.0 |1
+|<<modification-of-the-mspkiaccountcredentials, Modification of the msPKIAccountCredentials>> |Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys, certificates, and certificate requests. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Data Source: Active Directory], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring] |8.3.0 |6
 
-|<<persistence-via-scheduled-job-creation, Persistence via Scheduled Job Creation>> |A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.13.0 |100 <<persistence-via-scheduled-job-creation-history, Version history>>
+|<<modification-or-removal-of-an-okta-application-sign-on-policy, Modification or Removal of an Okta Application Sign-On Policy>> |Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |103
 
-|<<persistence-via-telemetrycontroller-scheduled-task-hijack, Persistence via TelemetryController Scheduled Task Hijack>> |Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.10.0 |101 <<persistence-via-telemetrycontroller-scheduled-task-hijack-history, Version history>>
+|<<mounting-hidden-or-webdav-remote-shares, Mounting Hidden or WebDav Remote Shares>> |Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<persistence-via-update-orchestrator-service-hijack, Persistence via Update Orchestrator Service Hijack>> |Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [CVE-2020-1313] [Investigation Guide]  |7.10.0 |102 <<persistence-via-update-orchestrator-service-hijack-history, Version history>>
+|<<msbuild-making-network-connections, MsBuild Making Network Connections>> |Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<persistence-via-wmi-event-subscription, Persistence via WMI Event Subscription>> |An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |102 <<persistence-via-wmi-event-subscription-history, Version history>>
+|<<msbuild-network-connection-sequence, MsBuild Network Connection Sequence>> |Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |None |1
 
-|<<persistence-via-wmi-standard-registry-provider, Persistence via WMI Standard Registry Provider>> |Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.13.0 |101 <<persistence-via-wmi-standard-registry-provider-history, Version history>>
+|<<msxsl-making-network-connections, MsXsl Making Network Connections>> |Identifies MsXsl.exe making outbound network connections. This may indicate adversarial activity as MsXsl is often leveraged by adversaries to execute malicious scripts and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |None |1
 
-|<<persistent-scripts-in-the-startup-directory, Persistent Scripts in the Startup Directory>> |Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.11.0 |102 <<persistent-scripts-in-the-startup-directory-history, Version history>>
+|<<mshta-making-network-connections, Mshta Making Network Connections>> |Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<port-forwarding-rule-addition, Port Forwarding Rule Addition>> |Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<port-forwarding-rule-addition-history, Version history>>
+|<<multi-factor-authentication-disabled-for-an-azure-user, Multi-Factor Authentication Disabled for an Azure User>> |Identifies when multi-factor authentication (MFA) is disabled for an Azure user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |8.3.0 |105
 
-|<<possible-consent-grant-attack-via-azure-registered-application, Possible Consent Grant Attack via Azure-Registered Application>> |Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide permissions to an application. An adversary may create an Azure-registered application that requests access to data such as contact information, email, or documents. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [Investigation Guide]  |7.10.0 |103 <<possible-consent-grant-attack-via-azure-registered-application-history, Version history>>
+|<<multiple-alerts-involving-a-user, Multiple Alerts Involving a User>> |This rule uses alert data to determine when multiple different alerts involving the same user are triggered. Analysts can use this to prioritize triage and response, as these users are more likely to be compromised. |[Use Case: Threat Detection], [Rule Type: Higher-Order Rule] |8.3.0 |3
 
-|<<possible-fin7-dga-command-and-control-behavior, Possible FIN7 DGA Command and Control Behavior>> |This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. |[Elastic] [Network] [Threat Detection] [Command and Control] [Host]  |7.10.0 |100 <<possible-fin7-dga-command-and-control-behavior-history, Version history>>
+|<<multiple-alerts-in-different-att-ck-tactics-on-a-single-host, Multiple Alerts in Different ATT&CK Tactics on a Single Host>> |This rule uses alert data to determine when multiple alerts in different phases of an attack involving the same host are triggered. Analysts can use this to prioritize triage and response, as these hosts are more likely to be compromised. |[Use Case: Threat Detection], [Rule Type: Higher-Order Rule] |8.3.0 |4
 
-|<<possible-okta-dos-attack, Possible Okta DoS Attack>> |Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an organization's business operations by performing a DoS attack against its Okta service. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |102 <<possible-okta-dos-attack-history, Version history>>
+|<<multiple-logon-failure-followed-by-logon-success, Multiple Logon Failure Followed by Logon Success>> |Identifies multiple logon failures followed by a successful one from the same source address. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |7
 
-|<<potential-abuse-of-repeated-mfa-push-notifications, Potential Abuse of Repeated MFA Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |8.1.0 |101 <<potential-abuse-of-repeated-mfa-push-notifications-history, Version history>>
+|<<multiple-logon-failure-from-the-same-source-address, Multiple Logon Failure from the same Source Address>> |Identifies multiple consecutive logon failures from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |7
 
-|<<potential-admin-group-account-addition, Potential Admin Group Account Addition>> |Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity. |[Elastic] [Host] [macOS] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<potential-admin-group-account-addition-history, Version history>>
+|<<multiple-vault-web-credentials-read, Multiple Vault Web Credentials Read>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |8
 
-|<<potential-application-shimming-via-sdbinst, Potential Application Shimming via Sdbinst>> |The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.6.0 |102 <<potential-application-shimming-via-sdbinst-history, Version history>>
+|<<my-first-rule, My First Rule>> |This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity. |[Use Case: Guided Onboarding], [Data Source: APM], [OS: Windows], [Data Source: Elastic Endgame] |8.7.0 |2
 
-|<<potential-command-and-control-via-internet-explorer, Potential Command and Control via Internet Explorer>> |Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control]  |7.11.0 |100 <<potential-command-and-control-via-internet-explorer-history, Version history>>
+|<<ntds-or-sam-database-file-copied, NTDS or SAM Database File Copied>> |Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<potential-cookies-theft-via-browser-debugging, Potential Cookies Theft via Browser Debugging>> |Identifies the execution of a Chromium based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. |[Elastic] [Host] [Linux] [Windows] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<potential-cookies-theft-via-browser-debugging-history, Version history>>
+|<<namespace-manipulation-using-unshare, Namespace Manipulation Using Unshare>> |Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |5
 
-|<<potential-credential-access-via-dcsync, Potential Credential Access via DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Active Directory] [Investigation Guide]  |8.1.0 |102 <<potential-credential-access-via-dcsync-history, Version history>>
+|<<netcat-listener-established-inside-a-container, Netcat Listener Established Inside A Container>> |This rule detects an established netcat listener running inside a container. Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence or exfiltrating data. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
-|<<potential-credential-access-via-duplicatehandle-in-lsass, Potential Credential Access via DuplicateHandle in LSASS>> |Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Sysmon Only]  |7.16.0 |101 <<potential-credential-access-via-duplicatehandle-in-lsass-history, Version history>>
+|<<network-connection-via-certutil, Network Connection via Certutil>> |Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<potential-credential-access-via-lsass-memory-dump, Potential Credential Access via LSASS Memory Dump>> |Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Sysmon Only]  |8.0.0 |101 <<potential-credential-access-via-lsass-memory-dump-history, Version history>>
+|<<network-connection-via-compiled-html-file, Network Connection via Compiled HTML File>> |Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<potential-credential-access-via-renamed-com-services-dll, Potential Credential Access via Renamed COM+ Services DLL>> |Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump function that can be used to dump a process memory. This may indicate an attempt to dump LSASS memory while bypassing command-line based detection in preparation for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Sysmon Only]  |8.0.0 |101 <<potential-credential-access-via-renamed-com-services-dll-history, Version history>>
+|<<network-connection-via-msxsl, Network Connection via MsXsl>> |Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<potential-credential-access-via-trusted-developer-utility, Potential Credential Access via Trusted Developer Utility>> |An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |7.7.0 |102 <<potential-credential-access-via-trusted-developer-utility-history, Version history>>
+|<<network-connection-via-registration-utility, Network Connection via Registration Utility>> |Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or RegAsm.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> |Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<potential-credential-access-via-windows-utilities-history, Version history>>
+|<<network-connection-via-signed-binary, Network Connection via Signed Binary>> |Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> |Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.14.0 |101 <<potential-dll-side-loading-via-microsoft-antimalware-service-executable-history, Version history>>
+|<<network-logon-provider-registry-modification, Network Logon Provider Registry Modification>> |Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-dll-sideloading-via-trusted-microsoft-programs, Potential DLL SideLoading via Trusted Microsoft Programs>> |Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |101 <<potential-dll-sideloading-via-trusted-microsoft-programs-history, Version history>>
+|<<network-traffic-to-rare-destination-country, Network Traffic to Rare Destination Country>> |A machine learning job detected a rare destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
 
-|<<potential-dns-tunneling-via-iodine, Potential DNS Tunneling via Iodine>> |Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection. |[Elastic] [Host] [Linux] [Threat Detection] [Command and Control]  |7.6.0 |100 <<potential-dns-tunneling-via-iodine-history, Version history>>
+|<<new-activesyncalloweddeviceid-added-via-powershell, New ActiveSyncAllowedDeviceID Added via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> |This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<potential-dns-tunneling-via-nslookup-history, Version history>>
+|<<new-systemd-service-created-by-previously-unknown-process, New Systemd Service Created by Previously Unknown Process>> |Systemd service files are configuration files in Linux systems used to define and manage system services. Malicious actors can leverage systemd service files to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.6.0 |2
 
-|<<potential-disabling-of-selinux, Potential Disabling of SELinux>> |Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.8.0 |100 <<potential-disabling-of-selinux-history, Version history>>
+|<<new-systemd-timer-created, New Systemd Timer Created>> |Detects the creation of a systemd timer within any of the default systemd timer directories. Systemd timers can be used by an attacker to gain persistence, by scheduling the execution of a command or script. Similarly to cron/at, systemd timers can be set up to execute on boot time, or on a specific point in time, which allows attackers to regain access in case the connection to the infected asset was lost. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.6.0 |3
 
-|<<potential-evasion-via-filter-manager, Potential Evasion via Filter Manager>> |The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.6.0 |102 <<potential-evasion-via-filter-manager-history, Version history>>
+|<<new-or-modified-federation-domain, New or Modified Federation Domain>> |Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<potential-hidden-local-user-account-creation-history, Version history>>
+|<<nping-process-activity, Nping Process Activity>> |Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-invoke-mimikatz-powershell-script, Potential Invoke-Mimikatz PowerShell Script>> |Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell script and alike. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |8.3.0 |102 <<potential-invoke-mimikatz-powershell-script-history, Version history>>
+|<<nullsessionpipe-registry-modification, NullSessionPipe Registry Modification>> |Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-java-jndi-exploitation-attempt, Potential JAVA/JNDI Exploitation Attempt>> |Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard ports followed by a suspicious JAVA child processes. This may indicate an attempt to exploit a JAVA/NDI (Java Naming and Directory Interface) injection vulnerability. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Execution]  |8.1.0 |101 <<potential-java-jndi-exploitation-attempt-history, Version history>>
+|<<o365-email-reported-by-user-as-malware-or-phish, O365 Email Reported by User as Malware or Phish>> |Detects the occurrence of emails reported as Phishing or Malware by Users. Security Awareness training is essential to stay ahead of scammers and threat actors, as security products can be bypassed, and the user can still receive a malicious message. Educating users to report suspicious messages can help identify gaps in security controls and prevent malware infections and Business Email Compromise attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Initial Access] |8.3.0 |102
 
-|<<potential-kerberos-attack-via-bifrost, Potential Kerberos Attack via Bifrost>> |Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access] [Lateral Movement]  |7.12.0 |100 <<potential-kerberos-attack-via-bifrost-history, Version history>>
+|<<o365-excessive-single-sign-on-logon-errors, O365 Excessive Single Sign-On Logon Errors>> |Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |102
 
-|<<potential-lsa-authentication-package-abuse, Potential LSA Authentication Package Abuse>> |Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<potential-lsa-authentication-package-abuse-history, Version history>>
+|<<o365-exchange-suspicious-mailbox-right-delegation, O365 Exchange Suspicious Mailbox Right Delegation>> |Identifies the assignment of rights to access content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target organization while creating inbox rules, so messages can evade spam/phishing detection mechanisms. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
-|<<potential-lsass-clone-creation-via-psscapturesnapshot, Potential LSASS Clone Creation via PssCaptureSnapShot>> |Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Sysmon Only]  |8.0.0 |101 <<potential-lsass-clone-creation-via-psscapturesnapshot-history, Version history>>
+|<<o365-mailbox-audit-logging-bypass, O365 Mailbox Audit Logging Bypass>> |Detects the occurrence of mailbox audit bypass associations. The mailbox audit is responsible for logging specified mailbox events (like accessing a folder or a message or permanently deleting a message). However, actions taken by some authorized accounts, such as accounts used by third-party tools or accounts used for lawful monitoring, can create a large number of mailbox audit log entries and may not be of interest to your organization. Because of this, administrators can create bypass associations, allowing certain accounts to perform their tasks without being logged. Attackers can abuse this allowlist mechanism to conceal actions taken, as the mailbox audit will log no activity done by the account. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Initial Access], [Tactic: Defense Evasion] |8.3.0 |102
 
-|<<potential-lsass-memory-dump-via-psscapturesnapshot, Potential LSASS Memory Dump via PssCaptureSnapShot>> |Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and target two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Sysmon Only]  |8.0.0 |101 <<potential-lsass-memory-dump-via-psscapturesnapshot-history, Version history>>
+|<<okta-brute-force-or-password-spraying-attack, Okta Brute Force or Password Spraying Attack>> |Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |104
 
-|<<potential-lateral-tool-transfer-via-smb-share, Potential Lateral Tool Transfer via SMB Share>> |Identifies the creation or change of a Windows executable file over network shares. Adversaries may transfer tools or other files between systems in a compromised environment. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.11.0 |102 <<potential-lateral-tool-transfer-via-smb-share-history, Version history>>
+|<<okta-threatinsight-threat-suspected-promotion, Okta ThreatInsight Threat Suspected Promotion>> |Okta ThreatInsight is a feature that provides valuable debug data regarding authentication and authorization processes, which is logged in the system. Within this data, there is a specific field called threat_suspected, which represents Okta's internal evaluation of the authentication or authorization workflow. When this field is set to True, it suggests the presence of potential credential access techniques, such as password-spraying, brute-forcing, replay attacks, and other similar threats. |[Use Case: Identity and Access Audit], [Data Source: Okta] |8.3.0 |103
 
-|<<potential-linux-ssh-brute-force-detected, Potential Linux SSH Brute Force Detected>> |Identifies multiple consecutive login failures targeting an user account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Elastic] [Host] [Linux] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<okta-user-session-impersonation, Okta User Session Impersonation>> |A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |104
 
-|<<potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> |Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |8.3.0 |102 <<potential-local-ntlm-relay-via-http-history, Version history>>
+|<<onedrive-malware-file-upload, OneDrive Malware File Upload>> |Identifies the occurence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.3.0 |102
 
-|<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<potential-microsoft-office-sandbox-evasion-history, Version history>>
+|<<outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> |Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |103
 
-|<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.6.0 |102 <<potential-modification-of-accessibility-binaries-history, Version history>>
+|<<parent-process-pid-spoofing, Parent Process PID Spoofing>> |Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<potential-non-standard-port-ssh-connection, Potential Non-Standard Port SSH connection>> |Identifies potentially malicious processes communicating via a port paring typically not associated with SSH. For example, SSH over port 2200 or port 2222 as opposed to the traditional port 22. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data. |[Elastic] [Host] [Linux] [Threat Detection] [Command and Control] [macOS]  |8.6.0 |1
+|<<peripheral-device-discovery, Peripheral Device Discovery>> |Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<potential-openssh-backdoor-logging-activity, Potential OpenSSH Backdoor Logging Activity>> |Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence] [Credential Access]  |7.12.0 |100 <<potential-openssh-backdoor-logging-activity-history, Version history>>
+|<<permission-theft-detected-elastic-endgame, Permission Theft - Detected - Elastic Endgame>> |Elastic Endgame detected Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<potential-password-spraying-of-microsoft-365-user-accounts, Potential Password Spraying of Microsoft 365 User Accounts>> |Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.11.0 |101 <<potential-password-spraying-of-microsoft-365-user-accounts-history, Version history>>
+|<<permission-theft-prevented-elastic-endgame, Permission Theft - Prevented - Elastic Endgame>> |Elastic Endgame prevented Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<potential-persistence-via-atom-init-script-modification, Potential Persistence via Atom Init Script Modification>> |Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<potential-persistence-via-atom-init-script-modification-history, Version history>>
+|<<persistence-via-bits-job-notify-cmdline, Persistence via BITS Job Notify Cmdline>> |An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<potential-persistence-via-login-hook, Potential Persistence via Login Hook>> |Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |101 <<potential-persistence-via-login-hook-history, Version history>>
+|<<persistence-via-directoryservice-plugin-modification, Persistence via DirectoryService Plugin Modification>> |Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<potential-persistence-via-periodic-tasks, Potential Persistence via Periodic Tasks>> |Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<potential-persistence-via-periodic-tasks-history, Version history>>
+|<<persistence-via-docker-shortcut-modification, Persistence via Docker Shortcut Modification>> |An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<potential-persistence-via-time-provider-modification, Potential Persistence via Time Provider Modification>> |Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.12.0 |100 <<potential-persistence-via-time-provider-modification-history, Version history>>
+|<<persistence-via-folder-action-script, Persistence via Folder Action Script>> |Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Persistence] |8.3.0 |103
 
-|<<potential-port-monitor-or-print-processor-registration-abuse, Potential Port Monitor or Print Processor Registration Abuse>> |Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<potential-port-monitor-or-print-processor-registration-abuse-history, Version history>>
+|<<persistence-via-hidden-run-key-detected, Persistence via Hidden Run Key Detected>> |Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<potential-privacy-control-bypass-via-localhost-secure-copy, Potential Privacy Control Bypass via Localhost Secure Copy>> |Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files. |[Elastic] [Host] [macOS] [Threat Detection] [Privilege Escalation] [Defense Evasion]  |7.12.0 |100 <<potential-privacy-control-bypass-via-localhost-secure-copy-history, Version history>>
+|<<persistence-via-kde-autostart-script-or-desktop-file-modification, Persistence via KDE AutoStart Script or Desktop File Modification>> |Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-privacy-control-bypass-via-tccdb-modification, Potential Privacy Control Bypass via TCCDB Modification>> |Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<potential-privacy-control-bypass-via-tccdb-modification-history, Version history>>
+|<<persistence-via-login-or-logout-hook, Persistence via Login or Logout Hook>> |Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<potential-privilege-escalation-via-installerfiletakeover, Potential Privilege Escalation via InstallerFileTakeOver>> |Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |8.0.0 |102 <<potential-privilege-escalation-via-installerfiletakeover-history, Version history>>
+|<<persistence-via-microsoft-office-addins, Persistence via Microsoft Office AddIns>> |Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<potential-privilege-escalation-via-pkexec, Potential Privilege Escalation via PKEXEC>> |Identifies an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user. |[Elastic] [Host] [Linux] [Threat Detection] [Privilege Escalation]  |8.1.0 |100 <<potential-privilege-escalation-via-pkexec-history, Version history>>
+|<<persistence-via-microsoft-outlook-vba, Persistence via Microsoft Outlook VBA>> |Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<potential-privilege-escalation-via-sudoers-file-modification, Potential Privilege Escalation via Sudoers File Modification>> |A sudoers file specifies the commands users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<potential-privilege-escalation-via-sudoers-file-modification-history, Version history>>
+|<<persistence-via-powershell-profile, Persistence via PowerShell profile>> |Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |4
 
-|<<potential-privileged-escalation-via-samaccountname-spoofing, Potential Privileged Escalation via SamAccountName Spoofing>> |Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Privilege Escalation]  |8.1.0 |100 <<potential-privileged-escalation-via-samaccountname-spoofing-history, Version history>>
+|<<persistence-via-scheduled-job-creation, Persistence via Scheduled Job Creation>> |A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<potential-process-herpaderping-attempt, Potential Process Herpaderping Attempt>> |Identifies process execution followed by a file overwrite of an executable by the same parent process. This may indicate an evasion attempt to execute malicious code in a stealthy way. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.11.0 |101 <<potential-process-herpaderping-attempt-history, Version history>>
+|<<persistence-via-telemetrycontroller-scheduled-task-hijack, Persistence via TelemetryController Scheduled Task Hijack>> |Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-process-injection-via-powershell, Potential Process Injection via PowerShell>> |Detects the use of Windows API functions that are commonly abused by malware and security tools to load malicious code or inject it into remote processes. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |8.0.0 |102 <<potential-process-injection-via-powershell-history, Version history>>
+|<<persistence-via-update-orchestrator-service-hijack, Persistence via Update Orchestrator Service Hijack>> |Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Use Case: Vulnerability], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<potential-protocol-tunneling-via-earthworm, Potential Protocol Tunneling via EarthWorm>> |Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems. |[Elastic] [Host] [Linux] [Threat Detection] [Command and Control]  |7.13.0 |100 <<potential-protocol-tunneling-via-earthworm-history, Version history>>
+|<<persistence-via-wmi-event-subscription, Persistence via WMI Event Subscription>> |An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<potential-remote-credential-access-via-registry, Potential Remote Credential Access via Registry>> |Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Credential Access] [Investigation Guide]  |8.2.0 |102 <<potential-remote-credential-access-via-registry-history, Version history>>
+|<<persistence-via-wmi-standard-registry-provider, Persistence via WMI Standard Registry Provider>> |Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<potential-remote-desktop-shadowing-activity, Potential Remote Desktop Shadowing Activity>> |Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.13.0 |100 <<potential-remote-desktop-shadowing-activity-history, Version history>>
+|<<persistent-scripts-in-the-startup-directory, Persistent Scripts in the Startup Directory>> |Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> |Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<potential-remote-desktop-tunneling-detected-history, Version history>>
+|<<port-forwarding-rule-addition, Port Forwarding Rule Addition>> |Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<potential-reverse-shell-activity-via-terminal, Potential Reverse Shell Activity via Terminal>> |Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Execution] [Investigation Guide]  |7.12.0 |102 <<potential-reverse-shell-activity-via-terminal-history, Version history>>
+|<<possible-consent-grant-attack-via-azure-registered-application, Possible Consent Grant Attack via Azure-Registered Application>> |Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide permissions to an application. An adversary may create an Azure-registered application that requests access to data such as contact information, email, or documents. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |106
 
-|<<potential-ssh-brute-force-detected-on-privileged-account, Potential SSH Brute Force Detected on Privileged Account>> |Identifies multiple consecutive login failures targeting a root user account from the same source address and within a short time interval. Adversaries will often brute force login attempts on privileged accounts with a common or known password, in an attempt to gain privileged access to systems. |[Elastic] [Host] [Linux] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<possible-fin7-dga-command-and-control-behavior, Possible FIN7 DGA Command and Control Behavior>> |This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |102
 
-|<<potential-ssh-password-guessing, Potential SSH Password Guessing>> |Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts. |[Elastic] [Host] [Linux] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<possible-okta-dos-attack, Possible Okta DoS Attack>> |Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an organization's business operations by performing a DoS attack against its Okta service. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.3.0 |103
 
-|<<potential-secure-file-deletion-via-sdelete-utility, Potential Secure File Deletion via SDelete Utility>> |Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |101 <<potential-secure-file-deletion-via-sdelete-utility-history, Version history>>
+|<<potential-abuse-of-repeated-mfa-push-notifications, Potential Abuse of Repeated MFA Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |104
 
-|<<potential-shadow-credentials-added-to-ad-object, Potential Shadow Credentials added to AD Object>> |Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control over the object and create a key pair, append to raw public key in the attribute, and obtain persistent and stealthy access to the target user or computer object. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Active Directory]  |8.1.0 |101 <<potential-shadow-credentials-added-to-ad-object-history, Version history>>
+|<<potential-admin-group-account-addition, Potential Admin Group Account Addition>> |Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |103
 
-|<<potential-shadow-file-read-via-command-line-utilities, Potential Shadow File Read via Command Line Utilities>> |Identifies access to the /etc/shadow file via the commandline using standard system utilities. After elevating privileges to root, threat actors may attempt to read or dump this file in order to gain valid credentials. They may utilize these to move laterally undetected and access additional resources. |[Elastic] [Host] [Linux] [Threat Detection] [Privilege Escalation] [Credential Access]  |8.5.0 |2 <<potential-shadow-file-read-via-command-line-utilities-history, Version history>>
+|<<potential-antimalware-scan-interface-bypass-via-powershell, Potential Antimalware Scan Interface Bypass via PowerShell>> |Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |6
 
-|<<potential-sharprdp-behavior, Potential SharpRDP Behavior>> |Identifies potential behavior of SharpRDP, which is a tool that can be used to perform authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for the purposes of lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<potential-sharprdp-behavior-history, Version history>>
+|<<potential-application-shimming-via-sdbinst, Potential Application Shimming via Sdbinst>> |The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<potential-shell-via-web-server, Potential Shell via Web Server>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence] [Investigation Guide]  |7.6.0 |102 <<potential-shell-via-web-server-history, Version history>>
+|<<potential-code-execution-via-postgresql, Potential Code Execution via Postgresql>> |This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks, which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for unauthorized access and malicious actions. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |1
 
-|<<potential-windows-error-manager-masquerading, Potential Windows Error Manager Masquerading>> |Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |100 <<potential-windows-error-manager-masquerading-history, Version history>>
+|<<potential-command-and-control-via-internet-explorer, Potential Command and Control via Internet Explorer>> |Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control] |8.3.0 |103
 
-|<<potential-macos-ssh-brute-force-detected, Potential macOS SSH Brute Force Detected>> |Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.11.0 |101 <<potential-macos-ssh-brute-force-detected-history, Version history>>
+|<<potential-cookies-theft-via-browser-debugging, Potential Cookies Theft via Browser Debugging>> |Identifies the execution of a Chromium based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |102
 
-|<<powershell-kerberos-ticket-request, PowerShell Kerberos Ticket Request>> |Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |8.1.0 |102 <<powershell-kerberos-ticket-request-history, Version history>>
+|<<potential-credential-access-via-dcsync, Potential Credential Access via DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |108
 
-|<<powershell-keylogging-script, PowerShell Keylogging Script>> |Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data. |[Elastic] [Host] [Windows] [Threat Detection] [Collection] [Investigation Guide]  |8.0.0 |102 <<powershell-keylogging-script-history, Version history>>
+|<<potential-credential-access-via-duplicatehandle-in-lsass, Potential Credential Access via DuplicateHandle in LSASS>> |Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.8.0 |206
 
-|<<powershell-minidump-script, PowerShell MiniDump Script>> |This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide]  |7.16.0 |102 <<powershell-minidump-script-history, Version history>>
+|<<potential-credential-access-via-lsass-memory-dump, Potential Credential Access via LSASS Memory Dump>> |Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.8.0 |206
 
-|<<powershell-psreflect-script, PowerShell PSReflect Script>> |Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide]  |8.0.0 |102 <<powershell-psreflect-script-history, Version history>>
+|<<potential-credential-access-via-renamed-com-services-dll, Potential Credential Access via Renamed COM+ Services DLL>> |Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump function that can be used to dump a process memory. This may indicate an attempt to dump LSASS memory while bypassing command-line based detection in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.3.0 |104
 
-|<<powershell-script-block-logging-disabled, PowerShell Script Block Logging Disabled>> |Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |8.1.0 |102 <<powershell-script-block-logging-disabled-history, Version history>>
+|<<potential-credential-access-via-trusted-developer-utility, Potential Credential Access via Trusted Developer Utility>> |An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<powershell-script-with-token-impersonation-capabilities, PowerShell Script with Token Impersonation Capabilities>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |8.5.0 |1
+|<<potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> |Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<powershell-share-enumeration-script, PowerShell Share Enumeration Script>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide]  |8.5.0 |2 <<powershell-share-enumeration-script-history, Version history>>
+|<<potential-cross-site-scripting-xss, Potential Cross Site Scripting (XSS)>> |Cross-Site Scripting (XSS) is a type of attack in which malicious scripts are injected into trusted websites. In XSS attacks, an attacker uses a benign web application to send malicious code, generally in the form of a browser-side script. This detection rule identifies the potential malicious executions of such browser-side scripts. |[Data Source: APM], [Use Case: Threat Detection], [Tactic: Initial Access] |8.3.0 |1
 
-|<<powershell-suspicious-discovery-related-windows-api-functions, PowerShell Suspicious Discovery Related Windows API Functions>> |This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide]  |7.16.0 |102 <<powershell-suspicious-discovery-related-windows-api-functions-history, Version history>>
+|<<potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> |Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> |Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |8.0.0 |102 <<powershell-suspicious-payload-encoded-and-compressed-history, Version history>>
+|<<potential-dll-sideloading-via-trusted-microsoft-programs, Potential DLL SideLoading via Trusted Microsoft Programs>> |Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<powershell-suspicious-script-with-audio-capture-capabilities, PowerShell Suspicious Script with Audio Capture Capabilities>> |Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling. |[Elastic] [Host] [Windows] [Threat Detection] [Collection] [Investigation Guide]  |7.16.0 |102 <<powershell-suspicious-script-with-audio-capture-capabilities-history, Version history>>
+|<<potential-dns-tunneling-via-iodine, Potential DNS Tunneling via Iodine>> |Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<powershell-suspicious-script-with-screenshot-capabilities, PowerShell Suspicious Script with Screenshot Capabilities>> |Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs). |[Elastic] [Host] [Windows] [Threat Detection] [Collection] [Investigation Guide]  |8.0.0 |102 <<powershell-suspicious-script-with-screenshot-capabilities-history, Version history>>
+|<<potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> |This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<privilege-escalation-via-named-pipe-impersonation, Privilege Escalation via Named Pipe Impersonation>> |Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |101 <<privilege-escalation-via-named-pipe-impersonation-history, Version history>>
+|<<potential-defense-evasion-via-proot, Potential Defense Evasion via PRoot>> |Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |2
 
-|<<privilege-escalation-via-rogue-named-pipe-impersonation, Privilege Escalation via Rogue Named Pipe Impersonation>> |Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Sysmon Only]  |8.0.0 |101 <<privilege-escalation-via-rogue-named-pipe-impersonation-history, Version history>>
+|<<potential-disabling-of-selinux, Potential Disabling of SELinux>> |Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<privilege-escalation-via-root-crontab-file-modification, Privilege Escalation via Root Crontab File Modification>> |Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities. |[Elastic] [Host] [macOS] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<privilege-escalation-via-root-crontab-file-modification-history, Version history>>
+|<<potential-evasion-via-filter-manager, Potential Evasion via Filter Manager>> |The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |100 <<privilege-escalation-via-windir-environment-variable-history, Version history>>
+|<<potential-exfiltration-via-certreq, Potential Exfiltration via Certreq>> |Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to exfiltrate data to a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Data Source: Elastic Endgame] |8.3.0 |3
 
-|<<privileged-account-brute-force, Privileged Account Brute Force>> |Identifies multiple consecutive logon failures targeting an Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access]  |8.5.0 |1
+|<<potential-external-linux-ssh-brute-force-detected, Potential External Linux SSH Brute Force Detected>> |Identifies multiple external consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |3
 
-|<<privileges-elevation-via-parent-process-pid-spoofing, Privileges Elevation via Parent Process PID Spoofing>> |Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |8.6.0 |1
+|<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<process-activity-via-compiled-html-file, Process Activity via Compiled HTML File>> |Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.6.0 |102 <<process-activity-via-compiled-html-file-history, Version history>>
+|<<potential-hidden-process-via-mount-hidepid, Potential Hidden Process via Mount Hidepid>> |Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |2
 
-|<<process-created-with-an-elevated-token, Process Created with an Elevated Token>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |8.6.0 |1
+|<<potential-internal-linux-ssh-brute-force-detected, Potential Internal Linux SSH Brute Force Detected>> |Identifies multiple internal consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |7
 
-|<<process-creation-via-secondary-logon, Process Creation via Secondary Logon>> |Identifies process creation with alternate credentials. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |8.5.0 |2 <<process-creation-via-secondary-logon-history, Version history>>
+|<<potential-invoke-mimikatz-powershell-script, Potential Invoke-Mimikatz PowerShell Script>> |Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell script and alike. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |106
 
-|<<process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> |Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |102 <<process-execution-from-an-unusual-directory-history, Version history>>
+|<<potential-java-jndi-exploitation-attempt, Potential JAVA/JNDI Exploitation Attempt>> |Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard ports followed by a suspicious JAVA child processes. This may indicate an attempt to exploit a JAVA/NDI (Java Naming and Directory Interface) injection vulnerability. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<process-injection-detected-elastic-endgame, Process Injection - Detected - Elastic Endgame>> |Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation]  |7.6.0 |100 <<process-injection-detected-elastic-endgame-history, Version history>>
+|<<potential-kerberos-attack-via-bifrost, Potential Kerberos Attack via Bifrost>> |Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Lateral Movement] |8.3.0 |103
 
-|<<process-injection-prevented-elastic-endgame, Process Injection - Prevented - Elastic Endgame>> |Elastic Endgame prevented Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation]  |7.6.0 |100 <<process-injection-prevented-elastic-endgame-history, Version history>>
+|<<potential-lsa-authentication-package-abuse, Potential LSA Authentication Package Abuse>> |Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<process-injection-by-the-microsoft-build-engine, Process Injection by the Microsoft Build Engine>> |An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Sysmon Only]  |7.7.0 |101 <<process-injection-by-the-microsoft-build-engine-history, Version history>>
+|<<potential-lsass-clone-creation-via-psscapturesnapshot, Potential LSASS Clone Creation via PssCaptureSnapShot>> |Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.3.0 |104
 
-|<<process-started-from-process-id-pid-file, Process Started from Process ID (PID) File>> |Identifies a new process starting from a process ID (PID), lock or reboot file within the temporary file storage paradigm (tmpfs) directory /var/run directory. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [BPFDoor]  |8.3.0 |101 <<process-started-from-process-id-pid-file-history, Version history>>
+|<<potential-lsass-memory-dump-via-psscapturesnapshot, Potential LSASS Memory Dump via PssCaptureSnapShot>> |Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and target two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.8.0 |206
 
-|<<process-termination-followed-by-deletion, Process Termination followed by Deletion>> |Identifies a process termination event quickly followed by the deletion of its executable file. Malware tools and other non-native files dropped or created on a system by an adversary may leave traces to indicate to what occurred. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |101 <<process-termination-followed-by-deletion-history, Version history>>
+|<<potential-lateral-tool-transfer-via-smb-share, Potential Lateral Tool Transfer via SMB Share>> |Identifies the creation or change of a Windows executable file over network shares. Adversaries may transfer tools or other files between systems in a compromised environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |101 <<program-files-directory-masquerading-history, Version history>>
+|<<potential-linux-backdoor-user-account-creation, Potential Linux Backdoor User Account Creation>> |Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |2
 
-|<<prompt-for-credentials-with-osascript, Prompt for Credentials with OSASCRIPT>> |Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.11.0 |100 <<prompt-for-credentials-with-osascript-history, Version history>>
+|<<potential-linux-credential-dumping-via-proc-filesystem, Potential Linux Credential Dumping via Proc Filesystem>> |Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Use Case: Vulnerability] |8.3.0 |2
 
-|<<psexec-network-connection, PsExec Network Connection>> |Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide]  |7.6.0 |102 <<psexec-network-connection-history, Version history>>
+|<<potential-linux-credential-dumping-via-unshadow, Potential Linux Credential Dumping via Unshadow>> |Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim. |[Data Source: Elastic Endgame], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |3
 
-|<<rdp-remote-desktop-protocol-from-the-internet, RDP (Remote Desktop Protocol) from the Internet>> |This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Elastic] [Host] [Network] [Threat Detection] [Command and Control] [Host]  |7.6.0 |100 <<rdp-remote-desktop-protocol-from-the-internet-history, Version history>>
+|<<potential-linux-local-account-brute-force-detected, Potential Linux Local Account Brute Force Detected>> |Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |1
 
-|<<rdp-enabled-via-registry, RDP Enabled via Registry>> |Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.11.0 |102 <<rdp-enabled-via-registry-history, Version history>>
+|<<potential-linux-ransomware-note-creation-detected, Potential Linux Ransomware Note Creation Detected>> |This rule identifies a sequence of a mass file encryption event in conjunction with the creation of a .txt file with a file name containing ransomware keywords executed by the same process in a 1 second timespan. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact] |8.3.0 |3
 
-|<<rpc-remote-procedure-call-from-the-internet, RPC (Remote Procedure Call) from the Internet>> |This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Elastic] [Host] [Network] [Threat Detection] [Initial Access] [Host]  |7.6.0 |100 <<rpc-remote-procedure-call-from-the-internet-history, Version history>>
+|<<potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> |Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<rpc-remote-procedure-call-to-the-internet, RPC (Remote Procedure Call) to the Internet>> |This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Elastic] [Host] [Network] [Threat Detection] [Initial Access] [Host]  |7.6.0 |100 <<rpc-remote-procedure-call-to-the-internet-history, Version history>>
+|<<potential-malicious-file-downloaded-from-google-drive, Potential Malicious File Downloaded from Google Drive>> |Identifies potential malicious file download and execution from Google Drive. The rule checks for download activity from Google Drive URL, followed by the creation of files commonly leveraged by or for malware. This could indicate an attempt to run malicious scripts, executables or payloads. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Command and Control] |8.3.0 |1
 
-|<<ransomware-detected-elastic-endgame, Ransomware - Detected - Elastic Endgame>> |Elastic Endgame detected ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame]  |7.6.0 |100 <<ransomware-detected-elastic-endgame-history, Version history>>
+|<<potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> |Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR] |8.3.0 |1
 
-|<<ransomware-prevented-elastic-endgame, Ransomware - Prevented - Elastic Endgame>> |Elastic Endgame prevented ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame]  |7.6.0 |100 <<ransomware-prevented-elastic-endgame-history, Version history>>
+|<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<rare-aws-error-code, Rare AWS Error Code>> |A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. |[Elastic] [Cloud] [AWS] [ML] [Investigation Guide]  |7.9.0 |102 <<rare-aws-error-code-history, Version history>>
+|<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<rare-user-logon, Rare User Logon>> |A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application. |[Elastic] [Authentication] [Threat Detection] [ML] [Initial Access]  |7.14.0 |100 <<rare-user-logon-history, Version history>>
+|<<potential-network-scan-detected, Potential Network Scan Detected>> |This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports. |[Domain: Network], [Tactic: Discovery], [Tactic: Reconnaissance], [Use Case: Network Security Monitoring] |8.3.0 |1
 
-|<<registry-persistence-via-appcert-dll, Registry Persistence via AppCert DLL>> |Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<registry-persistence-via-appcert-dll-history, Version history>>
+|<<potential-network-sweep-detected, Potential Network Sweep Detected>> |This rule identifies a potential network sweep.  A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services. |[Domain: Network], [Tactic: Discovery], [Tactic: Reconnaissance], [Use Case: Network Security Monitoring] |8.3.0 |1
 
-|<<registry-persistence-via-appinit-dll, Registry Persistence via AppInit DLL>> |Attackers may maintain persistence by creating registry keys using AppInit DLLs. AppInit DLLs are loaded by every process using the common library, user32.dll. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<registry-persistence-via-appinit-dll-history, Version history>>
+|<<potential-non-standard-port-http-https-connection, Potential Non-Standard Port HTTP/HTTPS connection>> |Identifies potentially malicious processes communicating via a port paring typically not associated with HTTP/HTTPS. For example, HTTP over port 8443 or port 440 as opposed to the traditional port 80 , 443. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Command and Control], [Rule Type: BBR] |8.3.0 |1
 
-|<<remote-computer-account-dnshostname-update, Remote Computer Account DnsHostName Update>> |Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Active Directory]  |8.3.0 |101 <<remote-computer-account-dnshostname-update-history, Version history>>
+|<<potential-non-standard-port-ssh-connection, Potential Non-Standard Port SSH connection>> |Identifies potentially malicious processes communicating via a port paring typically not associated with SSH. For example, SSH over port 2200 or port 2222 as opposed to the traditional port 22. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [OS: macOS] |8.3.0 |3
 
-|<<remote-desktop-enabled-in-windows-firewall-by-netsh, Remote Desktop Enabled in Windows Firewall by Netsh>> |Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<remote-desktop-enabled-in-windows-firewall-by-netsh-history, Version history>>
+|<<potential-openssh-backdoor-logging-activity, Potential OpenSSH Backdoor Logging Activity>> |Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<remote-execution-via-file-shares, Remote Execution via File Shares>> |Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.11.0 |102 <<remote-execution-via-file-shares-history, Version history>>
+|<<potential-pass-the-hash-pth-attempt, Potential Pass-the-Hash (PtH) Attempt>> |Adversaries may pass the hash using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.4.0 |2
 
-|<<remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> |Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<remote-file-copy-to-a-hidden-share-history, Version history>>
+|<<potential-password-spraying-of-microsoft-365-user-accounts, Potential Password Spraying of Microsoft 365 User Accounts>> |Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |102
 
-|<<remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> |Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<remote-file-copy-via-teamviewer-history, Version history>>
+|<<potential-persistence-through-motd-file-creation-detected, Potential Persistence Through MOTD File Creation Detected>> |Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and "/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the creation of potentially malicious files within the default MOTD file directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.6.0 |3
 
-|<<remote-file-download-via-desktopimgdownldr-utility, Remote File Download via Desktopimgdownldr Utility>> |Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<remote-file-download-via-desktopimgdownldr-utility-history, Version history>>
+|<<potential-persistence-through-run-control-detected, Potential Persistence Through Run Control Detected>> |This rule monitors the creation/alteration of the rc.local file by a previously unknown process executable through the use of the new terms rule type. The /etc/rc.local file is used to start custom applications, services, scripts or commands during start-up. The rc.local file has mostly been replaced by Systemd. However, through the "systemd-rc-local-generator", rc.local files can be converted to services that run at boot. Adversaries may alter rc.local to execute malicious code at start-up, and gain persistence onto the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.6.0 |104
 
-|<<remote-file-download-via-mpcmdrun, Remote File Download via MpCmdRun>> |Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<remote-file-download-via-mpcmdrun-history, Version history>>
+|<<potential-persistence-through-init-d-detected, Potential Persistence Through init.d Detected>> |Files that are placed in the /etc/init.d/ directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the "systemd-sysv-generator" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the /etc/init.d/ directory to execute malicious code upon boot in order to gain persistence on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.6.0 |3
 
-|<<remote-file-download-via-powershell, Remote File Download via PowerShell>> |Identifies powershell.exe being used to download an executable file from an untrusted remote destination. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide]  |7.11.0 |102 <<remote-file-download-via-powershell-history, Version history>>
+|<<potential-persistence-via-atom-init-script-modification, Potential Persistence via Atom Init Script Modification>> |Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<remote-file-download-via-script-interpreter, Remote File Download via Script Interpreter>> |Identifies built-in Windows script interpreters (cscript.exe or wscript.exe) being used to download an executable file from a remote destination. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide]  |7.11.0 |102 <<remote-file-download-via-script-interpreter-history, Version history>>
+|<<potential-persistence-via-login-hook, Potential Persistence via Login Hook>> |Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |104
 
-|<<remote-logon-followed-by-scheduled-task-creation, Remote Logon followed by Scheduled Task Creation>> |Identifies a remote logon followed by a scheduled task creation on the target host. This could be indicative of adversary lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |8.5.0 |1
+|<<potential-persistence-via-periodic-tasks, Potential Persistence via Periodic Tasks>> |Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<remote-ssh-login-enabled-via-systemsetup-command, Remote SSH Login Enabled via systemsetup Command>> |Detects use of the systemsetup command to enable remote SSH Login. |[Elastic] [Host] [macOS] [Threat Detection] [Lateral Movement]  |7.10.0 |100 <<remote-ssh-login-enabled-via-systemsetup-command-history, Version history>>
+|<<potential-persistence-via-time-provider-modification, Potential Persistence via Time Provider Modification>> |Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<remote-scheduled-task-creation, Remote Scheduled Task Creation>> |Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.11.0 |102 <<remote-scheduled-task-creation-history, Version history>>
+|<<potential-port-monitor-or-print-processor-registration-abuse, Potential Port Monitor or Print Processor Registration Abuse>> |Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<remote-system-discovery-commands, Remote System Discovery Commands>> |Discovery of remote system information using built-in commands, which may be used to move laterally. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<remote-system-discovery-commands-history, Version history>>
+|<<potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> |Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs] |8.3.0 |5
 
-|<<remote-windows-service-installed, Remote Windows Service Installed>> |Identifies a network logon followed by Windows service creation with same LogonId. This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Persistence]  |8.6.0 |1
+|<<potential-privacy-control-bypass-via-localhost-secure-copy, Potential Privacy Control Bypass via Localhost Secure Copy>> |Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<remotely-started-services-via-rpc, Remotely Started Services via RPC>> |Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Investigation Guide]  |7.11.0 |102 <<remotely-started-services-via-rpc-history, Version history>>
+|<<potential-privacy-control-bypass-via-tccdb-modification, Potential Privacy Control Bypass via TCCDB Modification>> |Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> |Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<renamed-autoit-scripts-interpreter-history, Version history>>
+|<<potential-privilege-escalation-through-writable-docker-socket, Potential Privilege Escalation through Writable Docker Socket>> |This rule monitors for the usage of Docker runtime sockets to escalate privileges on Linux systems. Docker sockets by default are only be writable by the root user and docker group. Attackers that have permissions to write to these sockets may be able to create and run a container that allows them to escalate privileges and gain further access onto the host file system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Domain: Container] |8.3.0 |1
 
-|<<reverse-shell-created-via-named-pipe, Reverse Shell Created via Named Pipe>> |Identifies a reverse shell via the abuse of named pipes on Linux with the help of OpenSSL or Netcat. First in, first out (FIFO) files are special files for reading and writing to by Linux processes. For this to work, a named pipe is created and passed to a Linux shell where the use of a network connection tool such as Netcat or OpenSSL has been established. The stdout and stderr are captured in the named pipe from the network connection and passed back to the shell for execution. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [Investigation Guide]  |8.6.0 |1
+|<<potential-privilege-escalation-via-installerfiletakeover, Potential Privilege Escalation via InstallerFileTakeOver>> |Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Use Case: Vulnerability] |8.3.0 |106
 
-|<<roshal-archive-rar-or-powershell-file-downloaded-from-the-internet, Roshal Archive (RAR) or PowerShell File Downloaded from the Internet>> |Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. |[Elastic] [Network] [Threat Detection] [Command and Control] [Host]  |7.10.0 |100 <<roshal-archive-rar-or-powershell-file-downloaded-from-the-internet-history, Version history>>
+|<<potential-privilege-escalation-via-pkexec, Potential Privilege Escalation via PKEXEC>> |Identifies an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |104
 
-|<<sip-provider-modification, SIP Provider Modification>> |Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.12.0 |101 <<sip-provider-modification-history, Version history>>
+|<<potential-privilege-escalation-via-sudoers-file-modification, Potential Privilege Escalation via Sudoers File Modification>> |A sudoers file specifies the commands users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<smb-windows-file-sharing-activity-to-the-internet, SMB (Windows File Sharing) Activity to the Internet>> |This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. |[Elastic] [Host] [Network] [Threat Detection] [Initial Access] [Host]  |7.6.0 |100 <<smb-windows-file-sharing-activity-to-the-internet-history, Version history>>
+|<<potential-privileged-escalation-via-samaccountname-spoofing, Potential Privileged Escalation via SamAccountName Spoofing>> |Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Use Case: Vulnerability] |8.3.0 |105
 
-|<<smtp-on-port-26-tcp, SMTP on Port 26/TCP>> |This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. |[Elastic] [Host] [Network] [Threat Detection] [Command and Control] [Host]  |7.6.0 |100 <<smtp-on-port-26-tcp-history, Version history>>
+|<<potential-process-herpaderping-attempt, Potential Process Herpaderping Attempt>> |Identifies process execution followed by a file overwrite of an executable by the same parent process. This may indicate an evasion attempt to execute malicious code in a stealthy way. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
 
-|<<ssh-authorized-keys-file-modification, SSH Authorized Keys File Modification>> |The Secure Shell (SSH) authorized_keys file specifies which users are allowed to log into a server using public key authentication. Adversaries may modify it to maintain persistence on a victim host by adding their own public key(s). |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<ssh-authorized-keys-file-modification-history, Version history>>
+|<<potential-process-injection-via-ld-preload-environment-variable, Potential Process Injection via LD_PRELOAD Environment Variable>> |This rule detects the execution of a process where the LD_PRELOAD environment variable is set. LD_PRELOAD can be used to inject a shared library into a binary at or prior to execution. A threat actor may do this in order to load a malicious shared library for the purposes of persistence, privilege escalation, and defense evasion. This activity is not common and will potentially indicate malicious or suspicious behavior. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Tactic: Privilege Escalation] |8.6.0 |1
 
-|<<sunburst-command-and-control-activity, SUNBURST Command and Control Activity>> |The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor. |[Elastic] [Host] [Windows] [Threat Detection] [Command and Control] [Investigation Guide]  |7.11.0 |102 <<sunburst-command-and-control-activity-history, Version history>>
+|<<potential-process-injection-via-powershell, Potential Process Injection via PowerShell>> |Detects the use of Windows API functions that are commonly abused by malware and security tools to load malicious code or inject it into remote processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |107
 
-|<<scheduled-task-created-by-a-windows-script, Scheduled Task Created by a Windows Script>> |A scheduled task was created by a Windows script via cscript.exe, wscript.exe or powershell.exe. This can be abused by an adversary to establish persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<scheduled-task-created-by-a-windows-script-history, Version history>>
+|<<potential-protocol-tunneling-via-earthworm, Potential Protocol Tunneling via EarthWorm>> |Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<scheduled-task-execution-at-scale-via-gpo, Scheduled Task Execution at Scale via GPO>> |Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the GPO. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Active Directory] [Investigation Guide]  |8.0.0 |102 <<scheduled-task-execution-at-scale-via-gpo-history, Version history>>
+|<<potential-pspy-process-monitoring-detected, Potential Pspy Process Monitoring Detected>> |This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |1
 
-|<<scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> |Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |101 <<scheduled-tasks-at-command-enabled-history, Version history>>
+|<<potential-remote-code-execution-via-web-server, Potential Remote Code Execution via Web Server>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Resources: Investigation Guide] |8.3.0 |3
 
-|<<screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> |Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.16.0 |100 <<screensaver-plist-file-modified-by-unexpected-process-history, Version history>>
+|<<potential-remote-credential-access-via-registry, Potential Remote Credential Access via Registry>> |Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |107
 
-|<<sedebugprivilege-enabled-by-a-suspicious-process, SeDebugPrivilege Enabled by a Suspicious Process>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |8.6.0 |1
+|<<potential-remote-desktop-shadowing-activity, Potential Remote Desktop Shadowing Activity>> |Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<searching-for-saved-credentials-via-vaultcmd, Searching for Saved Credentials via VaultCmd>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Elastic Endgame]  |7.12.0 |102 <<searching-for-saved-credentials-via-vaultcmd-history, Version history>>
+|<<potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> |Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<security-software-discovery-using-wmic, Security Software Discovery using WMIC>> |Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<security-software-discovery-using-wmic-history, Version history>>
+|<<potential-reverse-shell, Potential Reverse Shell>> |This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |2
 
-|<<security-software-discovery-via-grep, Security Software Discovery via Grep>> |Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus or Host Firewall details. |[Elastic] [Host] [macOS] [Linux] [Threat Detection] [Discovery] [Investigation Guide]  |7.12.0 |102 <<security-software-discovery-via-grep-history, Version history>>
+|<<potential-reverse-shell-activity-via-terminal, Potential Reverse Shell Activity via Terminal>> |Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<sensitive-files-compression, Sensitive Files Compression>> |Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations. |[Elastic] [Host] [Linux] [Threat Detection] [Collection] [Credential Access]  |7.12.0 |100 <<sensitive-files-compression-history, Version history>>
+|<<potential-reverse-shell-via-java, Potential Reverse Shell via Java>> |This detection rule identifies the execution of a Linux shell process from a Java JAR application post an incoming network connection. This behavior may indicate reverse shell activity via a Java application. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |2
 
-|<<sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user, Sensitive Privilege SeEnableDelegationPrivilege assigned to a User>> |Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user right" to a user. The SeEnableDelegationPrivilege "user right" enables computer and user accounts to be trusted for delegation. Attackers can abuse this right to compromise Active Directory accounts and elevate their privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Active Directory] [Investigation Guide]  |8.1.0 |102 <<sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user-history, Version history>>
+|<<potential-reverse-shell-via-suspicious-binary, Potential Reverse Shell via Suspicious Binary>> |This detection rule detects the creation of a shell through a chain consisting of the execution of a suspicious binary (located in a commonly abused location or executed manually) followed by a network event and ending with a shell being spawned. Stageless reverse tcp shells display this behaviour. Attackers may spawn reverse shells to establish persistence onto a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |2
 
-|<<service-command-lateral-movement, Service Command Lateral Movement>> |Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.10.0 |101 <<service-command-lateral-movement-history, Version history>>
+|<<potential-reverse-shell-via-suspicious-child-process, Potential Reverse Shell via Suspicious Child Process>> |This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |2
 
-|<<service-control-spawned-via-script-interpreter, Service Control Spawned via Script Interpreter>> |Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.6.0 |100 <<service-control-spawned-via-script-interpreter-history, Version history>>
+|<<potential-reverse-shell-via-suspicious-parent-process, Potential Reverse Shell via Suspicious Parent Process>> |This detection rule detects the creation of a shell through a suspicious parent child relationship. Any reverse shells spawned by the specified utilities that use a forked process to initialize the connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |2
 
-|<<service-creation-via-local-kerberos-authentication, Service Creation via Local Kerberos Authentication>> |Identifies a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, followed by a sevice creation from the same LogonId. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined user to local System privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Credential Access]  |8.3.0 |100 <<service-creation-via-local-kerberos-authentication-history, Version history>>
+|<<potential-ssh-password-guessing, Potential SSH Password Guessing>> |Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |6
 
-|<<setuid-setgid-bit-set-via-chmod, Setuid / Setgid Bit Set via chmod>> |An adversary may add the setuid or setgid bit to a file or directory in order to run a file with the privileges of the owning user or group. An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setuid or setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Privilege Escalation]  |7.8.0 |100 <<setuid-setgid-bit-set-via-chmod-history, Version history>>
+|<<potential-syn-based-network-scan-detected, Potential SYN-Based Network Scan Detected>> |This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port. |[Domain: Network], [Tactic: Discovery], [Tactic: Reconnaissance], [Use Case: Network Security Monitoring] |8.3.0 |1
 
-|<<sharepoint-malware-file-upload, SharePoint Malware File Upload>> |Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities to gain initial access to other endpoints in the environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Lateral Movement]  |8.1.0 |101 <<sharepoint-malware-file-upload-history, Version history>>
+|<<potential-secure-file-deletion-via-sdelete-utility, Potential Secure File Deletion via SDelete Utility>> |Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<shell-execution-via-apple-scripting, Shell Execution via Apple Scripting>> |Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. |[Elastic] [Host] [macOS] [Threat Detection] [Execution]  |7.11.0 |100 <<shell-execution-via-apple-scripting-history, Version history>>
+|<<potential-shadow-credentials-added-to-ad-object, Potential Shadow Credentials added to AD Object>> |Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control over the object and create a key pair, append to raw public key in the attribute, and obtain persistent and stealthy access to the target user or computer object. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |106
 
-|<<signed-proxy-execution-via-ms-work-folders, Signed Proxy Execution via MS Work Folders>> |Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |8.2.0 |102 <<signed-proxy-execution-via-ms-work-folders-history, Version history>>
+|<<potential-shadow-file-read-via-command-line-utilities, Potential Shadow File Read via Command Line Utilities>> |Identifies access to the /etc/shadow file via the commandline using standard system utilities. After elevating privileges to root, threat actors may attempt to read or dump this file in order to gain valid credentials. They may utilize these to move laterally undetected and access additional resources. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.4.0 |105
 
-|<<softwareupdate-preferences-modification, SoftwareUpdate Preferences Modification>> |Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion]  |7.12.0 |100 <<softwareupdate-preferences-modification-history, Version history>>
+|<<potential-sharprdp-behavior, Potential SharpRDP Behavior>> |Identifies potential behavior of SharpRDP, which is a tool that can be used to perform authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for the purposes of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |104
 
-|<<solarwinds-process-disabling-services-via-registry, SolarWinds Process Disabling Services via Registry>> |Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |101 <<solarwinds-process-disabling-services-via-registry-history, Version history>>
+|<<potential-successful-linux-ftp-brute-force-attack-detected, Potential Successful Linux FTP Brute Force Attack Detected>> |An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |1
 
-|<<spike-in-aws-error-messages, Spike in AWS Error Messages>> |A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. |[Elastic] [Cloud] [AWS] [ML] [Investigation Guide]  |7.9.0 |102 <<spike-in-aws-error-messages-history, Version history>>
+|<<potential-successful-linux-rdp-brute-force-attack-detected, Potential Successful Linux RDP Brute Force Attack Detected>> |An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |1
 
-|<<spike-in-failed-logon-events, Spike in Failed Logon Events>> |A machine learning job found an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration or brute force activity and may be a precursor to account takeover or credentialed access. |[Elastic] [Authentication] [Threat Detection] [ML] [Credential Access]  |7.14.0 |100 <<spike-in-failed-logon-events-history, Version history>>
+|<<potential-suspicious-file-edit, Potential Suspicious File Edit>> |This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish persistence, escalate privileges or perform reconnaisance on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |1
 
-|<<spike-in-firewall-denies, Spike in Firewall Denies>> |A machine learning job detected an unusually large spike in network traffic that was denied by network access control lists (ACLs) or firewall rules. Such a burst of denied traffic is usually caused by either 1) a mis-configured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. |[Elastic] [Network] [Threat Detection] [ML]  |7.13.0 |100 <<spike-in-firewall-denies-history, Version history>>
+|<<potential-windows-error-manager-masquerading, Potential Windows Error Manager Masquerading>> |Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<spike-in-logon-events, Spike in Logon Events>> |A machine learning job found an unusually large spike in successful authentication events. This can be due to password spraying, user enumeration or brute force activity. |[Elastic] [Authentication] [Threat Detection] [ML] [Credential Access]  |7.14.0 |100 <<spike-in-logon-events-history, Version history>>
+|<<potential-macos-ssh-brute-force-detected, Potential macOS SSH Brute Force Detected>> |Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |104
 
-|<<spike-in-logon-events-from-a-source-ip, Spike in Logon Events from a Source IP>> |A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity. |[Elastic] [Authentication] [Threat Detection] [ML] [Credential Access]  |7.14.0 |100 <<spike-in-logon-events-from-a-source-ip-history, Version history>>
+|<<powershell-invoke-ninjacopy-script, PowerShell Invoke-NinjaCopy script>> |Detects PowerShell scripts that contain the default exported functions used on Invoke-NinjaCopy. Attackers can use Invoke-NinjaCopy to read SYSTEM files that are normally locked, such as the NTDS.dit file or registry hives. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |4
 
-|<<spike-in-network-traffic, Spike in Network Traffic>> |A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. |[Elastic] [Network] [Threat Detection] [ML]  |7.13.0 |100 <<spike-in-network-traffic-history, Version history>>
+|<<powershell-kerberos-ticket-request, PowerShell Kerberos Ticket Request>> |Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |107
 
-|<<spike-in-network-traffic-to-a-country, Spike in Network Traffic To a Country>> |A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. |[Elastic] [Network] [Threat Detection] [ML]  |7.13.0 |100 <<spike-in-network-traffic-to-a-country-history, Version history>>
+|<<powershell-keylogging-script, PowerShell Keylogging Script>> |Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |108
 
-|<<startup-folder-persistence-via-unsigned-process, Startup Folder Persistence via Unsigned Process>> |Identifies files written or modified in the startup folder by unsigned processes. Adversaries may abuse this technique to maintain persistence in an environment. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.11.0 |102 <<startup-folder-persistence-via-unsigned-process-history, Version history>>
+|<<powershell-mailbox-collection-script, PowerShell Mailbox Collection Script>> |Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |4
 
-|<<startup-persistence-by-a-suspicious-process, Startup Persistence by a Suspicious Process>> |Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.11.0 |102 <<startup-persistence-by-a-suspicious-process-history, Version history>>
+|<<powershell-minidump-script, PowerShell MiniDump Script>> |This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |106
 
-|<<startup-or-run-key-registry-modification, Startup or Run Key Registry Modification>> |Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.11.0 |102 <<startup-or-run-key-registry-modification-history, Version history>>
+|<<powershell-psreflect-script, PowerShell PSReflect Script>> |Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |107
 
-|<<startup-logon-script-added-to-group-policy-object, Startup/Logon Script added to Group Policy Object>> |Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Active Directory] [Investigation Guide]  |8.0.0 |102 <<startup-logon-script-added-to-group-policy-object-history, Version history>>
+|<<powershell-script-block-logging-disabled, PowerShell Script Block Logging Disabled>> |Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<sublime-plugin-or-application-script-modification, Sublime Plugin or Application Script Modification>> |Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<sublime-plugin-or-application-script-modification-history, Version history>>
+|<<powershell-script-with-archive-compression-capabilities, PowerShell Script with Archive Compression Capabilities>> |Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |1
 
-|<<sudo-heap-based-buffer-overflow-attempt, Sudo Heap-Based Buffer Overflow Attempt>> |Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Privilege Escalation]  |7.12.0 |100 <<sudo-heap-based-buffer-overflow-attempt-history, Version history>>
+|<<powershell-script-with-discovery-capabilities, PowerShell Script with Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Discovery], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |1
 
-|<<sudoers-file-modification, Sudoers File Modification>> |A sudoers file specifies the commands that users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Privilege Escalation]  |7.8.0 |100 <<sudoers-file-modification-history, Version history>>
+|<<powershell-script-with-encryption-decryption-capabilities, PowerShell Script with Encryption/Decryption Capabilities>> |Identifies the use of Cmdlets and methods related to encryption/decryption of files in PowerShell scripts, which malware and offensive security tools can abuse to encrypt data or decrypt payloads to bypass security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |5
 
-|<<suspicious-.net-code-compilation, Suspicious .NET Code Compilation>> |Identifies suspicious .NET code execution. connections. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<suspicious-.net-code-compilation-history, Version history>>
+|<<powershell-script-with-log-clear-capabilities, PowerShell Script with Log Clear Capabilities>> |Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |1
 
-|<<suspicious-.net-reflection-via-powershell, Suspicious .NET Reflection via PowerShell>> |Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |8.0.0 |102 <<suspicious-.net-reflection-via-powershell-history, Version history>>
+|<<powershell-script-with-token-impersonation-capabilities, PowerShell Script with Token Impersonation Capabilities>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: PowerShell Logs] |8.3.0 |7
 
-|<<suspicious-activity-reported-by-okta-user, Suspicious Activity Reported by Okta User>> |Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |102 <<suspicious-activity-reported-by-okta-user-history, Version history>>
+|<<powershell-share-enumeration-script, PowerShell Share Enumeration Script>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |6
 
-|<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Elastic] [Host] [macOS] [Threat Detection] [Execution]  |7.12.0 |100 <<suspicious-automator-workflows-execution-history, Version history>>
+|<<powershell-suspicious-discovery-related-windows-api-functions, PowerShell Suspicious Discovery Related Windows API Functions>> |This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |109
 
-|<<suspicious-browser-child-process, Suspicious Browser Child Process>> |Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. |[Elastic] [Host] [macOS] [Threat Detection] [Initial Access] [Execution]  |7.12.0 |100 <<suspicious-browser-child-process-history, Version history>>
+|<<powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> |Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |108
 
-|<<suspicious-calendar-file-modification, Suspicious Calendar File Modification>> |Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<suspicious-calendar-file-modification-history, Version history>>
+|<<powershell-suspicious-script-with-audio-capture-capabilities, PowerShell Suspicious Script with Audio Capture Capabilities>> |Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |107
 
-|<<suspicious-certutil-commands, Suspicious CertUtil Commands>> |Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.6.0 |101 <<suspicious-certutil-commands-history, Version history>>
+|<<powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> |Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |5
 
-|<<suspicious-child-process-of-adobe-acrobat-reader-update-service, Suspicious Child Process of Adobe Acrobat Reader Update Service>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched. |[Elastic] [Host] [macOS] [Threat Detection] [Privilege Escalation] [CVE-2020-9615] [CVE-2020-9614] [CVE-2020-9613]  |7.12.0 |100 <<suspicious-child-process-of-adobe-acrobat-reader-update-service-history, Version history>>
+|<<powershell-suspicious-script-with-screenshot-capabilities, PowerShell Suspicious Script with Screenshot Capabilities>> |Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |106
 
-|<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.11.0 |102 <<suspicious-cmd-execution-via-wmi-history, Version history>>
+|<<privilege-escalation-via-named-pipe-impersonation, Privilege Escalation via Named Pipe Impersonation>> |Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> |Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |8.3.0 |100 <<suspicious-crontab-creation-or-modification-history, Version history>>
+|<<privilege-escalation-via-rogue-named-pipe-impersonation, Privilege Escalation via Rogue Named Pipe Impersonation>> |Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Sysmon Only] |8.3.0 |104
 
-|<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Privilege Escalation] [Investigation Guide]  |7.12.0 |102 <<suspicious-dll-loaded-for-persistence-or-privilege-escalation-history, Version history>>
+|<<privilege-escalation-via-root-crontab-file-modification, Privilege Escalation via Root Crontab File Modification>> |Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |103
 
-|<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.12.0 |100 <<suspicious-emond-child-process-history, Version history>>
+|<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<suspicious-endpoint-security-parent-process-history, Version history>>
+|<<privileged-account-brute-force, Privileged Account Brute Force>> |Identifies multiple consecutive logon failures targeting an Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |7
 
-|<<suspicious-execution-short-program-name, Suspicious Execution - Short Program Name>> |Identifies process execution with a single character process name. This is often done by adversaries while staging or executing temporary utilities. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |102 <<suspicious-execution-short-program-name-history, Version history>>
+|<<privileges-elevation-via-parent-process-pid-spoofing, Privileges Elevation via Parent Process PID Spoofing>> |Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |4
 
-|<<suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> |Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.14.0 |100 <<suspicious-execution-from-a-mounted-device-history, Version history>>
+|<<process-activity-via-compiled-html-file, Process Activity via Compiled HTML File>> |Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<suspicious-execution-via-scheduled-task, Suspicious Execution via Scheduled Task>> |Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<suspicious-execution-via-scheduled-task-history, Version history>>
+|<<process-created-with-an-elevated-token, Process Created with an Elevated Token>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.4.0 |4
 
-|<<suspicious-explorer-child-process, Suspicious Explorer Child Process>> |Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |7.11.0 |101 <<suspicious-explorer-child-process-history, Version history>>
+|<<process-creation-via-secondary-logon, Process Creation via Secondary Logon>> |Identifies process creation with alternate credentials. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |7
 
-|<<suspicious-file-creation-in-etc-for-persistence, Suspicious File Creation in /etc for Persistence>> |Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence for long term access. |[Elastic] [Host] [Linux] [Threat Detection] [Persistence] [Orbit] [Lightning Framework]  |8.4.0 |101 <<suspicious-file-creation-in-etc-for-persistence-history, Version history>>
+|<<process-discovery-via-built-in-applications, Process Discovery via Built-In Applications>> |Identifies the use of built-in tools attackers can use to discover running processes on an endpoint. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |1
 
-|<<suspicious-html-file-creation, Suspicious HTML File Creation>> |Identifies the execution of a browser process to open an HTML file with high entropy and size. Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |8.4.0 |100 <<suspicious-html-file-creation-history, Version history>>
+|<<process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> |Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<suspicious-hidden-child-process-of-launchd, Suspicious Hidden Child Process of Launchd>> |Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence] [Defense Evasion]  |7.12.0 |100 <<suspicious-hidden-child-process-of-launchd-history, Version history>>
+|<<process-injection-detected-elastic-endgame, Process Injection - Detected - Elastic Endgame>> |Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<suspicious-image-load-taskschd.dll-from-ms-office, Suspicious Image Load (taskschd.dll) from MS Office>> |Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<suspicious-image-load-taskschd.dll-from-ms-office-history, Version history>>
+|<<process-injection-prevented-elastic-endgame, Process Injection - Prevented - Elastic Endgame>> |Elastic Endgame prevented Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |101
 
-|<<suspicious-imagepath-service-creation, Suspicious ImagePath Service Creation>> |Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<suspicious-imagepath-service-creation-history, Version history>>
+|<<process-injection-by-the-microsoft-build-engine, Process Injection by the Microsoft Build Engine>> |An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Sysmon Only] |8.3.0 |104
 
-|<<suspicious-java-child-process, Suspicious JAVA Child Process>> |Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a JAVA specific vulnerability. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Execution] [Investigation Guide]  |7.12.0 |102 <<suspicious-java-child-process-history, Version history>>
+|<<process-started-from-process-id-pid-file, Process Started from Process ID (PID) File>> |Identifies a new process starting from a process ID (PID), lock or reboot file within the temporary file storage paradigm (tmpfs) directory /var/run directory. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Threat: BPFDoor], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<suspicious-lsass-access-via-malseclogon, Suspicious LSASS Access via MalSecLogon>> |Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value. This may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Sysmon Only]  |8.4.0 |101 <<suspicious-lsass-access-via-malseclogon-history, Version history>>
+|<<process-termination-followed-by-deletion, Process Termination followed by Deletion>> |Identifies a process termination event quickly followed by the deletion of its executable file. Malware tools and other non-native files dropped or created on a system by an adversary may leave traces to indicate to what occurred. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<suspicious-ms-office-child-process, Suspicious MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access] [Investigation Guide]  |7.6.0 |102 <<suspicious-ms-office-child-process-history, Version history>>
+|<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<suspicious-ms-outlook-child-process, Suspicious MS Outlook Child Process>> |Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access] [Investigation Guide]  |7.6.0 |102 <<suspicious-ms-outlook-child-process-history, Version history>>
+|<<prompt-for-credentials-with-osascript, Prompt for Credentials with OSASCRIPT>> |Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
 
-|<<suspicious-managed-code-hosting-process, Suspicious Managed Code Hosting Process>> |Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |100 <<suspicious-managed-code-hosting-process-history, Version history>>
+|<<psexec-network-connection, PsExec Network Connection>> |Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |8.3.0 |102 <<suspicious-microsoft-diagnostics-wizard-execution-history, Version history>>
+|<<python-script-execution-via-command-line, Python Script Execution via Command Line>> |Identifies when a Python script is executed using command line input and imports the sys module. Attackers often use this method to execute malicious scripts and avoiding writing it to disk. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution] |None |1
 
-|<<suspicious-network-connection-attempt-by-root, Suspicious Network Connection Attempt by Root>> |Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process. |[Elastic] [Host] [Linux] [Threat Detection] [Command and Control]  |8.3.0 |100 <<suspicious-network-connection-attempt-by-root-history, Version history>>
+|<<rdp-remote-desktop-protocol-from-the-internet, RDP (Remote Desktop Protocol) from the Internet>> |This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |101
 
-|<<suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> |Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.7.0 |102 <<suspicious-pdf-reader-child-process-history, Version history>>
+|<<rdp-enabled-via-registry, RDP Enabled via Registry>> |Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<suspicious-portable-executable-encoded-in-powershell-script, Suspicious Portable Executable Encoded in Powershell Script>> |Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide]  |7.16.0 |102 <<suspicious-portable-executable-encoded-in-powershell-script-history, Version history>>
+|<<rpc-remote-procedure-call-from-the-internet, RPC (Remote Procedure Call) from the Internet>> |This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Initial Access], [Domain: Endpoint] |8.3.0 |101
 
-|<<suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> |Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<suspicious-powershell-engine-imageload-history, Version history>>
+|<<rpc-remote-procedure-call-to-the-internet, RPC (Remote Procedure Call) to the Internet>> |This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Initial Access], [Domain: Endpoint] |8.3.0 |101
 
-|<<suspicious-powershell-script, Suspicious Powershell Script>> |A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Execution]  |7.7.0 |101 <<suspicious-powershell-script-history, Version history>>
+|<<ransomware-detected-elastic-endgame, Ransomware - Detected - Elastic Endgame>> |Elastic Endgame detected ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |101
 
-|<<suspicious-print-spooler-file-deletion, Suspicious Print Spooler File Deletion>> |Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.14.0 |100 <<suspicious-print-spooler-file-deletion-history, Version history>>
+|<<ransomware-prevented-elastic-endgame, Ransomware - Prevented - Elastic Endgame>> |Elastic Endgame prevented ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |101
 
-|<<suspicious-print-spooler-point-and-print-dll, Suspicious Print Spooler Point and Print DLL>> |Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |100 <<suspicious-print-spooler-point-and-print-dll-history, Version history>>
+|<<rare-aws-error-code, Rare AWS Error Code>> |A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<suspicious-print-spooler-spl-file-created, Suspicious Print Spooler SPL File Created>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |7.10.0 |102 <<suspicious-print-spooler-spl-file-created-history, Version history>>
+|<<rare-user-logon, Rare User Logon>> |A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access], [Resources: Investigation Guide] |8.3.0 |103
 
-|<<suspicious-printspooler-service-executable-file-creation, Suspicious PrintSpooler Service Executable File Creation>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.10.0 |100 <<suspicious-printspooler-service-executable-file-creation-history, Version history>>
+|<<registry-persistence-via-appcert-dll, Registry Persistence via AppCert DLL>> |Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<suspicious-process-access-via-direct-system-call, Suspicious Process Access via Direct System Call>> |Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Sysmon Only]  |7.16.0 |102 <<suspicious-process-access-via-direct-system-call-history, Version history>>
+|<<registry-persistence-via-appinit-dll, Registry Persistence via AppInit DLL>> |AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<suspicious-process-creation-calltrace, Suspicious Process Creation CallTrace>> |Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Sysmon Only]  |8.0.0 |102 <<suspicious-process-creation-calltrace-history, Version history>>
+|<<remote-computer-account-dnshostname-update, Remote Computer Account DnsHostName Update>> |Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Use Case: Vulnerability] |8.3.0 |106
 
-|<<suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> |Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.10.0 |102 <<suspicious-process-execution-via-renamed-psexec-executable-history, Version history>>
+|<<remote-desktop-enabled-in-windows-firewall-by-netsh, Remote Desktop Enabled in Windows Firewall by Netsh>> |Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<suspicious-rdp-activex-client-loaded, Suspicious RDP ActiveX Client Loaded>> |Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |100 <<suspicious-rdp-activex-client-loaded-history, Version history>>
+|<<remote-execution-via-file-shares, Remote Execution via File Shares>> |Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<suspicious-remote-registry-access-via-sebackupprivilege, Suspicious Remote Registry Access via SeBackupPrivilege>> |Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Credential Access] [Investigation Guide]  |8.2.0 |102 <<suspicious-remote-registry-access-via-sebackupprivilege-history, Version history>>
+|<<remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> |Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<suspicious-script-object-execution, Suspicious Script Object Execution>> |Identifies scrobj.dll loaded into unusual Microsoft processes. This usually means a malicious scriptlet is being executed in the target process. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |100 <<suspicious-script-object-execution-history, Version history>>
+|<<remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> |Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<suspicious-solarwinds-child-process, Suspicious SolarWinds Child Process>> |A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.11.0 |102 <<suspicious-solarwinds-child-process-history, Version history>>
+|<<remote-file-download-via-desktopimgdownldr-utility, Remote File Download via Desktopimgdownldr Utility>> |Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> |Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.13.0 |102 <<suspicious-startup-shell-folder-modification-history, Version history>>
+|<<remote-file-download-via-mpcmdrun, Remote File Download via MpCmdRun>> |Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<suspicious-wmi-image-load-from-ms-office, Suspicious WMI Image Load from MS Office>> |Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.11.0 |101 <<suspicious-wmi-image-load-from-ms-office-history, Version history>>
+|<<remote-file-download-via-powershell, Remote File Download via PowerShell>> |Identifies powershell.exe being used to download an executable file from an untrusted remote destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<suspicious-wmic-xsl-script-execution, Suspicious WMIC XSL Script Execution>> |Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |101 <<suspicious-wmic-xsl-script-execution-history, Version history>>
+|<<remote-file-download-via-script-interpreter, Remote File Download via Script Interpreter>> |Identifies built-in Windows script interpreters (cscript.exe or wscript.exe) being used to download an executable file from a remote destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<suspicious-werfault-child-process, Suspicious WerFault Child Process>> |A suspicious WerFault child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and parent process details as well. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<suspicious-werfault-child-process-history, Version history>>
+|<<remote-logon-followed-by-scheduled-task-creation, Remote Logon followed by Scheduled Task Creation>> |Identifies a remote logon followed by a scheduled task creation on the target host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |6
 
-|<<suspicious-zoom-child-process, Suspicious Zoom Child Process>> |A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<suspicious-zoom-child-process-history, Version history>>
+|<<remote-ssh-login-enabled-via-systemsetup-command, Remote SSH Login Enabled via systemsetup Command>> |Detects use of the systemsetup command to enable remote SSH Login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |103
 
-|<<suspicious-macos-ms-office-child-process, Suspicious macOS MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros. |[Elastic] [Host] [macOS] [Threat Detection] [Initial Access]  |7.12.0 |100 <<suspicious-macos-ms-office-child-process-history, Version history>>
+|<<remote-scheduled-task-creation, Remote Scheduled Task Creation>> |Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<suspicious-service-was-installed-in-the-system, Suspicious service was installed in the system>> |Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |8.6.0 |1
+|<<remote-system-discovery-commands, Remote System Discovery Commands>> |Discovery of remote system information using built-in commands, which may be used to move laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<svchost-spawning-cmd, Svchost spawning Cmd>> |Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Investigation Guide] [Elastic Endgame]  |7.6.0 |102 <<svchost-spawning-cmd-history, Version history>>
+|<<remote-windows-service-installed, Remote Windows Service Installed>> |Identifies a network logon followed by Windows service creation with same LogonId. This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence] |8.3.0 |6
 
-|<<symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> |Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Investigation Guide] [Elastic Endgame]  |8.0.0 |102 <<symbolic-link-to-shadow-copy-created-history, Version history>>
+|<<remotely-started-services-via-rpc, Remotely Started Services via RPC>> |Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide] |8.3.0 |107
 
-|<<system-information-discovery-via-windows-command-shell, System Information Discovery via Windows Command Shell>> |Identifies the execution of discovery commands to enumerate system info or files and folders using the Windows Command Shell. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Execution]  |8.6.0 |1
+|<<renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> |Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<system-log-file-deletion, System Log File Deletion>> |Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system. |[Elastic] [Host] [Linux] [Threat Detection] [Defense Evasion]  |7.11.0 |101 <<system-log-file-deletion-history, Version history>>
+|<<renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> |Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<system-shells-via-services, System Shells via Services>> |Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.6.0 |102 <<system-shells-via-services-history, Version history>>
+|<<roshal-archive-rar-or-powershell-file-downloaded-from-the-internet, Roshal Archive (RAR) or PowerShell File Downloaded from the Internet>> |Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |102
 
-|<<systemkey-access-via-command-line, SystemKey Access via Command Line>> |Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<systemkey-access-via-command-line-history, Version history>>
+|<<sip-provider-modification, SIP Provider Modification>> |Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<tcc-bypass-via-mounted-apfs-snapshot-access, TCC Bypass via Mounted APFS Snapshot Access>> |Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC). |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion] [CVE_2020_9771]  |7.12.0 |100 <<tcc-bypass-via-mounted-apfs-snapshot-access-history, Version history>>
+|<<smb-windows-file-sharing-activity-to-the-internet, SMB (Windows File Sharing) Activity to the Internet>> |This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Initial Access], [Domain: Endpoint] |8.3.0 |101
 
-|<<tampering-of-bash-command-line-history, Tampering of Bash Command-Line History>> |Adversaries may attempt to clear or disable the Bash command-line history in an attempt to evade detection or forensic investigations. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Defense Evasion]  |7.9.0 |100 <<tampering-of-bash-command-line-history-history, Version history>>
+|<<smtp-on-port-26-tcp, SMTP on Port 26/TCP>> |This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |101
 
-|<<temporarily-scheduled-task-creation, Temporarily Scheduled Task Creation>> |Indicates the creation and deletion of a scheduled task within a short time interval. Adversaries can use these to proxy malicious execution via the schedule service and perform clean up. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Persistence]  |8.5.0 |2 <<temporarily-scheduled-task-creation-history, Version history>>
+|<<ssh-authorized-keys-file-modification, SSH Authorized Keys File Modification>> |The Secure Shell (SSH) authorized_keys file specifies which users are allowed to log into a server using public key authentication. Adversaries may modify it to maintain persistence on a victim host by adding their own public key(s). |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence] |8.3.0 |103
 
-|<<third-party-backup-files-deleted-via-unexpected-process, Third-party Backup Files Deleted via Unexpected Process>> |Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide] [Elastic Endgame]  |7.16.0 |102 <<third-party-backup-files-deleted-via-unexpected-process-history, Version history>>
+|<<ssh-authorized-keys-file-modified-inside-a-container, SSH Authorized Keys File Modified Inside a Container>> |This rule detects the creation or modification of an authorized_keys or sshd_config file inside a container. The Secure Shell (SSH) authorized_keys file specifies which users are allowed to log into a server using public key authentication. Adversaries may modify it to maintain persistence on a victim host by adding their own public key(s). Unexpected and unauthorized SSH usage inside a container can be an indicator of compromise and should be investigated. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Lateral Movement] |8.8.0 |2
 
-|<<threat-detected-by-okta-threatinsight, Threat Detected by Okta ThreatInsight>> |Detects when Okta ThreatInsight identifies a request from a malicious IP address. Investigating requests from IP addresses identified as malicious by Okta ThreatInsight can help security teams monitor for and respond to credential based attacks against their organization, such as brute force and password spraying attacks. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring]  |7.9.0 |102 <<threat-detected-by-okta-threatinsight-history, Version history>>
+|<<ssh-connection-established-inside-a-running-container, SSH Connection Established Inside A Running Container>> |This rule detects an incoming SSH connection established inside a running container. Running an ssh daemon inside a container should be avoided and monitored closely if necessary. If an attacker gains valid credentials they can use it to gain initial access or establish persistence within a compromised environment. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement] |8.8.0 |2
 
-|<<threat-intel-filebeat-module-v8.x-indicator-match, Threat Intel Filebeat Module (v8.x) Indicator Match>> |This rule is triggered when indicators from the Threat Intel Filebeat module (v8.x) has a match against local file or network observations. |[Elastic] [Windows] [Elastic Endgame] [Network] [Continuous Monitoring] [SecOps] [Monitoring] [Investigation Guide]  |8.0.0 |102 <<threat-intel-filebeat-module-v8.x-indicator-match-history, Version history>>
+|<<ssh-process-launched-from-inside-a-container, SSH Process Launched From Inside A Container>> |This rule detects an SSH or SSHD process executed from inside a container. This includes both the client ssh binary and server ssh daemon process. SSH usage inside a container should be avoided and monitored closely when necessary. With valid credentials an attacker may move laterally to other containers or to the underlying host through container breakout. They may also use valid SSH credentials as a persistence mechanism. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence] |8.8.0 |2
 
-|<<threat-intel-indicator-match, Threat Intel Indicator Match>> |This rule is triggered when indicators from the Threat Intel integrations have a match against local file or network observations. |[Elastic] [Windows] [Elastic Endgame] [Network] [Continuous Monitoring] [SecOps] [Monitoring] [Investigation Guide]  |8.0.0 |102 <<threat-intel-indicator-match-history, Version history>>
+|<<sunburst-command-and-control-activity, SUNBURST Command and Control Activity>> |The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<timestomping-using-touch-command, Timestomping using Touch Command>> |Timestomping is an anti-forensics technique which is used to modify the timestamps of a file, often to mimic files that are in the same folder. |[Elastic] [Host] [Linux] [macOS] [Threat Detection] [Defense Evasion]  |7.11.0 |100 <<timestomping-using-touch-command-history, Version history>>
+|<<scheduled-task-created-by-a-windows-script, Scheduled Task Created by a Windows Script>> |A scheduled task was created by a Windows script via cscript.exe, wscript.exe or powershell.exe. This can be abused by an adversary to establish persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer, UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer>> |Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |101 <<uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer-history, Version history>>
+|<<scheduled-task-execution-at-scale-via-gpo, Scheduled Task Execution at Scale via GPO>> |Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the GPO. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
 
-|<<uac-bypass-attempt-via-privileged-ifileoperation-com-interface, UAC Bypass Attempt via Privileged IFileOperation COM Interface>> |Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |101 <<uac-bypass-attempt-via-privileged-ifileoperation-com-interface-history, Version history>>
+|<<scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> |Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> |Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |7.11.0 |102 <<uac-bypass-attempt-via-windows-directory-masquerading-history, Version history>>
+|<<screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> |Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface, UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface>> |Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |101 <<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface-history, Version history>>
+|<<sedebugprivilege-enabled-by-a-suspicious-process, SeDebugPrivilege Enabled by a Suspicious Process>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |4
 
-|<<uac-bypass-via-diskcleanup-scheduled-task-hijack, UAC Bypass via DiskCleanup Scheduled Task Hijack>> |Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.10.0 |100 <<uac-bypass-via-diskcleanup-scheduled-task-hijack-history, Version history>>
+|<<searching-for-saved-credentials-via-vaultcmd, Searching for Saved Credentials via VaultCmd>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<uac-bypass-via-icmluautil-elevated-com-interface, UAC Bypass via ICMLuaUtil Elevated COM Interface>> |Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.11.0 |101 <<uac-bypass-via-icmluautil-elevated-com-interface-history, Version history>>
+|<<security-software-discovery-using-wmic, Security Software Discovery using WMIC>> |Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<uac-bypass-via-windows-firewall-snap-in-hijack, UAC Bypass via Windows Firewall Snap-In Hijack>> |Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |7.11.0 |102 <<uac-bypass-via-windows-firewall-snap-in-hijack-history, Version history>>
+|<<security-software-discovery-via-grep, Security Software Discovery via Grep>> |Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus or Host Firewall details. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<unauthorized-access-to-an-okta-application, Unauthorized Access to an Okta Application>> |Identifies unauthorized access attempts to Okta applications. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access]  |7.16.0 |102 <<unauthorized-access-to-an-okta-application-history, Version history>>
+|<<sensitive-files-compression, Sensitive Files Compression>> |Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Credential Access], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<uncommon-registry-persistence-change, Uncommon Registry Persistence Change>> |Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<uncommon-registry-persistence-change-history, Version history>>
+|<<sensitive-files-compression-inside-a-container, Sensitive Files Compression Inside A Container>> |Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Credential Access] |8.8.0 |2
 
-|<<unexpected-child-process-of-macos-screensaver-engine, Unexpected Child Process of macOS Screensaver Engine>> |Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence]  |7.16.0 |100 <<unexpected-child-process-of-macos-screensaver-engine-history, Version history>>
+|<<sensitive-keys-or-passwords-searched-for-inside-a-container, Sensitive Keys Or Passwords Searched For Inside A Container>> |This rule detects the use of system search utilities like grep and find to search for private SSH keys or passwords inside a container. Unauthorized access to these sensitive files could lead to further compromise of the container environment or facilitate a container breakout to the underlying host machine. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.8.0 |2
 
-|<<unusual-aws-command-for-a-user, Unusual AWS Command for a User>> |A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. |[Elastic] [Cloud] [AWS] [ML] [Investigation Guide]  |7.9.0 |102 <<unusual-aws-command-for-a-user-history, Version history>>
+|<<sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user, Sensitive Privilege SeEnableDelegationPrivilege assigned to a User>> |Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user right" to a user. The SeEnableDelegationPrivilege "user right" enables computer and user accounts to be trusted for delegation. Attackers can abuse this right to compromise Active Directory accounts and elevate their privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
 
-|<<unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> |Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.10.0 |102 <<unusual-child-process-from-a-system-virtual-process-history, Version history>>
+|<<service-command-lateral-movement, Service Command Lateral Movement>> |Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |104
 
-|<<unusual-child-process-of-dns.exe, Unusual Child Process of dns.exe>> |Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access] [Investigation Guide]  |7.10.0 |102 <<unusual-child-process-of-dns.exe-history, Version history>>
+|<<service-control-spawned-via-script-interpreter, Service Control Spawned via Script Interpreter>> |Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<unusual-child-processes-of-rundll32, Unusual Child Processes of RunDLL32>> |Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |101 <<unusual-child-processes-of-rundll32-history, Version history>>
+|<<service-creation-via-local-kerberos-authentication, Service Creation via Local Kerberos Authentication>> |Identifies a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, followed by a sevice creation from the same LogonId. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined user to local System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |105
 
-|<<unusual-city-for-an-aws-command, Unusual City For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Elastic] [Cloud] [AWS] [ML] [Investigation Guide]  |7.9.0 |102 <<unusual-city-for-an-aws-command-history, Version history>>
+|<<setuid-setgid-bit-set-via-chmod, Setuid / Setgid Bit Set via chmod>> |An adversary may add the setuid or setgid bit to a file or directory in order to run a file with the privileges of the owning user or group. An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setuid or setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<unusual-country-for-an-aws-command, Unusual Country For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Elastic] [Cloud] [AWS] [ML] [Investigation Guide]  |7.9.0 |102 <<unusual-country-for-an-aws-command-history, Version history>>
+|<<sharepoint-malware-file-upload, SharePoint Malware File Upload>> |Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.3.0 |102
 
-|<<unusual-dns-activity, Unusual DNS Activity>> |A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication. |[Elastic] [Network] [Threat Detection] [ML] [Command and Control]  |7.7.0 |100 <<unusual-dns-activity-history, Version history>>
+|<<shared-object-created-or-changed-by-previously-unknown-process, Shared Object Created or Changed by Previously Unknown Process>> |This rule monitors the creation of shared object files by previously unknown processes. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime. While this process is typically used for legitimate purposes, malicious actors can leverage shared object files to execute unauthorized code, inject malicious functionality into legitimate processes, or bypass security controls. This allows malware to persist on the system, evade detection, and potentially compromise the integrity and confidentiality of the affected system and its data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.6.0 |1
 
-|<<unusual-executable-file-creation-by-a-system-critical-process, Unusual Executable File Creation by a System Critical Process>> |Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.10.0 |102 <<unusual-executable-file-creation-by-a-system-critical-process-history, Version history>>
+|<<shell-execution-via-apple-scripting, Shell Execution via Apple Scripting>> |Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |103
 
-|<<unusual-file-creation-alternate-data-stream, Unusual File Creation - Alternate Data Stream>> |Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |7.12.0 |102 <<unusual-file-creation-alternate-data-stream-history, Version history>>
+|<<signed-proxy-execution-via-ms-work-folders, Signed Proxy Execution via MS Work Folders>> |Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<unusual-file-modification-by-dns.exe, Unusual File Modification by dns.exe>> |Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |7.10.0 |101 <<unusual-file-modification-by-dns.exe-history, Version history>>
+|<<softwareupdate-preferences-modification, SoftwareUpdate Preferences Modification>> |Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<unusual-hour-for-a-user-to-logon, Unusual Hour for a User to Logon>> |A machine learning job detected a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. In addition, unauthorized user activity often takes place during non-business hours. |[Elastic] [Authentication] [Threat Detection] [ML] [Initial Access]  |7.14.0 |100 <<unusual-hour-for-a-user-to-logon-history, Version history>>
+|<<solarwinds-process-disabling-services-via-registry, SolarWinds Process Disabling Services via Registry>> |Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<unusual-linux-network-activity, Unusual Linux Network Activity>> |Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.7.0 |100 <<unusual-linux-network-activity-history, Version history>>
+|<<spike-in-aws-error-messages, Spike in AWS Error Messages>> |A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<unusual-linux-network-connection-discovery, Unusual Linux Network Connection Discovery>> |Looks for commands related to system network connection discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network connection discovery in order to increase their understanding of connected services and systems. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.10.0 |100 <<unusual-linux-network-connection-discovery-history, Version history>>
+|<<spike-in-failed-logon-events, Spike in Failed Logon Events>> |A machine learning job found an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration or brute force activity and may be a precursor to account takeover or credentialed access. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |103
 
-|<<unusual-linux-network-port-activity, Unusual Linux Network Port Activity>> |Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.7.0 |100 <<unusual-linux-network-port-activity-history, Version history>>
+|<<spike-in-firewall-denies, Spike in Firewall Denies>> |A machine learning job detected an unusually large spike in network traffic that was denied by network access control lists (ACLs) or firewall rules. Such a burst of denied traffic is usually caused by either 1) a mis-configured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
 
-|<<unusual-linux-process-calling-the-metadata-service, Unusual Linux Process Calling the Metadata Service>> |Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Elastic] [Host] [Linux] [Threat Detection] [ML] [Credential Access]  |7.10.0 |100 <<unusual-linux-process-calling-the-metadata-service-history, Version history>>
+|<<spike-in-logon-events, Spike in Logon Events>> |A machine learning job found an unusually large spike in successful authentication events. This can be due to password spraying, user enumeration or brute force activity. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access] |8.3.0 |102
 
-|<<unusual-linux-process-discovery-activity, Unusual Linux Process Discovery Activity>> |Looks for commands related to system process discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system process discovery in order to increase their understanding of software applications running on a target host or network. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.10.0 |100 <<unusual-linux-process-discovery-activity-history, Version history>>
+|<<spike-in-network-traffic, Spike in Network Traffic>> |A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
 
-|<<unusual-linux-system-information-discovery-activity, Unusual Linux System Information Discovery Activity>> |Looks for commands related to system information discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system information discovery in order to gather detailed information about system configuration and software versions. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.10.0 |100 <<unusual-linux-system-information-discovery-activity-history, Version history>>
+|<<spike-in-network-traffic-to-a-country, Spike in Network Traffic To a Country>> |A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country that does not normally appear in network traffic or business workflows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |103
 
-|<<unusual-linux-system-network-configuration-discovery, Unusual Linux System Network Configuration Discovery>> |Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.10.0 |100 <<unusual-linux-system-network-configuration-discovery-history, Version history>>
+|<<spike-in-successful-logon-events-from-a-source-ip, Spike in Successful Logon Events from a Source IP>> |A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |103
 
-|<<unusual-linux-system-owner-or-user-discovery-activity, Unusual Linux System Owner or User Discovery Activity>> |Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery in order to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping or privilege elevation activity. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.10.0 |100 <<unusual-linux-system-owner-or-user-discovery-activity-history, Version history>>
+|<<startup-folder-persistence-via-unsigned-process, Startup Folder Persistence via Unsigned Process>> |Identifies files written or modified in the startup folder by unsigned processes. Adversaries may abuse this technique to maintain persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |106
 
-|<<unusual-linux-user-calling-the-metadata-service, Unusual Linux User Calling the Metadata Service>> |Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Elastic] [Host] [Linux] [Threat Detection] [ML] [Credential Access]  |7.10.0 |100 <<unusual-linux-user-calling-the-metadata-service-history, Version history>>
+|<<startup-persistence-by-a-suspicious-process, Startup Persistence by a Suspicious Process>> |Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<unusual-linux-username, Unusual Linux Username>> |A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. |[Elastic] [Host] [Linux] [Threat Detection] [ML] [Initial Access]  |7.7.0 |100 <<unusual-linux-username-history, Version history>>
+|<<startup-or-run-key-registry-modification, Startup or Run Key Registry Modification>> |Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<unusual-login-activity, Unusual Login Activity>> |Identifies an unusually high number of authentication attempts. |[Elastic] [Authentication] [Threat Detection] [ML] [Credential Access]  |7.7.0 |100 <<unusual-login-activity-history, Version history>>
+|<<startup-logon-script-added-to-group-policy-object, Startup/Logon Script added to Group Policy Object>> |Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
 
-|<<unusual-network-activity-from-a-windows-system-binary, Unusual Network Activity from a Windows System Binary>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.10.0 |101 <<unusual-network-activity-from-a-windows-system-binary-history, Version history>>
+|<<sublime-plugin-or-application-script-modification, Sublime Plugin or Application Script Modification>> |Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<unusual-network-connection-via-dllhost, Unusual Network Connection via DllHost>> |Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.14.0 |101 <<unusual-network-connection-via-dllhost-history, Version history>>
+|<<sudo-heap-based-buffer-overflow-attempt, Sudo Heap-Based Buffer Overflow Attempt>> |Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability] |8.3.0 |102
 
-|<<unusual-network-connection-via-rundll32, Unusual Network Connection via RunDLL32>> |Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |7.6.0 |102 <<unusual-network-connection-via-rundll32-history, Version history>>
+|<<sudoers-file-modification, Sudoers File Modification>> |A sudoers file specifies the commands that users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<unusual-network-destination-domain-name, Unusual Network Destination Domain Name>> |A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication. |[Elastic] [Network] [Threat Detection] [ML]  |7.7.0 |100 <<unusual-network-destination-domain-name-history, Version history>>
+|<<suspicious-net-code-compilation, Suspicious .NET Code Compilation>> |Identifies suspicious .NET code execution. connections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<unusual-parent-process-for-cmd.exe, Unusual Parent Process for cmd.exe>> |Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process. |[Elastic] [Host] [Windows] [Threat Detection] [Execution] [Elastic Endgame]  |7.10.0 |102 <<unusual-parent-process-for-cmd.exe-history, Version history>>
+|<<suspicious-net-reflection-via-powershell, Suspicious .NET Reflection via PowerShell>> |Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |108
 
-|<<unusual-parent-child-relationship, Unusual Parent-Child Relationship>> |Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Investigation Guide]  |7.6.0 |102 <<unusual-parent-child-relationship-history, Version history>>
+|<<suspicious-activity-reported-by-okta-user, Suspicious Activity Reported by Okta User>> |Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access] |8.3.0 |103
 
-|<<unusual-persistence-via-services-registry, Unusual Persistence via Services Registry>> |Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence]  |7.11.0 |100 <<unusual-persistence-via-services-registry-history, Version history>>
+|<<suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> |Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |5
 
-|<<unusual-print-spooler-child-process, Unusual Print Spooler Child Process>> |Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |7.14.0 |100 <<unusual-print-spooler-child-process-history, Version history>>
+|<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution] |8.3.0 |103
 
-|<<unusual-process-execution-path-alternate-data-stream, Unusual Process Execution Path - Alternate Data Stream>> |Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Elastic Endgame]  |7.11.0 |101 <<unusual-process-execution-path-alternate-data-stream-history, Version history>>
+|<<suspicious-browser-child-process, Suspicious Browser Child Process>> |Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution] |8.3.0 |103
 
-|<<unusual-process-for-a-linux-host, Unusual Process For a Linux Host>> |Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. |[Elastic] [Host] [Linux] [Threat Detection] [ML] [Persistence]  |7.7.0 |100 <<unusual-process-for-a-linux-host-history, Version history>>
+|<<suspicious-calendar-file-modification, Suspicious Calendar File Modification>> |Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<unusual-process-for-a-windows-host, Unusual Process For a Windows Host>> |Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Persistence] [Investigation Guide]  |7.7.0 |102 <<unusual-process-for-a-windows-host-history, Version history>>
+|<<suspicious-certutil-commands, Suspicious CertUtil Commands>> |Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<unusual-process-network-connection, Unusual Process Network Connection>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |7.6.0 |102 <<unusual-process-network-connection-history, Version history>>
+|<<suspicious-child-process-of-adobe-acrobat-reader-update-service, Suspicious Child Process of Adobe Acrobat Reader Update Service>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<unusual-service-host-child-process-childless-service, Unusual Service Host Child Process - Childless Service>> |Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Privilege Escalation]  |7.11.0 |101 <<unusual-service-host-child-process-childless-service-history, Version history>>
+|<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<unusual-source-ip-for-a-user-to-logon-from, Unusual Source IP for a User to Logon from>> |A machine learning job detected a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts. |[Elastic] [Authentication] [Threat Detection] [ML] [Initial Access]  |7.14.0 |100 <<unusual-source-ip-for-a-user-to-logon-from-history, Version history>>
+|<<suspicious-content-extracted-or-decompressed-via-funzip, Suspicious Content Extracted or Decompressed via Funzip>> |Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |1
 
-|<<unusual-sudo-activity, Unusual Sudo Activity>> |Looks for sudo activity from an unusual user context. An unusual sudo user could be due to troubleshooting activity or it could be a sign of credentialed access via compromised accounts. |[Elastic] [Host] [Linux] [Threat Detection] [ML]  |7.10.0 |100 <<unusual-sudo-activity-history, Version history>>
+|<<suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> |Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<unusual-web-request, Unusual Web Request>> |A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic. |[Elastic] [Network] [Threat Detection] [ML] [Command and Control]  |7.7.0 |100 <<unusual-web-request-history, Version history>>
+|<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<unusual-web-user-agent, Unusual Web User Agent>> |A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity. |[Elastic] [Network] [Threat Detection] [ML] [Command and Control]  |7.7.0 |100 <<unusual-web-user-agent-history, Version history>>
+|<<suspicious-data-encryption-via-openssl-utility, Suspicious Data Encryption via OpenSSL Utility>> |Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact] |8.3.0 |1
 
-|<<unusual-windows-network-activity, Unusual Windows Network Activity>> |Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. |[Elastic] [Host] [Windows] [Threat Detection] [ML]  |7.7.0 |100 <<unusual-windows-network-activity-history, Version history>>
+|<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<unusual-windows-path-activity, Unusual Windows Path Activity>> |Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Persistence]  |7.7.0 |100 <<unusual-windows-path-activity-history, Version history>>
+|<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<unusual-windows-process-calling-the-metadata-service, Unusual Windows Process Calling the Metadata Service>> |Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Credential Access]  |7.10.0 |100 <<unusual-windows-process-calling-the-metadata-service-history, Version history>>
+|<<suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> |Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<unusual-windows-remote-user, Unusual Windows Remote User>> |A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Initial Access]  |7.7.0 |100 <<unusual-windows-remote-user-history, Version history>>
+|<<suspicious-execution-via-microsoft-office-add-ins, Suspicious Execution via Microsoft Office Add-Ins>> |Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |2
 
-|<<unusual-windows-service, Unusual Windows Service>> |A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Persistence]  |7.7.0 |100 <<unusual-windows-service-history, Version history>>
+|<<suspicious-execution-via-scheduled-task, Suspicious Execution via Scheduled Task>> |Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
 
-|<<unusual-windows-user-calling-the-metadata-service, Unusual Windows User Calling the Metadata Service>> |Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Credential Access]  |7.10.0 |100 <<unusual-windows-user-calling-the-metadata-service-history, Version history>>
+|<<suspicious-execution-via-windows-subsystem-for-linux, Suspicious Execution via Windows Subsystem for Linux>> |Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |3
 
-|<<unusual-windows-user-privilege-elevation-activity, Unusual Windows User Privilege Elevation Activity>> |A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Privilege Escalation]  |7.7.0 |100 <<unusual-windows-user-privilege-elevation-activity-history, Version history>>
+|<<suspicious-explorer-child-process, Suspicious Explorer Child Process>> |Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame] |8.3.0 |104
 
-|<<unusual-windows-username, Unusual Windows Username>> |A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. |[Elastic] [Host] [Windows] [Threat Detection] [ML] [Initial Access]  |7.7.0 |100 <<unusual-windows-username-history, Version history>>
+|<<suspicious-file-changes-activity-detected, Suspicious File Changes Activity Detected>> |This rule identifies a sequence of 100 file extension rename events within a set of common file paths by the same process in a timespan of 1 second. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact] |8.3.0 |3
 
-|<<user-account-creation, User Account Creation>> |Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.6.0 |102 <<user-account-creation-history, Version history>>
+|<<suspicious-file-creation-in-etc-for-persistence, Suspicious File Creation in /etc for Persistence>> |Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence mechanisms for long term access. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Orbit], [Threat: Lightning Framework], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<user-added-as-owner-for-azure-application, User Added as Owner for Azure Application>> |Identifies when a user is added as an owner for an Azure application. An adversary may add a user account as an owner for an Azure application in order to grant additional permissions and modify the application's configuration using another account. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |101 <<user-added-as-owner-for-azure-application-history, Version history>>
+|<<suspicious-html-file-creation, Suspicious HTML File Creation>> |Identifies the execution of a browser process to open an HTML file with high entropy and size. Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access] |8.3.0 |103
 
-|<<user-added-as-owner-for-azure-service-principal, User Added as Owner for Azure Service Principal>> |Identifies when a user is added as an owner for an Azure service principal. The service principal object defines what the application can do in the specific tenant, who can access the application, and what resources the app can access. A service principal object is created when an application is given permission to access resources in a tenant. An adversary may add a user account as an owner for a service principal and use that account in order to define what an application can do in the Azure AD tenant. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |101 <<user-added-as-owner-for-azure-service-principal-history, Version history>>
+|<<suspicious-hidden-child-process-of-launchd, Suspicious Hidden Child Process of Launchd>> |Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<user-added-to-privileged-group, User Added to Privileged Group>> |Identifies a user being added to a privileged group in Active Directory. Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.12.0 |102 <<user-added-to-privileged-group-history, Version history>>
+|<<suspicious-image-load-taskschd-dll-from-ms-office, Suspicious Image Load (taskschd.dll) from MS Office>> |Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<user-account-exposed-to-kerberoasting, User account exposed to Kerberoasting>> |Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Active Directory] [Investigation Guide]  |8.2.0 |102 <<user-account-exposed-to-kerberoasting-history, Version history>>
+|<<suspicious-imagepath-service-creation, Suspicious ImagePath Service Creation>> |Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
 
-|<<vnc-virtual-network-computing-from-the-internet, VNC (Virtual Network Computing) from the Internet>> |This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Elastic] [Host] [Network] [Threat Detection] [Command and Control] [Host]  |7.6.0 |100 <<vnc-virtual-network-computing-from-the-internet-history, Version history>>
+|<<suspicious-inter-process-communication-via-outlook, Suspicious Inter-Process Communication via Outlook>> |Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection] |8.4.0 |3
 
-|<<vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> |This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Elastic] [Host] [Network] [Threat Detection] [Command and Control] [Host]  |7.6.0 |100 <<vnc-virtual-network-computing-to-the-internet-history, Version history>>
+|<<suspicious-interactive-shell-spawned-from-inside-a-container, Suspicious Interactive Shell Spawned From Inside A Container>> |This rule detects when an interactive shell is spawned inside a running container. This could indicate a potential container breakout attempt or an attacker's attempt to gain unauthorized access to the underlying host. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
-|<<virtual-machine-fingerprinting, Virtual Machine Fingerprinting>> |An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. |[Elastic] [Host] [Linux] [Threat Detection] [Discovery]  |7.8.0 |100 <<virtual-machine-fingerprinting-history, Version history>>
+|<<suspicious-java-child-process, Suspicious JAVA Child Process>> |Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a JAVA specific vulnerability. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Use Case: Vulnerability] |8.3.0 |104
 
-|<<virtual-machine-fingerprinting-via-grep, Virtual Machine Fingerprinting via Grep>> |An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. |[Elastic] [Host] [macOS] [Linux] [Threat Detection] [Discovery]  |7.16.0 |100 <<virtual-machine-fingerprinting-via-grep-history, Version history>>
+|<<suspicious-lsass-access-via-malseclogon, Suspicious LSASS Access via MalSecLogon>> |Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value. This may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.8.0 |206
 
-|<<virtual-private-network-connection-attempt, Virtual Private Network Connection Attempt>> |Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network. |[Elastic] [Host] [macOS] [Threat Detection] [Lateral Movement]  |7.12.0 |100 <<virtual-private-network-connection-attempt-history, Version history>>
+|<<suspicious-lsass-process-access, Suspicious Lsass Process Access>> |Identifies access attempts to LSASS handle, this may indicate an attempt to dump credentials from Lsass memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon Only] |8.8.0 |105
 
-|<<volume-shadow-copy-deleted-or-resized-via-vssadmin, Volume Shadow Copy Deleted or Resized via VssAdmin>> |Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide]  |7.6.0 |102 <<volume-shadow-copy-deleted-or-resized-via-vssadmin-history, Version history>>
+|<<suspicious-ms-office-child-process, Suspicious MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<volume-shadow-copy-deletion-via-powershell, Volume Shadow Copy Deletion via PowerShell>> |Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide]  |7.16.0 |102 <<volume-shadow-copy-deletion-via-powershell-history, Version history>>
+|<<suspicious-ms-outlook-child-process, Suspicious MS Outlook Child Process>> |Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<volume-shadow-copy-deletion-via-wmic, Volume Shadow Copy Deletion via WMIC>> |Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Elastic] [Host] [Windows] [Threat Detection] [Impact] [Investigation Guide]  |7.6.0 |102 <<volume-shadow-copy-deletion-via-wmic-history, Version history>>
+|<<suspicious-managed-code-hosting-process, Suspicious Managed Code Hosting Process>> |Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
 
-|<<wmi-incoming-lateral-movement, WMI Incoming Lateral Movement>> |Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement]  |7.11.0 |101 <<wmi-incoming-lateral-movement-history, Version history>>
+|<<suspicious-microsoft-365-mail-access-by-clientappid, Suspicious Microsoft 365 Mail Access by ClientAppId>> |Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was observed for the fist time during the last 10 days. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.6.0 |1
 
-|<<web-application-suspicious-activity-post-request-declined, Web Application Suspicious Activity: POST Request Declined>> |A POST request to a web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed. |[Elastic] [APM]  |7.6.0 |100 <<web-application-suspicious-activity-post-request-declined-history, Version history>>
+|<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<web-application-suspicious-activity-unauthorized-method, Web Application Suspicious Activity: Unauthorized Method>> |A request to a web application returned a 405 response, which indicates the web application declined to process the request because the HTTP method is not allowed for the resource. |[Elastic] [APM]  |7.6.0 |100 <<web-application-suspicious-activity-unauthorized-method-history, Version history>>
+|<<suspicious-mining-process-creation-event, Suspicious Mining Process Creation Event>> |Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |2
 
-|<<web-application-suspicious-activity-sqlmap-user-agent, Web Application Suspicious Activity: sqlmap User Agent>> |This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities. |[Elastic] [APM]  |7.6.0 |100 <<web-application-suspicious-activity-sqlmap-user-agent-history, Version history>>
+|<<suspicious-modprobe-file-event, Suspicious Modprobe File Event>> |Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |1
 
-|<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Investigation Guide]  |7.15.0 |102 <<web-shell-detection-script-process-child-of-common-web-processes-history, Version history>>
+|<<suspicious-module-loaded-by-lsass, Suspicious Module Loaded by LSASS>> |Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |3
 
-|<<webproxy-settings-modification, WebProxy Settings Modification>> |Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access]  |7.12.0 |100 <<webproxy-settings-modification-history, Version history>>
+|<<suspicious-network-activity-to-the-internet-by-previously-unknown-executable, Suspicious Network Activity to the Internet by Previously Unknown Executable>> |This rule monitors for network connectivity to the internet from a previously unknown executable located in a suspicious directory to a previously unknown destination ip. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to establish connections to unknown or suspicious destinations such as a command and control server. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame] |8.6.0 |1
 
-|<<webserver-access-logs-deleted, WebServer Access Logs Deleted>> |Identifies the deletion of WebServer access logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system. |[Elastic] [Host] [Linux] [Windows] [macOS] [Threat Detection] [Defense Evasion]  |7.11.0 |100 <<webserver-access-logs-deleted-history, Version history>>
+|<<suspicious-network-connection-attempt-by-root, Suspicious Network Connection Attempt by Root>> |Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control] |8.3.0 |104
 
-|<<whoami-process-activity, Whoami Process Activity>> |Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.6.0 |102 <<whoami-process-activity-history, Version history>>
+|<<suspicious-network-tool-launched-inside-a-container, Suspicious Network Tool Launched Inside A Container>> |This rule detects commonly abused network utilities running inside a container. Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation, and should be monitored closely within a container. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Command and Control], [Tactic: Reconnaissance] |8.8.0 |2
 
-|<<windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball, Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)>> |A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion]  |7.7.0 |100 <<windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball-history, Version history>>
+|<<suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> |Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
 
-|<<windows-defender-disabled-via-registry-modification, Windows Defender Disabled via Registry Modification>> |Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.12.0 |102 <<windows-defender-disabled-via-registry-modification-history, Version history>>
+|<<suspicious-portable-executable-encoded-in-powershell-script, Suspicious Portable Executable Encoded in Powershell Script>> |Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |107
 
-|<<windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> |Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |7.14.0 |102 <<windows-defender-exclusions-added-via-powershell-history, Version history>>
+|<<suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> |Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |107
 
-|<<windows-event-logs-cleared, Windows Event Logs Cleared>> |Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide]  |7.12.0 |102 <<windows-event-logs-cleared-history, Version history>>
+|<<suspicious-powershell-script, Suspicious Powershell Script>> |A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Execution] |8.3.0 |103
 
-|<<windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> |Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [Investigation Guide] [Elastic Endgame]  |8.0.0 |102 <<windows-firewall-disabled-via-powershell-history, Version history>>
+|<<suspicious-print-spooler-file-deletion, Suspicious Print Spooler File Deletion>> |Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<windows-network-enumeration, Windows Network Enumeration>> |Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] [Investigation Guide] [Elastic Endgame]  |7.11.0 |102 <<windows-network-enumeration-history, Version history>>
+|<<suspicious-print-spooler-point-and-print-dll, Suspicious Print Spooler Point and Print DLL>> |Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<windows-registry-file-creation-in-smb-share, Windows Registry File Creation in SMB Share>> |Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system. |[Elastic] [Host] [Windows] [Threat Detection] [Lateral Movement] [Credential Access] [Investigation Guide]  |8.2.0 |102 <<windows-registry-file-creation-in-smb-share-history, Version history>>
+|<<suspicious-print-spooler-spl-file-created, Suspicious Print Spooler SPL File Created>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |106
 
-|<<windows-script-executing-powershell, Windows Script Executing PowerShell>> |Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access] [Investigation Guide]  |7.6.0 |102 <<windows-script-executing-powershell-history, Version history>>
+|<<suspicious-printspooler-service-executable-file-creation, Suspicious PrintSpooler Service Executable File Creation>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |103
 
-|<<windows-script-interpreter-executing-process-via-wmi, Windows Script Interpreter Executing Process via WMI>> |Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity. |[Elastic] [Host] [Windows] [Threat Detection] [Initial Access]  |7.11.0 |101 <<windows-script-interpreter-executing-process-via-wmi-history, Version history>>
+|<<suspicious-proc-pseudo-file-system-enumeration, Suspicious Proc Pseudo File System Enumeration>> |This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |1
 
-|<<windows-service-installed-via-an-unusual-client, Windows Service Installed via an Unusual Client>> |Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation]  |8.1.0 |100 <<windows-service-installed-via-an-unusual-client-history, Version history>>
+|<<suspicious-process-access-via-direct-system-call, Suspicious Process Access via Direct System Call>> |Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Sysmon Only] |8.8.0 |208
 
-|<<wireless-credential-dumping-using-netsh-command, Wireless Credential Dumping using Netsh Command>> |Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [Discovery] [Elastic Endgame]  |8.6.0 |1
+|<<suspicious-process-creation-calltrace, Suspicious Process Creation CallTrace>> |Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Sysmon Only] |8.8.0 |207
 
-|<<zoom-meeting-with-no-passcode, Zoom Meeting with no Passcode>> |This rule identifies Zoom meetings that are created without a passcode. Meetings without a passcode are susceptible to Zoombombing. Zoombombing is carried out by taking advantage of Zoom sessions that are not protected with a passcode. Zoombombing refers to the unwanted, disruptive intrusion, generally by Internet trolls and hackers, into a video conference call. In a typical Zoombombing incident, a teleconferencing session is hijacked by the insertion of material that is lewd, obscene, racist, or antisemitic in nature, typically resulting of the shutdown of the session. |[Elastic] [Application] [Communication] [Zoom] [Continuous Monitoring] [SecOps] [Configuration Audit]  |7.10.0 |100 <<zoom-meeting-with-no-passcode-history, Version history>>
+|<<suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> |Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |105
 
-|==============================================
\ No newline at end of file
+|<<suspicious-process-spawned-from-motd-detected, Suspicious Process Spawned from MOTD Detected>> |Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and "/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |3
+
+|<<suspicious-rdp-activex-client-loaded, Suspicious RDP ActiveX Client Loaded>> |Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame] |8.3.0 |103
+
+|<<suspicious-remote-registry-access-via-sebackupprivilege, Suspicious Remote Registry Access via SeBackupPrivilege>> |Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |107
+
+|<<suspicious-renaming-of-esxi-files, Suspicious Renaming of ESXI Files>> |Identifies instances where VMware-related files, such as those with extensions like ".vmdk", ".vmx", ".vmxf", ".vmsd", ".vmsn", ".vswp", ".vmss", ".nvram", and ".vmem", are renamed on a Linux system. The rule monitors for the "rename" event action associated with these file types, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.5.0 |2
+
+|<<suspicious-renaming-of-esxi-index-html-file, Suspicious Renaming of ESXI index.html File>> |Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.5.0 |2
+
+|<<suspicious-script-object-execution, Suspicious Script Object Execution>> |Identifies scrobj.dll loaded into unusual Microsoft processes. This usually means a malicious scriptlet is being executed in the target process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |103
+
+|<<suspicious-service-was-installed-in-the-system, Suspicious Service was Installed in the System>> |Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |7
+
+|<<suspicious-solarwinds-child-process, Suspicious SolarWinds Child Process>> |A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> |Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<suspicious-sysctl-file-event, Suspicious Sysctl File Event>> |Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |1
+
+|<<suspicious-system-commands-executed-by-previously-unknown-executable, Suspicious System Commands Executed by Previously Unknown Executable>> |This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.4.0 |1
+
+|<<suspicious-termination-of-esxi-process, Suspicious Termination of ESXI Process>> |Identifies instances where VMware processes, such as "vmware-vmx" or "vmx," are terminated on a Linux system by a "kill" command. The rule monitors for the "end" event type, which signifies the termination of a process. The presence of a "kill" command as the parent process for terminating VMware processes may indicate that a threat actor is attempting to interfere with the virtualized environment on the targeted system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact] |8.5.0 |2
+
+|<<suspicious-wmi-image-load-from-ms-office, Suspicious WMI Image Load from MS Office>> |Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<suspicious-wmic-xsl-script-execution, Suspicious WMIC XSL Script Execution>> |Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
+
+|<<suspicious-werfault-child-process, Suspicious WerFault Child Process>> |A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<suspicious-zoom-child-process, Suspicious Zoom Child Process>> |A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |106
+
+|<<suspicious-macos-ms-office-child-process, Suspicious macOS MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access] |8.3.0 |103
+
+|<<svchost-spawning-cmd, Svchost spawning Cmd>> |Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> |Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<system-hosts-file-access, System Hosts File Access>> |Identifies the use of built-in tools to read the contents of \etc\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |1
+
+|<<system-information-discovery-via-windows-command-shell, System Information Discovery via Windows Command Shell>> |Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows Command Shell. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Resources: Investigation Guide] |8.3.0 |5
+
+|<<system-log-file-deletion, System Log File Deletion>> |Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<system-network-connections-discovery, System Network Connections Discovery>> |Adversaries may attempt to get a listing of network connections to or from a compromised system. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |1
+
+|<<system-owner-user-discovery-linux, System Owner/User Discovery Linux>> |Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |1
+
+|<<system-service-discovery-through-built-in-windows-utilities, System Service Discovery through built-in Windows Utilities>> |Detects the usage of commonly used system service discovery techniques, which attackers may use during the reconnaissance phase after compromising a system in order to gain a better understanding of the environment and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame] |8.3.0 |3
+
+|<<system-shells-via-services, System Shells via Services>> |Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<system-time-discovery, System Time Discovery>> |Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame] |8.3.0 |3
+
+|<<systemkey-access-via-command-line, SystemKey Access via Command Line>> |Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
+
+|<<tcc-bypass-via-mounted-apfs-snapshot-access, TCC Bypass via Mounted APFS Snapshot Access>> |Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC). |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Use Case: Vulnerability] |8.3.0 |103
+
+|<<tampering-of-bash-command-line-history, Tampering of Bash Command-Line History>> |Adversaries may attempt to clear or disable the Bash command-line history in an attempt to evade detection or forensic investigations. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |102
+
+|<<temporarily-scheduled-task-creation, Temporarily Scheduled Task Creation>> |Indicates the creation and deletion of a scheduled task within a short time interval. Adversaries can use these to proxy malicious execution via the schedule service and perform clean up. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |6
+
+|<<third-party-backup-files-deleted-via-unexpected-process, Third-party Backup Files Deleted via Unexpected Process>> |Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<threat-intel-hash-indicator-match, Threat Intel Hash Indicator Match>> |This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Indicator Match] |8.5.0 |2
+
+|<<threat-intel-ip-address-indicator-match, Threat Intel IP Address Indicator Match>> |This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Indicator Match] |8.5.0 |2
+
+|<<threat-intel-url-indicator-match, Threat Intel URL Indicator Match>> |This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Indicator Match] |8.5.0 |2
+
+|<<threat-intel-windows-registry-indicator-match, Threat Intel Windows Registry Indicator Match>> |This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Indicator Match] |8.5.0 |2
+
+|<<timestomping-using-touch-command, Timestomping using Touch Command>> |Timestomping is an anti-forensics technique which is used to modify the timestamps of a file, often to mimic files that are in the same folder. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |102
+
+|<<uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer, UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer>> |Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<uac-bypass-attempt-via-privileged-ifileoperation-com-interface, UAC Bypass Attempt via Privileged IFileOperation COM Interface>> |Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> |Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface, UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface>> |Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<uac-bypass-via-diskcleanup-scheduled-task-hijack, UAC Bypass via DiskCleanup Scheduled Task Hijack>> |Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |103
+
+|<<uac-bypass-via-icmluautil-elevated-com-interface, UAC Bypass via ICMLuaUtil Elevated COM Interface>> |Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<uac-bypass-via-windows-firewall-snap-in-hijack, UAC Bypass via Windows Firewall Snap-In Hijack>> |Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<unauthorized-access-to-an-okta-application, Unauthorized Access to an Okta Application>> |Identifies unauthorized access attempts to Okta applications. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.3.0 |103
+
+|<<uncommon-registry-persistence-change, Uncommon Registry Persistence Change>> |Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
+
+|<<unexpected-child-process-of-macos-screensaver-engine, Unexpected Child Process of macOS Screensaver Engine>> |Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence] |8.3.0 |103
+
+|<<unsigned-dll-loaded-by-svchost, Unsigned DLL Loaded by Svchost>> |Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |8.4.0 |3
+
+|<<unsigned-dll-side-loading-from-a-suspicious-folder, Unsigned DLL Side-Loading from a Suspicious Folder>> |Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.4.0 |3
+
+|<<untrusted-driver-loaded, Untrusted Driver Loaded>> |Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |4
+
+|<<unusual-aws-command-for-a-user, Unusual AWS Command for a User>> |A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.3.0 |105
+
+|<<unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> |Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> |Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |105
+
+|<<unusual-child-processes-of-rundll32, Unusual Child Processes of RunDLL32>> |Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
+
+|<<unusual-city-for-an-aws-command, Unusual City For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.3.0 |105
+
+|<<unusual-country-for-an-aws-command, Unusual Country For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.3.0 |105
+
+|<<unusual-dns-activity, Unusual DNS Activity>> |A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.3.0 |102
+
+|<<unusual-executable-file-creation-by-a-system-critical-process, Unusual Executable File Creation by a System Critical Process>> |Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<unusual-file-creation-alternate-data-stream, Unusual File Creation - Alternate Data Stream>> |Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |109
+
+|<<unusual-file-modification-by-dns-exe, Unusual File Modification by dns.exe>> |Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability] |8.3.0 |105
+
+|<<unusual-hour-for-a-user-to-logon, Unusual Hour for a User to Logon>> |A machine learning job detected a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. In addition, unauthorized user activity often takes place during non-business hours. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access], [Resources: Investigation Guide] |8.3.0 |103
+
+|<<unusual-linux-network-activity, Unusual Linux Network Activity>> |Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
+
+|<<unusual-linux-network-configuration-discovery, Unusual Linux Network Configuration Discovery>> |Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Discovery] |8.3.0 |103
+
+|<<unusual-linux-network-connection-discovery, Unusual Linux Network Connection Discovery>> |Looks for commands related to system network connection discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network connection discovery in order to increase their understanding of connected services and systems. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Discovery] |8.3.0 |102
+
+|<<unusual-linux-network-port-activity, Unusual Linux Network Port Activity>> |Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
+
+|<<unusual-linux-process-calling-the-metadata-service, Unusual Linux Process Calling the Metadata Service>> |Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access] |8.3.0 |102
+
+|<<unusual-linux-process-discovery-activity, Unusual Linux Process Discovery Activity>> |Looks for commands related to system process discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system process discovery in order to increase their understanding of software applications running on a target host or network. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Discovery] |8.3.0 |102
+
+|<<unusual-linux-system-information-discovery-activity, Unusual Linux System Information Discovery Activity>> |Looks for commands related to system information discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system information discovery in order to gather detailed information about system configuration and software versions. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Discovery] |8.3.0 |102
+
+|<<unusual-linux-user-calling-the-metadata-service, Unusual Linux User Calling the Metadata Service>> |Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access] |8.3.0 |102
+
+|<<unusual-linux-user-discovery-activity, Unusual Linux User Discovery Activity>> |Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery in order to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping or privilege elevation activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Discovery] |8.3.0 |103
+
+|<<unusual-linux-username, Unusual Linux Username>> |A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access] |8.3.0 |102
+
+|<<unusual-login-activity, Unusual Login Activity>> |Identifies an unusually high number of authentication attempts. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access] |8.3.0 |102
+
+|<<unusual-network-activity-from-a-windows-system-binary, Unusual Network Activity from a Windows System Binary>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |106
+
+|<<unusual-network-connection-via-dllhost, Unusual Network Connection via DllHost>> |Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |104
+
+|<<unusual-network-connection-via-rundll32, Unusual Network Connection via RunDLL32>> |Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Resources: Investigation Guide] |8.3.0 |106
+
+|<<unusual-network-destination-domain-name, Unusual Network Destination Domain Name>> |A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
+
+|<<unusual-parent-process-for-cmd-exe, Unusual Parent Process for cmd.exe>> |Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<unusual-parent-child-relationship, Unusual Parent-Child Relationship>> |Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<unusual-persistence-via-services-registry, Unusual Persistence via Services Registry>> |Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame] |8.3.0 |103
+
+|<<unusual-print-spooler-child-process, Unusual Print Spooler Child Process>> |Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability] |8.3.0 |103
+
+|<<unusual-process-execution-path-alternate-data-stream, Unusual Process Execution Path - Alternate Data Stream>> |Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<unusual-process-for-a-linux-host, Unusual Process For a Linux Host>> |Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence] |8.3.0 |103
+
+|<<unusual-process-for-a-windows-host, Unusual Process For a Windows Host>> |Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |106
+
+|<<unusual-process-network-connection, Unusual Process Network Connection>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |105
+
+|<<unusual-service-host-child-process-childless-service, Unusual Service Host Child Process - Childless Service>> |Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<unusual-source-ip-for-a-user-to-logon-from, Unusual Source IP for a User to Logon from>> |A machine learning job detected a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access] |8.3.0 |102
+
+|<<unusual-sudo-activity, Unusual Sudo Activity>> |Looks for sudo activity from an unusual user context. An unusual sudo user could be due to troubleshooting activity or it could be a sign of credentialed access via compromised accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Privilege Escalation] |8.3.0 |102
+
+|<<unusual-web-request, Unusual Web Request>> |A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.3.0 |102
+
+|<<unusual-web-user-agent, Unusual Web User Agent>> |A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.3.0 |102
+
+|<<unusual-windows-network-activity, Unusual Windows Network Activity>> |Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |102
+
+|<<unusual-windows-path-activity, Unusual Windows Path Activity>> |Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence], [Tactic: Execution] |8.3.0 |103
+
+|<<unusual-windows-process-calling-the-metadata-service, Unusual Windows Process Calling the Metadata Service>> |Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access] |8.3.0 |102
+
+|<<unusual-windows-remote-user, Unusual Windows Remote User>> |A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access] |8.3.0 |102
+
+|<<unusual-windows-service, Unusual Windows Service>> |A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence] |8.3.0 |102
+
+|<<unusual-windows-user-calling-the-metadata-service, Unusual Windows User Calling the Metadata Service>> |Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access] |8.3.0 |102
+
+|<<unusual-windows-user-privilege-elevation-activity, Unusual Windows User Privilege Elevation Activity>> |A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Privilege Escalation] |8.3.0 |102
+
+|<<unusual-windows-username, Unusual Windows Username>> |A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access] |8.3.0 |103
+
+|<<user-account-creation, User Account Creation>> |Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<user-added-as-owner-for-azure-application, User Added as Owner for Azure Application>> |Identifies when a user is added as an owner for an Azure application. An adversary may add a user account as an owner for an Azure application in order to grant additional permissions and modify the application's configuration using another account. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
+
+|<<user-added-as-owner-for-azure-service-principal, User Added as Owner for Azure Service Principal>> |Identifies when a user is added as an owner for an Azure service principal. The service principal object defines what the application can do in the specific tenant, who can access the application, and what resources the app can access. A service principal object is created when an application is given permission to access resources in a tenant. An adversary may add a user account as an owner for a service principal and use that account in order to define what an application can do in the Azure AD tenant. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
+
+|<<user-added-to-privileged-group, User Added to Privileged Group>> |Identifies a user being added to a privileged group in Active Directory. Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |107
+
+|<<user-account-exposed-to-kerberoasting, User account exposed to Kerberoasting>> |Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |107
+
+|<<vnc-virtual-network-computing-from-the-internet, VNC (Virtual Network Computing) from the Internet>> |This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |102
+
+|<<vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> |This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |102
+
+|<<virtual-machine-fingerprinting, Virtual Machine Fingerprinting>> |An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame] |8.3.0 |104
+
+|<<virtual-machine-fingerprinting-via-grep, Virtual Machine Fingerprinting via Grep>> |An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |102
+
+|<<virtual-private-network-connection-attempt, Virtual Private Network Connection Attempt>> |Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |103
+
+|<<volume-shadow-copy-deleted-or-resized-via-vssadmin, Volume Shadow Copy Deleted or Resized via VssAdmin>> |Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<volume-shadow-copy-deletion-via-powershell, Volume Shadow Copy Deletion via PowerShell>> |Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<volume-shadow-copy-deletion-via-wmic, Volume Shadow Copy Deletion via WMIC>> |Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<wmi-incoming-lateral-movement, WMI Incoming Lateral Movement>> |Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |106
+
+|<<wpad-service-exploit, WPAD Service Exploit>> |Identifies probable exploitation of the Web Proxy Auto-Discovery Protocol (WPAD) service. Attackers who have access to the local network or upstream DNS traffic can inject malicious JavaScript to the WPAD service which can lead to a full system compromise. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |None |1
+
+|<<web-application-suspicious-activity-post-request-declined, Web Application Suspicious Activity: POST Request Declined>> |A POST request to a web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed. |[Data Source: APM] |8.3.0 |102
+
+|<<web-application-suspicious-activity-unauthorized-method, Web Application Suspicious Activity: Unauthorized Method>> |A request to a web application returned a 405 response, which indicates the web application declined to process the request because the HTTP method is not allowed for the resource. |[Data Source: APM] |8.3.0 |102
+
+|<<web-application-suspicious-activity-sqlmap-user-agent, Web Application Suspicious Activity: sqlmap User Agent>> |This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities. |[Data Source: APM] |8.3.0 |102
+
+|<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<webproxy-settings-modification, WebProxy Settings Modification>> |Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |103
+
+|<<webserver-access-logs-deleted, WebServer Access Logs Deleted>> |Identifies the deletion of WebServer access logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion] |8.3.0 |102
+
+|<<whoami-process-activity, Whoami Process Activity>> |Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
+
+|<<windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball, Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)>> |A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Use Case: Vulnerability] |8.3.0 |103
+
+|<<windows-defender-disabled-via-registry-modification, Windows Defender Disabled via Registry Modification>> |Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> |Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<windows-event-logs-cleared, Windows Event Logs Cleared>> |Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |107
+
+|<<windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> |Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<windows-network-enumeration, Windows Network Enumeration>> |Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<windows-registry-file-creation-in-smb-share, Windows Registry File Creation in SMB Share>> |Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |105
+
+|<<windows-script-executing-powershell, Windows Script Executing PowerShell>> |Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<windows-script-interpreter-executing-process-via-wmi, Windows Script Interpreter Executing Process via WMI>> |Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame] |8.3.0 |105
+
+|<<windows-service-installed-via-an-unusual-client, Windows Service Installed via an Unusual Client>> |Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |105
+
+|<<windows-subsystem-for-linux-distribution-installed, Windows Subsystem for Linux Distribution Installed>> |Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |3
+
+|<<windows-subsystem-for-linux-enabled-via-dism-utility, Windows Subsystem for Linux Enabled via Dism Utility>> |Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame] |8.3.0 |3
+
+|<<windows-system-information-discovery, Windows System Information Discovery>> |Detects the execution of commands used to discover information about the system, which attackers may use after compromising a system to gain situational awareness. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |1
+
+|<<windows-user-account-creation, Windows User Account Creation>> |Identifies attempts to create a Windows User Account. This is sometimes done by attackers to persist or increase access to a system or domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |None |1
+
+|<<wireless-credential-dumping-using-netsh-command, Wireless Credential Dumping using Netsh Command>> |Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |8.3.0 |5
+
+|<<zoom-meeting-with-no-passcode, Zoom Meeting with no Passcode>> |This rule identifies Zoom meetings that are created without a passcode. Meetings without a passcode are susceptible to Zoombombing. Zoombombing is carried out by taking advantage of Zoom sessions that are not protected with a passcode. Zoombombing refers to the unwanted, disruptive intrusion, generally by Internet trolls and hackers, into a video conference call. In a typical Zoombombing incident, a teleconferencing session is hijacked by the insertion of material that is lewd, obscene, racist, or antisemitic in nature, typically resulting of the shutdown of the session. |[Data Source: Zoom], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |101
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 8887ec2357..32bc83a6b9 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -1,6 +1,5 @@
 include::rule-details/a-scheduled-task-was-created.asciidoc[]
 include::rule-details/a-scheduled-task-was-updated.asciidoc[]
-include::rule-details/aws-access-secret-in-secrets-manager.asciidoc[]
 include::rule-details/aws-cloudtrail-log-created.asciidoc[]
 include::rule-details/aws-cloudtrail-log-deleted.asciidoc[]
 include::rule-details/aws-cloudtrail-log-suspended.asciidoc[]
@@ -10,6 +9,7 @@ include::rule-details/aws-cloudwatch-log-group-deletion.asciidoc[]
 include::rule-details/aws-cloudwatch-log-stream-deletion.asciidoc[]
 include::rule-details/aws-config-resource-deletion.asciidoc[]
 include::rule-details/aws-configuration-recorder-stopped.asciidoc[]
+include::rule-details/aws-credentials-searched-for-inside-a-container.asciidoc[]
 include::rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc[]
 include::rule-details/aws-ec2-encryption-disabled.asciidoc[]
 include::rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc[]
@@ -64,6 +64,7 @@ include::rule-details/access-to-a-sensitive-ldap-attribute.asciidoc[]
 include::rule-details/account-configured-with-never-expiring-password.asciidoc[]
 include::rule-details/account-discovery-command-via-system-account.asciidoc[]
 include::rule-details/account-password-reset-remotely.asciidoc[]
+include::rule-details/account-or-group-discovery-via-built-in-tools.asciidoc[]
 include::rule-details/adfind-command-activity.asciidoc[]
 include::rule-details/adding-hidden-file-attribute-via-attrib.asciidoc[]
 include::rule-details/adminsdholder-backdoor.asciidoc[]
@@ -93,8 +94,10 @@ include::rule-details/attempt-to-delete-an-okta-network-zone.asciidoc[]
 include::rule-details/attempt-to-delete-an-okta-policy.asciidoc[]
 include::rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc[]
 include::rule-details/attempt-to-disable-gatekeeper.asciidoc[]
+include::rule-details/attempt-to-disable-iptables-or-firewall.asciidoc[]
 include::rule-details/attempt-to-disable-syslog-service.asciidoc[]
 include::rule-details/attempt-to-enable-the-root-account.asciidoc[]
+include::rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc[]
 include::rule-details/attempt-to-install-root-certificate.asciidoc[]
 include::rule-details/attempt-to-modify-an-okta-application.asciidoc[]
 include::rule-details/attempt-to-modify-an-okta-network-zone.asciidoc[]
@@ -147,19 +150,25 @@ include::rule-details/base16-or-base32-encoding-decoding-activity.asciidoc[]
 include::rule-details/bash-shell-profile-modification.asciidoc[]
 include::rule-details/binary-executed-from-shared-memory-directory.asciidoc[]
 include::rule-details/bypass-uac-via-event-viewer.asciidoc[]
+include::rule-details/bypass-uac-via-sdclt.asciidoc[]
 include::rule-details/chkconfig-service-add.asciidoc[]
 include::rule-details/clearing-windows-console-history.asciidoc[]
 include::rule-details/clearing-windows-event-logs.asciidoc[]
 include::rule-details/cobalt-strike-command-and-control-beacon.asciidoc[]
+include::rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc[]
+include::rule-details/code-signing-policy-modification-through-registry.asciidoc[]
 include::rule-details/command-execution-via-solarwinds-process.asciidoc[]
 include::rule-details/command-prompt-network-connection.asciidoc[]
 include::rule-details/command-shell-activity-started-via-rundll32.asciidoc[]
 include::rule-details/component-object-model-hijacking.asciidoc[]
+include::rule-details/compression-dll-loaded-by-unusual-process.asciidoc[]
 include::rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc[]
 include::rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc[]
 include::rule-details/connection-to-commonly-abused-web-services.asciidoc[]
 include::rule-details/connection-to-external-network-via-telnet.asciidoc[]
 include::rule-details/connection-to-internal-network-via-telnet.asciidoc[]
+include::rule-details/container-management-utility-run-inside-a-container.asciidoc[]
+include::rule-details/container-workload-protection.asciidoc[]
 include::rule-details/control-panel-process-with-unusual-arguments.asciidoc[]
 include::rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc[]
 include::rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc[]
@@ -174,6 +183,7 @@ include::rule-details/credential-dumping-detected-elastic-endgame.asciidoc[]
 include::rule-details/credential-dumping-prevented-elastic-endgame.asciidoc[]
 include::rule-details/credential-manipulation-detected-elastic-endgame.asciidoc[]
 include::rule-details/credential-manipulation-prevented-elastic-endgame.asciidoc[]
+include::rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc[]
 include::rule-details/cyberark-privileged-access-security-error.asciidoc[]
 include::rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc[]
 include::rule-details/dns-tunneling.asciidoc[]
@@ -187,9 +197,14 @@ include::rule-details/disable-windows-firewall-rules-via-netsh.asciidoc[]
 include::rule-details/disabling-user-account-control-via-registry-modification.asciidoc[]
 include::rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc[]
 include::rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc[]
+include::rule-details/downloaded-shortcut-files.asciidoc[]
+include::rule-details/downloaded-url-files.asciidoc[]
 include::rule-details/dumping-account-hashes-via-built-in-commands.asciidoc[]
 include::rule-details/dumping-of-keychain-content-via-security-command.asciidoc[]
 include::rule-details/dynamic-linker-copy.asciidoc[]
+include::rule-details/esxi-discovery-via-find.asciidoc[]
+include::rule-details/esxi-discovery-via-grep.asciidoc[]
+include::rule-details/esxi-timestomping-using-touch-command.asciidoc[]
 include::rule-details/eggshell-backdoor-execution.asciidoc[]
 include::rule-details/elastic-agent-service-terminated.asciidoc[]
 include::rule-details/emond-rules-creation-or-modification.asciidoc[]
@@ -197,33 +212,48 @@ include::rule-details/enable-host-network-discovery-via-netsh.asciidoc[]
 include::rule-details/encoded-executable-stored-in-the-registry.asciidoc[]
 include::rule-details/encrypting-files-with-winrar-or-7z.asciidoc[]
 include::rule-details/endpoint-security.asciidoc[]
-include::rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc[]
+include::rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc[]
+include::rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc[]
 include::rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc[]
 include::rule-details/enumeration-of-administrator-accounts.asciidoc[]
 include::rule-details/enumeration-of-kernel-modules.asciidoc[]
+include::rule-details/enumeration-of-kernel-modules-via-proc.asciidoc[]
 include::rule-details/enumeration-of-privileged-local-groups-membership.asciidoc[]
 include::rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc[]
+include::rule-details/exchange-mailbox-export-via-powershell.asciidoc[]
 include::rule-details/executable-file-creation-with-multiple-extensions.asciidoc[]
 include::rule-details/execution-from-unusual-directory-command-line.asciidoc[]
 include::rule-details/execution-of-com-object-via-xwizard.asciidoc[]
 include::rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc[]
 include::rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc[]
 include::rule-details/execution-of-persistent-suspicious-program.asciidoc[]
-include::rule-details/execution-via-electron-child-process-node.js-module.asciidoc[]
-include::rule-details/execution-via-mssql-xp_cmdshell-stored-procedure.asciidoc[]
+include::rule-details/execution-via-electron-child-process-node-js-module.asciidoc[]
+include::rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc[]
 include::rule-details/execution-via-tsclient-mountpoint.asciidoc[]
+include::rule-details/execution-via-windows-subsystem-for-linux.asciidoc[]
 include::rule-details/execution-via-local-sxs-shared-module.asciidoc[]
 include::rule-details/execution-with-explicit-credentials-via-scripting.asciidoc[]
+include::rule-details/expired-or-revoked-driver-loaded.asciidoc[]
 include::rule-details/exploit-detected-elastic-endgame.asciidoc[]
 include::rule-details/exploit-prevented-elastic-endgame.asciidoc[]
 include::rule-details/exporting-exchange-mailbox-via-powershell.asciidoc[]
 include::rule-details/external-alerts.asciidoc[]
 include::rule-details/external-ip-lookup-from-non-browser-process.asciidoc[]
+include::rule-details/external-user-added-to-google-workspace-group.asciidoc[]
+include::rule-details/file-creation-time-changed.asciidoc[]
 include::rule-details/file-deletion-via-shred.asciidoc[]
+include::rule-details/file-made-executable-via-chmod-inside-a-container.asciidoc[]
 include::rule-details/file-permission-modification-in-writable-directory.asciidoc[]
 include::rule-details/file-transfer-or-listener-established-via-netcat.asciidoc[]
 include::rule-details/file-made-immutable-by-chattr.asciidoc[]
 include::rule-details/finder-sync-plugin-registered-and-enabled.asciidoc[]
+include::rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc[]
+include::rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc[]
+include::rule-details/first-time-seen-driver-loaded.asciidoc[]
+include::rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc[]
+include::rule-details/first-time-seen-removable-device.asciidoc[]
+include::rule-details/firsttime-seen-account-performing-dcsync.asciidoc[]
+include::rule-details/forwarded-google-workspace-security-alert.asciidoc[]
 include::rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc[]
 include::rule-details/gcp-firewall-rule-creation.asciidoc[]
 include::rule-details/gcp-firewall-rule-deletion.asciidoc[]
@@ -256,17 +286,21 @@ include::rule-details/google-workspace-admin-role-deletion.asciidoc[]
 include::rule-details/google-workspace-bitlocker-setting-disabled.asciidoc[]
 include::rule-details/google-workspace-custom-admin-role-created.asciidoc[]
 include::rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc[]
+include::rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc[]
 include::rule-details/google-workspace-mfa-enforcement-disabled.asciidoc[]
+include::rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc[]
 include::rule-details/google-workspace-password-policy-modified.asciidoc[]
 include::rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc[]
 include::rule-details/google-workspace-role-modified.asciidoc[]
-include::rule-details/google-workspace-user-group-access-modified-to-allow-external-access.asciidoc[]
+include::rule-details/google-workspace-suspended-user-account-renewed.asciidoc[]
 include::rule-details/google-workspace-user-organizational-unit-changed.asciidoc[]
 include::rule-details/group-policy-abuse-for-privilege-addition.asciidoc[]
+include::rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc[]
 include::rule-details/halfbaked-command-and-control-beacon.asciidoc[]
 include::rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc[]
 include::rule-details/high-number-of-process-terminations.asciidoc[]
 include::rule-details/high-number-of-process-and-or-service-terminations.asciidoc[]
+include::rule-details/host-files-system-changes-via-windows-subsystem-for-linux.asciidoc[]
 include::rule-details/hosts-file-modified.asciidoc[]
 include::rule-details/hping-process-activity.asciidoc[]
 include::rule-details/iis-http-logging-disabled.asciidoc[]
@@ -279,15 +313,18 @@ include::rule-details/incoming-dcom-lateral-movement-with-mmc.asciidoc[]
 include::rule-details/incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc[]
 include::rule-details/incoming-execution-via-powershell-remoting.asciidoc[]
 include::rule-details/incoming-execution-via-winrm-remote-shell.asciidoc[]
+include::rule-details/ingress-transfer-via-windows-bits.asciidoc[]
 include::rule-details/installutil-process-making-network-connections.asciidoc[]
 include::rule-details/installation-of-custom-shim-databases.asciidoc[]
 include::rule-details/installation-of-security-support-provider.asciidoc[]
+include::rule-details/interactive-exec-command-launched-against-a-running-container.asciidoc[]
 include::rule-details/interactive-terminal-spawned-via-perl.asciidoc[]
 include::rule-details/interactive-terminal-spawned-via-python.asciidoc[]
 include::rule-details/krbtgt-delegation-backdoor.asciidoc[]
 include::rule-details/kerberos-cached-credentials-dumping.asciidoc[]
 include::rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc[]
 include::rule-details/kerberos-traffic-from-unusual-process.asciidoc[]
+include::rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc[]
 include::rule-details/kernel-module-removal.asciidoc[]
 include::rule-details/kernel-module-load-via-insmod.asciidoc[]
 include::rule-details/keychain-password-retrieval-via-command-line.asciidoc[]
@@ -305,10 +342,15 @@ include::rule-details/kubernetes-suspicious-self-subject-review.asciidoc[]
 include::rule-details/kubernetes-user-exec-into-pod.asciidoc[]
 include::rule-details/lsass-memory-dump-creation.asciidoc[]
 include::rule-details/lsass-memory-dump-handle-access.asciidoc[]
+include::rule-details/lsass-process-access-via-windows-api.asciidoc[]
 include::rule-details/lateral-movement-via-startup-folder.asciidoc[]
 include::rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc[]
 include::rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc[]
-include::rule-details/linux-restricted-shell-breakout-via-linux-binarys.asciidoc[]
+include::rule-details/linux-group-creation.asciidoc[]
+include::rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc[]
+include::rule-details/linux-system-information-discovery.asciidoc[]
+include::rule-details/linux-user-account-creation.asciidoc[]
+include::rule-details/linux-user-added-to-privileged-group.asciidoc[]
 include::rule-details/local-account-tokenfilter-policy-disabled.asciidoc[]
 include::rule-details/local-scheduled-task-creation.asciidoc[]
 include::rule-details/mfa-disabled-for-google-workspace-organization.asciidoc[]
@@ -329,7 +371,9 @@ include::rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc[
 include::rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc[]
 include::rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc[]
 include::rule-details/microsoft-365-global-administrator-role-assigned.asciidoc[]
+include::rule-details/microsoft-365-impossible-travel-activity.asciidoc[]
 include::rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc[]
+include::rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc[]
 include::rule-details/microsoft-365-potential-ransomware-activity.asciidoc[]
 include::rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc[]
 include::rule-details/microsoft-365-teams-external-access-enabled.asciidoc[]
@@ -351,6 +395,7 @@ include::rule-details/mimikatz-memssp-log-file-detected.asciidoc[]
 include::rule-details/modification-of-amsienable-registry-key.asciidoc[]
 include::rule-details/modification-of-boot-configuration.asciidoc[]
 include::rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc[]
+include::rule-details/modification-of-dynamic-linker-preload-shared-object-inside-a-container.asciidoc[]
 include::rule-details/modification-of-environment-variable-via-launchctl.asciidoc[]
 include::rule-details/modification-of-openssh-binaries.asciidoc[]
 include::rule-details/modification-of-safari-settings-via-defaults-command.asciidoc[]
@@ -360,15 +405,19 @@ include::rule-details/modification-of-the-mspkiaccountcredentials.asciidoc[]
 include::rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc[]
 include::rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc[]
 include::rule-details/msbuild-making-network-connections.asciidoc[]
+include::rule-details/msbuild-network-connection-sequence.asciidoc[]
+include::rule-details/msxsl-making-network-connections.asciidoc[]
 include::rule-details/mshta-making-network-connections.asciidoc[]
 include::rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc[]
+include::rule-details/multiple-alerts-involving-a-user.asciidoc[]
 include::rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-host.asciidoc[]
 include::rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc[]
 include::rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc[]
 include::rule-details/multiple-vault-web-credentials-read.asciidoc[]
-include::rule-details/my-first-alert.asciidoc[]
+include::rule-details/my-first-rule.asciidoc[]
 include::rule-details/ntds-or-sam-database-file-copied.asciidoc[]
 include::rule-details/namespace-manipulation-using-unshare.asciidoc[]
+include::rule-details/netcat-listener-established-inside-a-container.asciidoc[]
 include::rule-details/network-connection-via-certutil.asciidoc[]
 include::rule-details/network-connection-via-compiled-html-file.asciidoc[]
 include::rule-details/network-connection-via-msxsl.asciidoc[]
@@ -377,6 +426,8 @@ include::rule-details/network-connection-via-signed-binary.asciidoc[]
 include::rule-details/network-logon-provider-registry-modification.asciidoc[]
 include::rule-details/network-traffic-to-rare-destination-country.asciidoc[]
 include::rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc[]
+include::rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc[]
+include::rule-details/new-systemd-timer-created.asciidoc[]
 include::rule-details/new-or-modified-federation-domain.asciidoc[]
 include::rule-details/nping-process-activity.asciidoc[]
 include::rule-details/nullsessionpipe-registry-modification.asciidoc[]
@@ -385,6 +436,7 @@ include::rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc[]
 include::rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc[]
 include::rule-details/o365-mailbox-audit-logging-bypass.asciidoc[]
 include::rule-details/okta-brute-force-or-password-spraying-attack.asciidoc[]
+include::rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc[]
 include::rule-details/okta-user-session-impersonation.asciidoc[]
 include::rule-details/onedrive-malware-file-upload.asciidoc[]
 include::rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc[]
@@ -414,7 +466,9 @@ include::rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc[]
 include::rule-details/possible-okta-dos-attack.asciidoc[]
 include::rule-details/potential-abuse-of-repeated-mfa-push-notifications.asciidoc[]
 include::rule-details/potential-admin-group-account-addition.asciidoc[]
+include::rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc[]
 include::rule-details/potential-application-shimming-via-sdbinst.asciidoc[]
+include::rule-details/potential-code-execution-via-postgresql.asciidoc[]
 include::rule-details/potential-command-and-control-via-internet-explorer.asciidoc[]
 include::rule-details/potential-cookies-theft-via-browser-debugging.asciidoc[]
 include::rule-details/potential-credential-access-via-dcsync.asciidoc[]
@@ -423,13 +477,19 @@ include::rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
 include::rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc[]
 include::rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc[]
 include::rule-details/potential-credential-access-via-windows-utilities.asciidoc[]
+include::rule-details/potential-cross-site-scripting-xss.asciidoc[]
 include::rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[]
 include::rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc[]
 include::rule-details/potential-dns-tunneling-via-iodine.asciidoc[]
 include::rule-details/potential-dns-tunneling-via-nslookup.asciidoc[]
+include::rule-details/potential-defense-evasion-via-proot.asciidoc[]
 include::rule-details/potential-disabling-of-selinux.asciidoc[]
 include::rule-details/potential-evasion-via-filter-manager.asciidoc[]
+include::rule-details/potential-exfiltration-via-certreq.asciidoc[]
+include::rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc[]
 include::rule-details/potential-hidden-local-user-account-creation.asciidoc[]
+include::rule-details/potential-hidden-process-via-mount-hidepid.asciidoc[]
+include::rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc[]
 include::rule-details/potential-invoke-mimikatz-powershell-script.asciidoc[]
 include::rule-details/potential-java-jndi-exploitation-attempt.asciidoc[]
 include::rule-details/potential-kerberos-attack-via-bifrost.asciidoc[]
@@ -437,50 +497,82 @@ include::rule-details/potential-lsa-authentication-package-abuse.asciidoc[]
 include::rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc[]
 include::rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc[]
 include::rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc[]
-include::rule-details/potential-linux-ssh-brute-force-detected.asciidoc[]
+include::rule-details/potential-linux-backdoor-user-account-creation.asciidoc[]
+include::rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc[]
+include::rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc[]
+include::rule-details/potential-linux-local-account-brute-force-detected.asciidoc[]
+include::rule-details/potential-linux-ransomware-note-creation-detected.asciidoc[]
 include::rule-details/potential-local-ntlm-relay-via-http.asciidoc[]
+include::rule-details/potential-malicious-file-downloaded-from-google-drive.asciidoc[]
+include::rule-details/potential-masquerading-as-communication-apps.asciidoc[]
 include::rule-details/potential-microsoft-office-sandbox-evasion.asciidoc[]
 include::rule-details/potential-modification-of-accessibility-binaries.asciidoc[]
+include::rule-details/potential-network-scan-detected.asciidoc[]
+include::rule-details/potential-network-sweep-detected.asciidoc[]
+include::rule-details/potential-non-standard-port-http-https-connection.asciidoc[]
 include::rule-details/potential-non-standard-port-ssh-connection.asciidoc[]
 include::rule-details/potential-openssh-backdoor-logging-activity.asciidoc[]
+include::rule-details/potential-pass-the-hash-pth-attempt.asciidoc[]
 include::rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc[]
+include::rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc[]
+include::rule-details/potential-persistence-through-run-control-detected.asciidoc[]
+include::rule-details/potential-persistence-through-init-d-detected.asciidoc[]
 include::rule-details/potential-persistence-via-atom-init-script-modification.asciidoc[]
 include::rule-details/potential-persistence-via-login-hook.asciidoc[]
 include::rule-details/potential-persistence-via-periodic-tasks.asciidoc[]
 include::rule-details/potential-persistence-via-time-provider-modification.asciidoc[]
 include::rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc[]
+include::rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc[]
+include::rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc[]
 include::rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc[]
 include::rule-details/potential-privilege-escalation-via-pkexec.asciidoc[]
 include::rule-details/potential-privilege-escalation-via-sudoers-file-modification.asciidoc[]
 include::rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc[]
 include::rule-details/potential-process-herpaderping-attempt.asciidoc[]
+include::rule-details/potential-process-injection-via-ld-preload-environment-variable.asciidoc[]
 include::rule-details/potential-process-injection-via-powershell.asciidoc[]
 include::rule-details/potential-protocol-tunneling-via-earthworm.asciidoc[]
+include::rule-details/potential-pspy-process-monitoring-detected.asciidoc[]
+include::rule-details/potential-remote-code-execution-via-web-server.asciidoc[]
 include::rule-details/potential-remote-credential-access-via-registry.asciidoc[]
 include::rule-details/potential-remote-desktop-shadowing-activity.asciidoc[]
 include::rule-details/potential-remote-desktop-tunneling-detected.asciidoc[]
+include::rule-details/potential-reverse-shell.asciidoc[]
 include::rule-details/potential-reverse-shell-activity-via-terminal.asciidoc[]
-include::rule-details/potential-ssh-brute-force-detected-on-privileged-account.asciidoc[]
+include::rule-details/potential-reverse-shell-via-java.asciidoc[]
+include::rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc[]
+include::rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc[]
+include::rule-details/potential-reverse-shell-via-suspicious-parent-process.asciidoc[]
 include::rule-details/potential-ssh-password-guessing.asciidoc[]
+include::rule-details/potential-syn-based-network-scan-detected.asciidoc[]
 include::rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc[]
 include::rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc[]
 include::rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc[]
 include::rule-details/potential-sharprdp-behavior.asciidoc[]
-include::rule-details/potential-shell-via-web-server.asciidoc[]
+include::rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc[]
+include::rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc[]
+include::rule-details/potential-suspicious-file-edit.asciidoc[]
 include::rule-details/potential-windows-error-manager-masquerading.asciidoc[]
 include::rule-details/potential-macos-ssh-brute-force-detected.asciidoc[]
+include::rule-details/powershell-invoke-ninjacopy-script.asciidoc[]
 include::rule-details/powershell-kerberos-ticket-request.asciidoc[]
 include::rule-details/powershell-keylogging-script.asciidoc[]
+include::rule-details/powershell-mailbox-collection-script.asciidoc[]
 include::rule-details/powershell-minidump-script.asciidoc[]
 include::rule-details/powershell-psreflect-script.asciidoc[]
 include::rule-details/powershell-script-block-logging-disabled.asciidoc[]
+include::rule-details/powershell-script-with-archive-compression-capabilities.asciidoc[]
+include::rule-details/powershell-script-with-discovery-capabilities.asciidoc[]
+include::rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc[]
+include::rule-details/powershell-script-with-log-clear-capabilities.asciidoc[]
 include::rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc[]
 include::rule-details/powershell-share-enumeration-script.asciidoc[]
 include::rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc[]
 include::rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc[]
 include::rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc[]
+include::rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc[]
 include::rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc[]
 include::rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc[]
 include::rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc[]
@@ -491,6 +583,7 @@ include::rule-details/privileges-elevation-via-parent-process-pid-spoofing.ascii
 include::rule-details/process-activity-via-compiled-html-file.asciidoc[]
 include::rule-details/process-created-with-an-elevated-token.asciidoc[]
 include::rule-details/process-creation-via-secondary-logon.asciidoc[]
+include::rule-details/process-discovery-via-built-in-applications.asciidoc[]
 include::rule-details/process-execution-from-an-unusual-directory.asciidoc[]
 include::rule-details/process-injection-detected-elastic-endgame.asciidoc[]
 include::rule-details/process-injection-prevented-elastic-endgame.asciidoc[]
@@ -500,6 +593,7 @@ include::rule-details/process-termination-followed-by-deletion.asciidoc[]
 include::rule-details/program-files-directory-masquerading.asciidoc[]
 include::rule-details/prompt-for-credentials-with-osascript.asciidoc[]
 include::rule-details/psexec-network-connection.asciidoc[]
+include::rule-details/python-script-execution-via-command-line.asciidoc[]
 include::rule-details/rdp-remote-desktop-protocol-from-the-internet.asciidoc[]
 include::rule-details/rdp-enabled-via-registry.asciidoc[]
 include::rule-details/rpc-remote-procedure-call-from-the-internet.asciidoc[]
@@ -526,12 +620,15 @@ include::rule-details/remote-system-discovery-commands.asciidoc[]
 include::rule-details/remote-windows-service-installed.asciidoc[]
 include::rule-details/remotely-started-services-via-rpc.asciidoc[]
 include::rule-details/renamed-autoit-scripts-interpreter.asciidoc[]
-include::rule-details/reverse-shell-created-via-named-pipe.asciidoc[]
+include::rule-details/renamed-utility-executed-with-short-program-name.asciidoc[]
 include::rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc[]
 include::rule-details/sip-provider-modification.asciidoc[]
 include::rule-details/smb-windows-file-sharing-activity-to-the-internet.asciidoc[]
 include::rule-details/smtp-on-port-26-tcp.asciidoc[]
 include::rule-details/ssh-authorized-keys-file-modification.asciidoc[]
+include::rule-details/ssh-authorized-keys-file-modified-inside-a-container.asciidoc[]
+include::rule-details/ssh-connection-established-inside-a-running-container.asciidoc[]
+include::rule-details/ssh-process-launched-from-inside-a-container.asciidoc[]
 include::rule-details/sunburst-command-and-control-activity.asciidoc[]
 include::rule-details/scheduled-task-created-by-a-windows-script.asciidoc[]
 include::rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc[]
@@ -542,12 +639,15 @@ include::rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc[]
 include::rule-details/security-software-discovery-using-wmic.asciidoc[]
 include::rule-details/security-software-discovery-via-grep.asciidoc[]
 include::rule-details/sensitive-files-compression.asciidoc[]
+include::rule-details/sensitive-files-compression-inside-a-container.asciidoc[]
+include::rule-details/sensitive-keys-or-passwords-searched-for-inside-a-container.asciidoc[]
 include::rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc[]
 include::rule-details/service-command-lateral-movement.asciidoc[]
 include::rule-details/service-control-spawned-via-script-interpreter.asciidoc[]
 include::rule-details/service-creation-via-local-kerberos-authentication.asciidoc[]
 include::rule-details/setuid-setgid-bit-set-via-chmod.asciidoc[]
 include::rule-details/sharepoint-malware-file-upload.asciidoc[]
+include::rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc[]
 include::rule-details/shell-execution-via-apple-scripting.asciidoc[]
 include::rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc[]
 include::rule-details/softwareupdate-preferences-modification.asciidoc[]
@@ -556,9 +656,9 @@ include::rule-details/spike-in-aws-error-messages.asciidoc[]
 include::rule-details/spike-in-failed-logon-events.asciidoc[]
 include::rule-details/spike-in-firewall-denies.asciidoc[]
 include::rule-details/spike-in-logon-events.asciidoc[]
-include::rule-details/spike-in-logon-events-from-a-source-ip.asciidoc[]
 include::rule-details/spike-in-network-traffic.asciidoc[]
 include::rule-details/spike-in-network-traffic-to-a-country.asciidoc[]
+include::rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc[]
 include::rule-details/startup-folder-persistence-via-unsigned-process.asciidoc[]
 include::rule-details/startup-persistence-by-a-suspicious-process.asciidoc[]
 include::rule-details/startup-or-run-key-registry-modification.asciidoc[]
@@ -566,35 +666,49 @@ include::rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
 include::rule-details/sublime-plugin-or-application-script-modification.asciidoc[]
 include::rule-details/sudo-heap-based-buffer-overflow-attempt.asciidoc[]
 include::rule-details/sudoers-file-modification.asciidoc[]
-include::rule-details/suspicious-.net-code-compilation.asciidoc[]
-include::rule-details/suspicious-.net-reflection-via-powershell.asciidoc[]
+include::rule-details/suspicious-net-code-compilation.asciidoc[]
+include::rule-details/suspicious-net-reflection-via-powershell.asciidoc[]
 include::rule-details/suspicious-activity-reported-by-okta-user.asciidoc[]
+include::rule-details/suspicious-antimalware-scan-interface-dll.asciidoc[]
 include::rule-details/suspicious-automator-workflows-execution.asciidoc[]
 include::rule-details/suspicious-browser-child-process.asciidoc[]
 include::rule-details/suspicious-calendar-file-modification.asciidoc[]
 include::rule-details/suspicious-certutil-commands.asciidoc[]
 include::rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc[]
 include::rule-details/suspicious-cmd-execution-via-wmi.asciidoc[]
+include::rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc[]
 include::rule-details/suspicious-crontab-creation-or-modification.asciidoc[]
 include::rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc[]
+include::rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc[]
 include::rule-details/suspicious-emond-child-process.asciidoc[]
 include::rule-details/suspicious-endpoint-security-parent-process.asciidoc[]
-include::rule-details/suspicious-execution-short-program-name.asciidoc[]
 include::rule-details/suspicious-execution-from-a-mounted-device.asciidoc[]
+include::rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc[]
 include::rule-details/suspicious-execution-via-scheduled-task.asciidoc[]
+include::rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc[]
 include::rule-details/suspicious-explorer-child-process.asciidoc[]
+include::rule-details/suspicious-file-changes-activity-detected.asciidoc[]
 include::rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc[]
 include::rule-details/suspicious-html-file-creation.asciidoc[]
 include::rule-details/suspicious-hidden-child-process-of-launchd.asciidoc[]
-include::rule-details/suspicious-image-load-taskschd.dll-from-ms-office.asciidoc[]
+include::rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc[]
 include::rule-details/suspicious-imagepath-service-creation.asciidoc[]
+include::rule-details/suspicious-inter-process-communication-via-outlook.asciidoc[]
+include::rule-details/suspicious-interactive-shell-spawned-from-inside-a-container.asciidoc[]
 include::rule-details/suspicious-java-child-process.asciidoc[]
 include::rule-details/suspicious-lsass-access-via-malseclogon.asciidoc[]
+include::rule-details/suspicious-lsass-process-access.asciidoc[]
 include::rule-details/suspicious-ms-office-child-process.asciidoc[]
 include::rule-details/suspicious-ms-outlook-child-process.asciidoc[]
 include::rule-details/suspicious-managed-code-hosting-process.asciidoc[]
+include::rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc[]
 include::rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc[]
+include::rule-details/suspicious-mining-process-creation-event.asciidoc[]
+include::rule-details/suspicious-modprobe-file-event.asciidoc[]
+include::rule-details/suspicious-module-loaded-by-lsass.asciidoc[]
+include::rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc[]
 include::rule-details/suspicious-network-connection-attempt-by-root.asciidoc[]
+include::rule-details/suspicious-network-tool-launched-inside-a-container.asciidoc[]
 include::rule-details/suspicious-pdf-reader-child-process.asciidoc[]
 include::rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc[]
 include::rule-details/suspicious-powershell-engine-imageload.asciidoc[]
@@ -603,33 +717,46 @@ include::rule-details/suspicious-print-spooler-file-deletion.asciidoc[]
 include::rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc[]
 include::rule-details/suspicious-print-spooler-spl-file-created.asciidoc[]
 include::rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc[]
+include::rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc[]
 include::rule-details/suspicious-process-access-via-direct-system-call.asciidoc[]
 include::rule-details/suspicious-process-creation-calltrace.asciidoc[]
 include::rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc[]
+include::rule-details/suspicious-process-spawned-from-motd-detected.asciidoc[]
 include::rule-details/suspicious-rdp-activex-client-loaded.asciidoc[]
 include::rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc[]
+include::rule-details/suspicious-renaming-of-esxi-files.asciidoc[]
+include::rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc[]
 include::rule-details/suspicious-script-object-execution.asciidoc[]
+include::rule-details/suspicious-service-was-installed-in-the-system.asciidoc[]
 include::rule-details/suspicious-solarwinds-child-process.asciidoc[]
 include::rule-details/suspicious-startup-shell-folder-modification.asciidoc[]
+include::rule-details/suspicious-sysctl-file-event.asciidoc[]
+include::rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc[]
+include::rule-details/suspicious-termination-of-esxi-process.asciidoc[]
 include::rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc[]
 include::rule-details/suspicious-wmic-xsl-script-execution.asciidoc[]
 include::rule-details/suspicious-werfault-child-process.asciidoc[]
 include::rule-details/suspicious-zoom-child-process.asciidoc[]
 include::rule-details/suspicious-macos-ms-office-child-process.asciidoc[]
-include::rule-details/suspicious-service-was-installed-in-the-system.asciidoc[]
 include::rule-details/svchost-spawning-cmd.asciidoc[]
 include::rule-details/symbolic-link-to-shadow-copy-created.asciidoc[]
+include::rule-details/system-hosts-file-access.asciidoc[]
 include::rule-details/system-information-discovery-via-windows-command-shell.asciidoc[]
 include::rule-details/system-log-file-deletion.asciidoc[]
+include::rule-details/system-network-connections-discovery.asciidoc[]
+include::rule-details/system-owner-user-discovery-linux.asciidoc[]
+include::rule-details/system-service-discovery-through-built-in-windows-utilities.asciidoc[]
 include::rule-details/system-shells-via-services.asciidoc[]
+include::rule-details/system-time-discovery.asciidoc[]
 include::rule-details/systemkey-access-via-command-line.asciidoc[]
 include::rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc[]
 include::rule-details/tampering-of-bash-command-line-history.asciidoc[]
 include::rule-details/temporarily-scheduled-task-creation.asciidoc[]
 include::rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc[]
-include::rule-details/threat-detected-by-okta-threatinsight.asciidoc[]
-include::rule-details/threat-intel-filebeat-module-v8.x-indicator-match.asciidoc[]
-include::rule-details/threat-intel-indicator-match.asciidoc[]
+include::rule-details/threat-intel-hash-indicator-match.asciidoc[]
+include::rule-details/threat-intel-ip-address-indicator-match.asciidoc[]
+include::rule-details/threat-intel-url-indicator-match.asciidoc[]
+include::rule-details/threat-intel-windows-registry-indicator-match.asciidoc[]
 include::rule-details/timestomping-using-touch-command.asciidoc[]
 include::rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc[]
 include::rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc[]
@@ -641,33 +768,36 @@ include::rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc[]
 include::rule-details/unauthorized-access-to-an-okta-application.asciidoc[]
 include::rule-details/uncommon-registry-persistence-change.asciidoc[]
 include::rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc[]
+include::rule-details/unsigned-dll-loaded-by-svchost.asciidoc[]
+include::rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc[]
+include::rule-details/untrusted-driver-loaded.asciidoc[]
 include::rule-details/unusual-aws-command-for-a-user.asciidoc[]
 include::rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc[]
-include::rule-details/unusual-child-process-of-dns.exe.asciidoc[]
+include::rule-details/unusual-child-process-of-dns-exe.asciidoc[]
 include::rule-details/unusual-child-processes-of-rundll32.asciidoc[]
 include::rule-details/unusual-city-for-an-aws-command.asciidoc[]
 include::rule-details/unusual-country-for-an-aws-command.asciidoc[]
 include::rule-details/unusual-dns-activity.asciidoc[]
 include::rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc[]
 include::rule-details/unusual-file-creation-alternate-data-stream.asciidoc[]
-include::rule-details/unusual-file-modification-by-dns.exe.asciidoc[]
+include::rule-details/unusual-file-modification-by-dns-exe.asciidoc[]
 include::rule-details/unusual-hour-for-a-user-to-logon.asciidoc[]
 include::rule-details/unusual-linux-network-activity.asciidoc[]
+include::rule-details/unusual-linux-network-configuration-discovery.asciidoc[]
 include::rule-details/unusual-linux-network-connection-discovery.asciidoc[]
 include::rule-details/unusual-linux-network-port-activity.asciidoc[]
 include::rule-details/unusual-linux-process-calling-the-metadata-service.asciidoc[]
 include::rule-details/unusual-linux-process-discovery-activity.asciidoc[]
 include::rule-details/unusual-linux-system-information-discovery-activity.asciidoc[]
-include::rule-details/unusual-linux-system-network-configuration-discovery.asciidoc[]
-include::rule-details/unusual-linux-system-owner-or-user-discovery-activity.asciidoc[]
 include::rule-details/unusual-linux-user-calling-the-metadata-service.asciidoc[]
+include::rule-details/unusual-linux-user-discovery-activity.asciidoc[]
 include::rule-details/unusual-linux-username.asciidoc[]
 include::rule-details/unusual-login-activity.asciidoc[]
 include::rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc[]
 include::rule-details/unusual-network-connection-via-dllhost.asciidoc[]
 include::rule-details/unusual-network-connection-via-rundll32.asciidoc[]
 include::rule-details/unusual-network-destination-domain-name.asciidoc[]
-include::rule-details/unusual-parent-process-for-cmd.exe.asciidoc[]
+include::rule-details/unusual-parent-process-for-cmd-exe.asciidoc[]
 include::rule-details/unusual-parent-child-relationship.asciidoc[]
 include::rule-details/unusual-persistence-via-services-registry.asciidoc[]
 include::rule-details/unusual-print-spooler-child-process.asciidoc[]
@@ -702,6 +832,7 @@ include::rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciido
 include::rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc[]
 include::rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc[]
 include::rule-details/wmi-incoming-lateral-movement.asciidoc[]
+include::rule-details/wpad-service-exploit.asciidoc[]
 include::rule-details/web-application-suspicious-activity-post-request-declined.asciidoc[]
 include::rule-details/web-application-suspicious-activity-unauthorized-method.asciidoc[]
 include::rule-details/web-application-suspicious-activity-sqlmap-user-agent.asciidoc[]
@@ -719,5 +850,9 @@ include::rule-details/windows-registry-file-creation-in-smb-share.asciidoc[]
 include::rule-details/windows-script-executing-powershell.asciidoc[]
 include::rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc[]
 include::rule-details/windows-service-installed-via-an-unusual-client.asciidoc[]
+include::rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc[]
+include::rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc[]
+include::rule-details/windows-system-information-discovery.asciidoc[]
+include::rule-details/windows-user-account-creation.asciidoc[]
 include::rule-details/wireless-credential-dumping-using-netsh-command.asciidoc[]
-include::rule-details/zoom-meeting-with-no-passcode.asciidoc[]
+include::rule-details/zoom-meeting-with-no-passcode.asciidoc[]
\ No newline at end of file
diff --git a/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-created.asciidoc
index 8fd21dc402..ce996f91cc 100644
--- a/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-created.asciidoc
@@ -5,62 +5,60 @@ Indicates the creation of a scheduled task using Windows event logs. Adversaries
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 2 (<<a-scheduled-task-was-created-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 7
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks may be created during installation of new software.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-iam where event.action == "scheduled-task-created" and /* excluding
-tasks created by the computer account */ not user.name : "*$" and
-/* TaskContent is not parsed, exclude by full taskname noisy ones */
-not winlog.event_data.TaskName : ("\\OneDrive Standalone
-Update Task-S-1-5-21*", "\\OneDrive Standalone Update
-Task-S-1-12-1-*", "\\Hewlett-Packard\\HP Web Products
-Detection", "\\Hewlett-Packard\\HPDeviceCheck")
+[source, js]
 ----------------------------------
+iam where event.action == "scheduled-task-created" and
 
-==== Threat mapping
+ /* excluding tasks created by the computer account */
+ not user.name : "*$" and
+
+ /* TaskContent is not parsed, exclude by full taskname noisy ones */
+ not winlog.event_data.TaskName :
+             ("\\OneDrive Standalone Update Task-S-1-5-21*",
+              "\\OneDrive Standalone Update Task-S-1-12-1-*",
+              "\\Hewlett-Packard\\HP Web Products Detection",
+              "\\Hewlett-Packard\\HPDeviceCheck")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,20 +70,7 @@ Detection", "\\Hewlett-Packard\\HPDeviceCheck")
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[a-scheduled-task-was-created-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-iam where event.action == "scheduled-task-created" and /* excluding
-tasks created by the computer account */ not user.name : "*$" and
-/* TaskContent is not parsed, exclude by full taskname noisy ones */
-not winlog.event_data.TaskName : ("\\OneDrive Standalone
-Update Task-S-1-5-21*", "\\Hewlett-Packard\\HP Web
-Products Detection", "\\Hewlett-Packard\\HPDeviceCheck")
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-updated.asciidoc b/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-updated.asciidoc
index a19ae291ba..ada909e83f 100644
--- a/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-updated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/a-scheduled-task-was-updated.asciidoc
@@ -5,62 +5,68 @@ Indicates the update of a scheduled task using Windows event logs. Adversaries c
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
-*Severity*: low
+*Severity*: medium
 
-*Risk score*: 21
+*Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 2 (<<a-scheduled-task-was-updated-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 8
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks may be created during installation of new software.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-iam where event.action == "scheduled-task-updated" and /* excluding
-tasks created by the computer account */ not user.name : "*$" and
-not winlog.event_data.TaskName :
-("\\User_Feed_Synchronization-*", "\\OneDrive Reporting
-Task-S-1-5-21*", "\\OneDrive Reporting Task-S-1-12-1-*",
-"\\Hewlett-Packard\\HP Web Products Detection", "\\Hewlett-
-Packard\\HPDeviceCheck")
+[source, js]
 ----------------------------------
+iam where event.action == "scheduled-task-updated" and
+
+ /* excluding tasks created by the computer account */
+ not user.name : "*$" and 
+ not winlog.event_data.TaskName : "*Microsoft*" and 
+ not winlog.event_data.TaskName :
+          ("\\User_Feed_Synchronization-*",
+           "\\OneDrive Reporting Task-S-1-5-21*",
+           "\\OneDrive Reporting Task-S-1-12-1-*",
+           "\\Hewlett-Packard\\HP Web Products Detection",
+           "\\Hewlett-Packard\\HPDeviceCheck", 
+           "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant", 
+           "\\IpamDnsProvisioning",  
+           "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantAllUsersRun", 
+           "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun", 
+           "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun", 
+           "\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN v*", 
+           "\\Microsoft\\VisualStudio\\Updates\\BackgroundDownload") and 
+  not winlog.event_data.SubjectUserSid :  ("S-1-5-18", "S-1-5-19", "S-1-5-20")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,20 +78,7 @@ Packard\\HPDeviceCheck")
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[a-scheduled-task-was-updated-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-iam where event.action == "scheduled-task-updated" and /* excluding
-tasks created by the computer account */ not user.name : "*$" and
-not winlog.event_data.TaskName :
-("\\User_Feed_Synchronization-*", "\\OneDrive Reporting
-Task-S-1-5-21*", "\\Hewlett-Packard\\HP Web Products
-Detection", "\\Hewlett-Packard\\HPDeviceCheck")
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc
index baad36dd16..3ee5fe91a1 100644
--- a/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc
@@ -3,133 +3,109 @@
 
 Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files.
 
-*Rule type*: eql
+*Rule type*: new_terms
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/
 * https://twitter.com/GossiTheDog/status/1522964028284411907
 * https://exatrack.com/public/Tricephalic_Hellkeeper.pdf
 * https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* BPFDoor
-* Investigation Guide
-
-*Version*: 102 (<<abnormal-process-id-or-lock-file-created-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Threat: BPFDoor
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 207
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-False-Positives (FP) can appear if the PID file is legitimate and holding a process ID as intended. To differentiate, if the PID file is an executable or larger than 10 bytes, it should be ruled suspicious.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Abnormal Process ID or Lock File Created
 
-Linux applications may need to save their process identification number (PID) for various purposes: from signaling that
-a program is running to serving as a signal that a previous instance of an application didn't exit successfully. PID
-files contain its creator process PID in an integer value.
+Linux applications may need to save their process identification number (PID) for various purposes: from signaling that a program is running to serving as a signal that a previous instance of an application didn't exit successfully. PID files contain its creator process PID in an integer value.
 
 Linux lock files are used to coordinate operations in files so that conflicts and race conditions are prevented.
 
-This rule identifies the creation of PID, lock, or reboot files in the /var/run/ directory. Attackers can masquerade
-malware, payloads, staged data for exfiltration, and more as legitimate PID files.
+This rule identifies the creation of PID, lock, or reboot files in the /var/run/ directory. Attackers can masquerade malware, payloads, staged data for exfiltration, and more as legitimate PID files.
 
 #### Possible investigation steps
 
 - Retrieve the file and determine if it is malicious:
     - Check the contents of the PID files. They should only contain integer strings.
-    - Check the file type of the lock and PID files to determine if they are executables. This is only observed in
-    malicious files.
+    - Check the file type of the lock and PID files to determine if they are executables. This is only observed in     malicious files.
     - Check the size of the subject file. Legitimate PID files should be under 10 bytes.
     - Check if the lock or PID file has high entropy. This typically indicates an encrypted payload.
         - Analysts can use tools like `ent` to measure entropy.
-    - Examine the reputation of the SHA-256 hash in the PID file. Use a database like VirusTotal to identify additional
-    pivots and artifacts for investigation.
+    - Examine the reputation of the SHA-256 hash in the PID file. Use a database like VirusTotal to identify additional pivots and artifacts for investigation.
 - Trace the file's creation to ensure it came from a legitimate or authorized process.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
-spawned child processes.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 
 ### False positive analysis
 
-- False positives can appear if the PID file is legitimate and holding a process ID as intended. If the PID file is
-an executable or has a file size that's larger than 10 bytes, it should be ruled suspicious.
-- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination
-of file name and process executable conditions.
+- False positives can appear if the PID file is legitimate and holding a process ID as intended. If the PID file is an executable or has a file size that's larger than 10 bytes, it should be ruled suspicious.
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of file name and process executable conditions.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Block the identified indicators of compromise (IoCs).
 - Take actions to terminate processes and connections used by the attacker.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* add file size filters when data is available */ file where
-event.type == "creation" and user.id == "0" and file.path regex~
-"""/var/run/\w+\.(pid|lock|reboot)""" and file.extension in
-("pid","lock","reboot") and /* handle common legitimate files */
-not file.name in ( "auditd.pid", "python*", "apport.pid",
-"apport.lock", "kworker*", "gdm3.pid", "sshd.pid",
-"acpid.pid", "unattended-upgrades.lock", "unattended-
-upgrades.pid", "cmd.pid", "cron*.pid", "yum.pid",
-"netconfig.pid", "docker.pid", "atd.pid", "lfd.pid",
-"atop.pid", "nginx.pid", "dhclient.pid", "smtpd.pid",
-"stunnel.pid", "1_waagent.pid" )
+[source, js]
 ----------------------------------
+host.os.type : "linux" and event.category : "file" and event.action : ("creation" or "file_create_event") and
+user.id : "0" and file.path : (/var/run/* or /run/*) and file.extension : ("pid" or "lock" or "reboot") and not 
+file.name : ("auditd.pid" or "python*" or "apport.pid" or "apport.lock" or "kworker*" or "gdm3.pid" or "sshd.pid" or 
+"acpid.pid" or "unattended-upgrades.lock" or "unattended-upgrades.pid" or "cmd.pid" or "yum.pid" or "netconfig.pid" or 
+"docker.pid" or "atd.pid" or "lfd.pid" or "atop.pid" or "nginx.pid" or "dhclient.pid" or "smtpd.pid" or "stunnel.pid" or 
+"1_waagent.pid" or "crond.pid" or "cron.reboot" or "sssd.pid" or "tomcat8.pid")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -141,43 +117,3 @@ upgrades.pid", "cmd.pid", "cron*.pid", "yum.pid",
 ** Name: Native API
 ** ID: T1106
 ** Reference URL: https://attack.mitre.org/techniques/T1106/
-
-[[abnormal-process-id-or-lock-file-created-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* add file size filters when data is available */ file where
-event.type == "creation" and user.id == "0" and file.path regex~
-"""/var/run/\w+\.(pid|lock|reboot)""" and file.extension in
-("pid","lock","reboot") and /* handle common legitimate files */
-not file.name in ( "auditd.pid", "python*", "apport.pid",
-"apport.lock", "kworker*", "gdm3.pid", "sshd.pid",
-"acpid.pid", "unattended-upgrades.lock", "unattended-
-upgrades.pid", "cmd.pid", "cron*.pid", "yum.pid",
-"netconfig.pid", "docker.pid", "atd.pid", "lfd.pid",
-"atop.pid", "nginx.pid", "dhclient.pid", "smtpd.pid",
-"stunnel.pid" )
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* add file size filters when data is available */ file where
-event.type == "creation" and user.id == "0" and file.path regex~
-"""/var/run/\w+\.(pid|lock|reboot)""" and file.extension in
-("pid","lock","reboot") and /* handle common legitimate files */
-not file.name in ( "auditd.pid", "python*", "apport.pid",
-"apport.lock", "kworker*", "gdm3.pid", "sshd.pid",
-"acpid.pid", "unattended-upgrades.lock", "unattended-
-upgrades.pid", "cmd.pid", "cron*.pid" )
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc b/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc
index a3c6f3125a..8cee57f07f 100644
--- a/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc
@@ -5,81 +5,67 @@ Specially crafted DNS requests can manipulate a known overflow vulnerability in
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * packetbeat-*
-* filebeat-*
+* logs-network_traffic.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
 * https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
 * https://github.com/maxpl0it/CVE-2020-1350-DoS
 * https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
-
-*Version*: 102 (<<abnormally-large-dns-response-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Environments that leverage DNS responses over 60k bytes will result in false positives - if this traffic is predictable and expected, it should be filtered out. Additionally, this detection rule could be triggered by an authorized vulnerability scan or compromise assessment.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Abnormally Large DNS Response
 
-Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS
-server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350)
-also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.
+Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.
 
 #### Possible investigation steps
 
-- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate
-the source of the incoming traffic and determine if this activity has been observed previously within an environment.
+- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate the source of the incoming traffic and determine if this activity has been observed previously within an environment.
 - Activity can be further investigated and validated by reviewing any associated Intrusion Detection Signatures (IDS) alerts.
-- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as
-Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.
-- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale
-internet vulnerability scanning.
+- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.
+- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale internet vulnerability scanning.
 - Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.
 
 #### False positive analysis
 
-- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes
-and related to legitimate behavior.  In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses
-were all observed as greater than 65k bytes.
-- This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to
-determine the source of the activity and potentially allowlist the source host.
+- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes and related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses were all observed as greater than 65k bytes.
+- This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to determine the source of the activity and potentially allowlist the source host.
 
 ### Related rules
 
@@ -89,27 +75,22 @@ determine the source of the activity and potentially allowlist the source host.
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350)
-(Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability)
-a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
+- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
 - Maintain backups of your critical systems to aid in quick recovery.
 - Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.
 - If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and destination.port:53
-and (event.dataset:zeek.dns or type:dns or event.type:connection)
-and network.bytes > 60000
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.dns and
+  (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -121,34 +102,3 @@ and network.bytes > 60000
 ** Name: Exploitation of Remote Services
 ** ID: T1210
 ** Reference URL: https://attack.mitre.org/techniques/T1210/
-
-[[abnormally-large-dns-response-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/accepted-default-telnet-port-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/accepted-default-telnet-port-connection.asciidoc
index 2dc6b628be..35ee8eb932 100644
--- a/docs/detections/prebuilt-rules/rule-details/accepted-default-telnet-port-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/accepted-default-telnet-port-connection.asciidoc
@@ -5,60 +5,51 @@ This rule detects network events that may indicate the use of Telnet traffic. Te
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Command and Control
-* Host
-* Lateral Movement
-* Initial Access
+*Tags*: 
 
-*Version*: 101 (<<accepted-default-telnet-port-connection-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Lateral Movement
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and destination.port:23
-and network.direction:(inbound or ingress or outbound or egress) and
-not event.action:( flow_dropped or denied or deny or
-flow_terminated or timeout or Reject or network_flow)
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and event.type: connection
+  and not event.action:(
+      flow_dropped or denied or deny or
+      flow_terminated or timeout or Reject or network_flow)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,8 +57,6 @@ flow_terminated or timeout or Reject or network_flow)
 ** Name: Command and Control
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
-
-
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -76,8 +65,6 @@ flow_terminated or timeout or Reject or network_flow)
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -86,65 +73,3 @@ flow_terminated or timeout or Reject or network_flow)
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[accepted-default-telnet-port-connection-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Rule name changed from: Telnet Port Activity
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port:23
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.15.0 release)::
-* Formatting only
-
-Version 8 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port:23
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port:23
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
index 26a7794bd8..98707ddd46 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a process with arguments pointing to known browser f
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,64 +14,64 @@ Identifies the execution of a process with arguments pointing to known browser f
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://securelist.com/calisto-trojan-for-macos/86543/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<access-of-stored-browser-credentials-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : ( "/Users/*/Library/Application
-Support/Google/Chrome/Default/Login Data",
-"/Users/*/Library/Application Support/Google/Chrome/Default/Cookies",
-"/Users/*/Library/Application Support/Google/Chrome/Profile*/Cookies",
-"/Users/*/Library/Cookies*", "/Users/*/Library/Application
-Support/Firefox/Profiles/*.default/cookies.sqlite",
-"/Users/*/Library/Application
-Support/Firefox/Profiles/*.default/key*.db",
-"/Users/*/Library/Application
-Support/Firefox/Profiles/*.default/logins.json", "Login Data",
-"Cookies.binarycookies", "key4.db", "key3.db",
-"logins.json", "cookies.sqlite" )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.args :
+    (
+      "/Users/*/Library/Application Support/Google/Chrome/Default/Login Data",
+      "/Users/*/Library/Application Support/Google/Chrome/Default/Cookies",
+      "/Users/*/Library/Application Support/Google/Chrome/Profile*/Cookies",
+      "/Users/*/Library/Cookies*",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/cookies.sqlite",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/key*.db",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/logins.json",
+      "Login Data",
+      "Cookies.binarycookies",
+      "key4.db",
+      "key3.db",
+      "logins.json",
+      "cookies.sqlite"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,32 +83,11 @@ Support/Firefox/Profiles/*.default/logins.json", "Login Data",
 ** Name: Steal Web Session Cookie
 ** ID: T1539
 ** Reference URL: https://attack.mitre.org/techniques/T1539/
-
-[[access-of-stored-browser-credentials-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : ( "/Users/*/Library/Application
-Support/Google/Chrome/Default/Login Data",
-"/Users/*/Library/Application Support/Google/Chrome/Default/Cookies",
-"/Users/*/Library/Cookies*", "/Users/*/Library/Application
-Support/Firefox/Profiles/*.default/cookies.sqlite",
-"/Users/*/Library/Application
-Support/Firefox/Profiles/*.default/key*.db",
-"/Users/*/Library/Application
-Support/Firefox/Profiles/*.default/logins.json", "Login Data",
-"Cookies.binarycookies", "key4.db", "key3.db",
-"logins.json", "cookies.sqlite" )
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Credentials from Web Browsers
+** ID: T1555.003
+** Reference URL: https://attack.mitre.org/techniques/T1555/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc
index a45ff0440c..0fb14be968 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc
@@ -5,48 +5,50 @@ Identify access to sensitive Active Directory object attributes that contains cr
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming
 * https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx
 * https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Active Directory
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Version*: 1
+*Version*: 6
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
 Steps to implement the logging policy with Advanced Audit Configuration:
@@ -63,24 +65,37 @@ Audit Directory Service Changes (Success,Failure)
 ```
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where event.action == "Directory Service Access" and event.code ==
-"4662" and not winlog.event_data.SubjectUserSid : "S-1-5-18" and
-winlog.event_data.Properties : ( /* unixUserPassword */
-"*612cb747-c0e8-4f92-9221-fdd5f15b550d*", /* ms-PKI-
-AccountCredentials */ "*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*",
-/* ms-PKI-DPAPIMasterKeys */
-"*b3f93023-9239-4f7c-b99c-6745d87adbc2*", /* msPKI-
-CredentialRoamingTokens */ "*b7ff5a38-0818-42b0-8110-d3d154c97f24*"
-)
+[source, js]
 ----------------------------------
+any where event.action == "Directory Service Access" and event.code == "4662" and
+
+  not winlog.event_data.SubjectUserSid : "S-1-5-18" and
 
-==== Threat mapping
+  winlog.event_data.Properties : (
+   /* unixUserPassword */
+  "*612cb747-c0e8-4f92-9221-fdd5f15b550d*",
+
+  /* ms-PKI-AccountCredentials */
+  "*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*",
+
+  /*  ms-PKI-DPAPIMasterKeys */
+  "*b3f93023-9239-4f7c-b99c-6745d87adbc2*",
+
+  /* msPKI-CredentialRoamingTokens */
+  "*b7ff5a38-0818-42b0-8110-d3d154c97f24*"
+  ) and
+
+  /*
+   Excluding noisy AccessMasks
+   0x0 undefined and 0x100 Control Access
+   https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
+   */
+  not winlog.event_data.AccessMask in ("0x0", "0x100")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
index a9dd29face..d61c154e23 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
@@ -5,7 +5,7 @@ Adversaries may collect the keychain storage data from a system to acquire crede
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,69 +14,75 @@ Adversaries may collect the keychain storage data from a system to acquire crede
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://objective-see.com/blog/blog_0x25.html
 * https://securelist.com/calisto-trojan-for-macos/86543/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<access-to-keychain-credentials-directories-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : ( "/Users/*/Library/Keychains/*",
-"/Library/Keychains/*", "/Network/Library/Keychains/*",
-"System.keychain", "login.keychain-db", "login.keychain"
-) and not process.args : ("find-certificate",
-"add-trusted-cert", "set-keychain-settings",
-"delete-certificate",
-"/Users/*/Library/Keychains/openvpn.keychain-db",
-"show-keychain-info", "lock-keychain",
-"set-key-partition-list", "import",
-"find-identity") and not process.parent.executable : (
-"/Applications/OpenVPN Connect/OpenVPN
-Connect.app/Contents/MacOS/OpenVPN Connect",
-"/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterp
-rise.app/Contents/MacOS/wdavdaemon_enterprise",
-"/opt/jc/bin/jumpcloud-agent" ) and not process.executable :
-"/opt/jc/bin/jumpcloud-agent"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.args :
+    (
+      "/Users/*/Library/Keychains/*",
+      "/Library/Keychains/*",
+      "/Network/Library/Keychains/*",
+      "System.keychain",
+      "login.keychain-db",
+      "login.keychain"
+    ) and
+    not process.args : ("find-certificate",
+                      "add-trusted-cert",
+                      "set-keychain-settings",
+                      "delete-certificate",
+                      "/Users/*/Library/Keychains/openvpn.keychain-db",
+                      "show-keychain-info",
+                      "lock-keychain",
+                      "set-key-partition-list",
+                      "import",
+                      "find-identity") and
+    not process.parent.executable :
+      (
+        "/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect",
+        "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise",
+        "/opt/jc/bin/jumpcloud-agent"
+      ) and
+    not process.executable : "/opt/jc/bin/jumpcloud-agent"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -88,64 +94,7 @@ rise.app/Contents/MacOS/wdavdaemon_enterprise",
 ** Name: Credentials from Password Stores
 ** ID: T1555
 ** Reference URL: https://attack.mitre.org/techniques/T1555/
-
-[[access-to-keychain-credentials-directories-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : ( "/Users/*/Library/Keychains/*",
-"/Library/Keychains/*", "/Network/Library/Keychains/*",
-"System.keychain", "login.keychain-db", "login.keychain"
-) and not process.args : ("find-certificate",
-"add-trusted-cert", "set-keychain-settings",
-"delete-certificate",
-"/Users/*/Library/Keychains/openvpn.keychain-db",
-"show-keychain-info", "lock-keychain",
-"set-key-partition-list", "import",
-"find-identity") and not process.parent.executable :
-"/Applications/OpenVPN Connect/OpenVPN
-Connect.app/Contents/MacOS/OpenVPN Connect"
-----------------------------------
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : ( "/Users/*/Library/Keychains/*",
-"/Library/Keychains/*", "/Network/Library/Keychains/*",
-"System.keychain", "login.keychain-db", "login.keychain"
-)
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Rule name changed from: Compression of Keychain Credentials Directories
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(zip or tar or gzip or 7za or hdiutil) and
-process.args:("/Library/Keychains/" or "/Network/Library/Keychains/"
-or "~/Library/Keychains/")
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
index 4fc8b3c5ad..f441bcca0a 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
@@ -5,64 +5,58 @@ Detects the creation and modification of an account with the "Don't Expire Passw
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire
 * https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<account-configured-with-never-expiring-password-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-User accounts can be used as service accounts and have their password set never to expire. This is a bad security practice that exposes the account to Credential Access attacks. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Account Configured with Never-Expiring Password
 
-Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose
-environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
+Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
 
-The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to
-persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
+The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
 
 #### Possible investigation steps
 
@@ -73,12 +67,8 @@ persist in the domain and maintain long-term access using compromised accounts w
 
 ### False positive analysis
 
-- This activity should not happen legitimately. The security team should address any potential benign true positive
-(B-TP), as this configuration can put the user and the domain at risk.
-- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The
-security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged.
-For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature,
-which ensures that the account password is robust and changed regularly and automatically.
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
 
 ### Response and remediation
 
@@ -88,25 +78,20 @@ which ensures that the account password is robust and changed regularly and auto
 - Search for other occurrences on the domain.
     - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
         - `get-aduser -filter { passwordNeverExpires -eq $true  -and enabled -eq $true } | ft`
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts, if
-any, are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email,
-business systems, and web services.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.action:"modified-user-account" and event.code:"4738" and
-message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"
+[source, js]
 ----------------------------------
+event.action:"modified-user-account" and winlog.api:"wineventlog" and event.code:"4738" and
+  message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,18 +103,3 @@ message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[account-configured-with-never-expiring-password-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Rule name changed from: Account configured with never Expiring Password
diff --git a/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
index e43adf0689..62489c6d05 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
@@ -5,7 +5,7 @@ Identifies when the SYSTEM account uses an account discovery utility. This could
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,92 +15,78 @@ Identifies when the SYSTEM account uses an account discovery utility. This could
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<account-discovery-command-via-system-account-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Account Discovery Command via SYSTEM Account
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed
-after attackers successfully perform privilege escalation or exploit web applications.
+This rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed after attackers successfully perform privilege escalation or exploit web applications.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-  - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike,
-  investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential
-  webshell backdoor.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike, investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential webshell backdoor.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system
-shell using Windows services, scheduled tasks or other third party utilities.
+- Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system shell using Windows services, scheduled tasks or other third party utilities.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 - Use the data collected through the analysis to investigate other machines affected in the environment.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-(?process.Ext.token.integrity_level_name : "System" or
-?winlog.event_data.IntegrityLevel : "System") and (process.name :
-"whoami.exe" or (process.name : "net1.exe" and not
-process.parent.name : "net.exe"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (?process.Ext.token.integrity_level_name : "System" or
+  ?winlog.event_data.IntegrityLevel : "System") and
+  (process.name : "whoami.exe" or
+  (process.name : "net1.exe" and not process.parent.name : "net.exe"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -112,104 +98,3 @@ process.parent.name : "net.exe"))
 ** Name: System Owner/User Discovery
 ** ID: T1033
 ** Reference URL: https://attack.mitre.org/techniques/T1033/
-
-[[account-discovery-command-via-system-account-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(?process.Ext.token.integrity_level_name : "System" or
-?winlog.event_data.IntegrityLevel : "System") and (process.name :
-"whoami.exe" or (process.name : "net1.exe" and not
-process.parent.name : "net.exe"))
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(?process.Ext.token.integrity_level_name : "System" or
-?winlog.event_data.IntegrityLevel : "System") and (process.name :
-"whoami.exe" or (process.name : "net1.exe" and not
-process.parent.name : "net.exe"))
-----------------------------------
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Rule name changed from: Net command via SYSTEM account
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.Ext.token.integrity_level_name : "System" or
-winlog.event_data.IntegrityLevel : "System") and process.name :
-"whoami.exe" or (process.name : "net1.exe" and not
-process.parent.name : "net.exe")
-----------------------------------
-
-Version 9 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.name :
-"whoami.exe" or (process.name : "net1.exe" and not
-process.parent.name : "net.exe")
-----------------------------------
-
-Version 8 (7.16.0 release)::
-* Formatting only
-
-Version 7 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:(whoami.exe or net.exe) or process.name:net1.exe and not
-process.parent.name:net.exe) and user.name:SYSTEM
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:net.exe or process.name:net1.exe and not
-process.parent.name:net.exe) and user.name:SYSTEM
-----------------------------------
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-(process.name:net.exe or process.name:net1.exe and not
-process.parent.name:net.exe) and user.name:SYSTEM and
-event.action:"Process Create (rule: ProcessCreate)"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/account-or-group-discovery-via-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-or-group-discovery-via-built-in-tools.asciidoc
new file mode 100644
index 0000000000..19a64a736e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/account-or-group-discovery-via-built-in-tools.asciidoc
@@ -0,0 +1,86 @@
+[[account-or-group-discovery-via-built-in-tools]]
+=== Account or Group Discovery via Built-In Tools
+
+Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type== "start" and event.action == "exec" and
+  ( (process.name: ("groups","id"))
+    or (process.name : "dscl" and process.args : ("/Active Directory/*", "/Users*", "/Groups*"))
+    or (process.name: "dscacheutil" and process.args:("user", "group"))
+    or process.args:("/etc/passwd", "/etc/master.passwd", "/etc/sudoers")
+    or (process.name: "getent" and process.args:("passwd", "group"))
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Sub-technique:
+** Name: Domain Groups
+** ID: T1069.002
+** Reference URL: https://attack.mitre.org/techniques/T1069/002/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
index edb406066b..b581885b31 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
@@ -5,71 +5,68 @@ Identifies an attempt to reset a potentially privileged account password remotel
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724
 * https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
 * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Credential%20Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 101 (<<account-password-reset-remotely-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate remote account administration.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where
-event.action == "logged-in" and /* event 4624 need to be logged */
-winlog.logon.type : "Network" and event.outcome == "success" and
-source.ip != null and source.ip != "127.0.0.1" and source.ip !=
-"::1"] by winlog.event_data.TargetLogonId /* event 4724 need to be
-logged */ [iam where event.action == "reset-password" and (
-/* This rule is very noisy if not scoped to privileged
-accounts, duplicate the rule and add your own naming convention
-and accounts of interest here. */
-winlog.event_data.TargetUserName: ("*Admin*", "*super*", "*SVC*",
-"*DC0*", "*service*", "*DMZ*", "*ADM*") or
-winlog.event_data.TargetSid : ("S-1-5-21-*-500", "S-1-12-1-*-500")
-) ] by winlog.event_data.SubjectLogonId
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name with maxspan=5m
+  [authentication where event.action == "logged-in" and
+    /* event 4624 need to be logged */
+    winlog.logon.type : "Network" and event.outcome == "success" and source.ip != null and
+    source.ip != "127.0.0.1" and source.ip != "::1"] by winlog.event_data.TargetLogonId
+   /* event 4724 need to be logged */
+  [iam where event.action == "reset-password" and
+   (
+    /*
+       This rule is very noisy if not scoped to privileged accounts, duplicate the
+       rule and add your own naming convention and accounts of interest here.
+     */
+    winlog.event_data.TargetUserName: ("*Admin*", "*super*", "*SVC*", "*DC0*", "*service*", "*DMZ*", "*ADM*") or
+    winlog.event_data.TargetSid : ("S-1-5-21-*-500", "S-1-12-1-*-500")
+    )
+  ] by winlog.event_data.SubjectLogonId
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,61 +78,3 @@ winlog.event_data.TargetSid : ("S-1-5-21-*-500", "S-1-12-1-*-500")
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[account-password-reset-remotely-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where
-event.action == "logged-in" and /* event 4624 need to be logged */
-winlog.logon.type : "Network" and event.outcome == "success" and
-source.ip != null and source.ip != "127.0.0.1" and source.ip !=
-"::1"] by winlog.event_data.TargetLogonId /* event 4724 need to be
-logged */ [iam where event.action == "reset-password" and (
-/* This rule is very noisy if not scoped to privileged
-accounts, duplicate the rule and add your own naming convention
-and accounts of interest here. */
-winlog.event_data.TargetUserName: ("*Admin*", "*super*", "*SVC*",
-"*DC0*", "*service*", "*DMZ*", "*ADM*") or
-winlog.event_data.TargetSid : "S-1-5-21-*-500" ) ] by
-winlog.event_data.SubjectLogonId
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where
-event.action == "logged-in" and /* event 4624 need to be logged */
-winlog.logon.type : "Network" and event.outcome == "success" and
-source.ip != null and source.ip != "127.0.0.1" and source.ip !=
-"::1"] by winlog.event_data.TargetLogonId /* event 4724 need to be
-logged */ [iam where event.action == "reset-password"] by
-winlog.event_data.SubjectLogonId
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where
-event.action == "logged-in" and /* event 4624 need to be logged */
-winlog.logon.type : "Network" and event.outcome == "success" and
-source.ip != null and not source.ip in ("127.0.0.1", "::1")] by
-winlog.event_data.TargetLogonId /* event 4724 need to be logged */
-[iam where event.action == "reset-password"] by
-winlog.event_data.SubjectLogonId
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index 46a504be3a..ae13196bc0 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -16,50 +16,105 @@ Adversaries can add the 'hidden' attribute to files to hide them from the user i
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<adding-hidden-file-attribute-via-attrib-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Adding Hidden File Attribute via Attrib
+
+The `Hidden` attribute is a file or folder attribute that makes the file or folder invisible to regular directory listings when the attribute is set.
+
+Attackers can use this attribute to conceal tooling and malware to prevent administrators and users from finding it, even if they are looking specifically for it.
+
+This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to identify the target file or folder.
+  - Examine the file, which process created it, header, etc.
+  - If suspicious, retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "attrib.exe"
-and process.args : "+h"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "attrib.exe" or process.pe.original_file_name == "ATTRIB.EXE") and process.args : "+h" and
+  not
+  (process.parent.name: "cmd.exe" and
+    process.command_line: "attrib  +R +H +S +A *.cui" and
+    process.parent.command_line: "?:\\WINDOWS\\system32\\cmd.exe /c \"?:\\WINDOWS\\system32\\*.bat\"")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -71,76 +126,11 @@ and process.args : "+h"
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[adding-hidden-file-attribute-via-attrib-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "attrib.exe" and process.args : "+h"
-----------------------------------
-
-Version 15 (8.4.0 release)::
-* Formatting only
-
-Version 13 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:attrib.exe and process.args:+h
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:attrib.exe and process.args:+h
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"attrib.exe" and process.args:"+h"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
index ede9845877..785016ba8c 100644
--- a/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
@@ -5,7 +5,7 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,13 +16,13 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * http://www.joeware.net/freetools/tools/adfind/
 * https://thedfirreport.com/2020/05/08/adfind-recon/
@@ -31,45 +31,38 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 * https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
 * https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<adfind-command-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AdFind Command Activity
 
-[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information
-from Active Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same
-ways they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects
-and understand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/) of
-this tool being adopted by ransomware and criminal groups and used in compromises.
+[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from Active Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and understand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/) of this tool being adopted by ransomware and criminal groups and used in compromises.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Examine the command line to determine what information was retrieved by the tool.
 - Contact the account owner and confirm whether they are aware of this activity.
@@ -78,10 +71,8 @@ for prevalence, whether they are located in expected locations, and if they are
 ### False positive analysis
 
 - This rule has a high chance to produce false positives as it is a legitimate tool used by network administrators.
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination
-of user and command line conditions.
-- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in
-isolation, so reviewing previous logs/activity from impacted machines can be very telling.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in isolation, so reviewing previous logs/activity from impacted machines can be very telling.
 
 ### Related rules
 
@@ -93,36 +84,28 @@ isolation, so reviewing previous logs/activity from impacted machines can be ver
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "AdFind.exe"
-or process.pe.original_file_name == "AdFind.exe") and process.args :
-("objectcategory=computer", "(objectcategory=computer)",
-"objectcategory=person", "(objectcategory=person)",
-"objectcategory=subnet", "(objectcategory=subnet)",
-"objectcategory=group", "(objectcategory=group)",
-"objectcategory=organizationalunit",
-"(objectcategory=organizationalunit)",
-"objectcategory=attributeschema", "(objectcategory=attributeschema)",
-"domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd",
-"trustdmp")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "AdFind.exe" or process.pe.original_file_name == "AdFind.exe") and
+  process.args : ("objectcategory=computer", "(objectcategory=computer)",
+                  "objectcategory=person", "(objectcategory=person)",
+                  "objectcategory=subnet", "(objectcategory=subnet)",
+                  "objectcategory=group", "(objectcategory=group)",
+                  "objectcategory=organizationalunit", "(objectcategory=organizationalunit)",
+                  "objectcategory=attributeschema", "(objectcategory=attributeschema)",
+                  "domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd", "trustdmp")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -134,69 +117,23 @@ or process.pe.original_file_name == "AdFind.exe") and process.args :
 ** Name: Remote System Discovery
 ** ID: T1018
 ** Reference URL: https://attack.mitre.org/techniques/T1018/
-
-[[adfind-command-activity-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "AdFind.exe" or process.pe.original_file_name ==
-"AdFind.exe") and process.args : ("objectcategory=computer",
-"(objectcategory=computer)",
-"objectcategory=person", "(objectcategory=person)",
-"objectcategory=subnet", "(objectcategory=subnet)",
-"objectcategory=group", "(objectcategory=group)",
-"objectcategory=organizationalunit",
-"(objectcategory=organizationalunit)",
-"objectcategory=attributeschema", "(objectcategory=attributeschema)",
-"domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd",
-"trustdmp")
-----------------------------------
-
-Version 10 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "AdFind.exe" or process.pe.original_file_name ==
-"AdFind.exe") and process.args : ("objectcategory=computer",
-"(objectcategory=computer)",
-"objectcategory=person", "(objectcategory=person)",
-"objectcategory=subnet", "(objectcategory=subnet)",
-"objectcategory=group", "(objectcategory=group)",
-"objectcategory=organizationalunit",
-"(objectcategory=organizationalunit)",
-"objectcategory=attributeschema", "(objectcategory=attributeschema)",
-"domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd",
-"trustdmp")
-----------------------------------
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Domain Groups
+** ID: T1069.002
+** Reference URL: https://attack.mitre.org/techniques/T1069/002/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
diff --git a/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc
index 4154fe61c5..9b8885aa5e 100644
--- a/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc
@@ -5,7 +5,7 @@ Detects when an administrator role is assigned to an Okta group. An adversary ma
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,60 +14,50 @@ Detects when an administrator role is assigned to an Okta group. An adversary ma
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/administrators-admin-comparison.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<administrator-privileges-assigned-to-an-okta-group-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Administrator roles may be assigned to Okta users by a Super Admin user. Verify that the behavior was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:group.privilege.grant
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,36 +69,3 @@ event.dataset:okta.system and event.action:group.privilege.grant
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[administrator-privileges-assigned-to-an-okta-group-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Administrator Privileges Assigned to Okta Group
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:group.privilege.grant
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc
index bfdc18880c..82a7e4f858 100644
--- a/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc
@@ -5,7 +5,7 @@ Identifies when an administrator role is assigned to an Okta user. An adversary
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,60 +14,50 @@ Identifies when an administrator role is assigned to an Okta user. An adversary
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/administrators-admin-comparison.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Okta
-* SecOps
-* Monitoring
-* Continuous Monitoring
-
-*Version*: 102 (<<administrator-role-assigned-to-an-okta-user-history, version history>>)
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Administrator roles may be assigned to Okta users by a Super Admin user. Verify that the behavior was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:user.account.privilege.grant
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:user.account.privilege.grant
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,25 +69,3 @@ event.action:user.account.privilege.grant
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[administrator-role-assigned-to-an-okta-user-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/adminsdholder-backdoor.asciidoc b/docs/detections/prebuilt-rules/rule-details/adminsdholder-backdoor.asciidoc
index f1a7235e00..42e3a3838c 100644
--- a/docs/detections/prebuilt-rules/rule-details/adminsdholder-backdoor.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adminsdholder-backdoor.asciidoc
@@ -5,55 +5,54 @@ Detects modifications in the AdminSDHolder object. Attackers can abuse the SDPro
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://adsecurity.org/?p=1906
 * https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#adminsdholder
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Active Directory
-
-*Version*: 100 (<<adminsdholder-backdoor-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.action:"Directory Service Changes" and event.code:5136 and
-winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
-----------------------------------
+  winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -61,16 +60,3 @@ winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[adminsdholder-backdoor-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc b/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc
index 6b95d7ed48..80db9b226f 100644
--- a/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc
@@ -5,71 +5,64 @@ Identifies a modification on the dsHeuristics attribute on the bit that holds th
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dsheuristics_bad
 * https://petri.com/active-directory-security-understanding-adminsdholder-object
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<adminsdholder-sdprop-exclusion-added-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AdminSDHolder SDProp Exclusion Added
 
-The SDProp process compares the permissions on protected objects with those defined on the AdminSDHolder object. If the
-permissions on any of the protected accounts and groups do not match, it resets the permissions on the protected
-accounts and groups to match those defined in the domain AdminSDHolder object.
+The SDProp process compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, it resets the permissions on the protected accounts and groups to match those defined in the domain AdminSDHolder object.
 
-The dSHeuristics is a Unicode string attribute, in which each character in the string represents a heuristic that is
-used to determine the behavior of Active Directory.
+The dSHeuristics is a Unicode string attribute, in which each character in the string represents a heuristic that is used to determine the behavior of Active Directory.
 
-Administrators can use the dSHeuristics attribute to exclude privilege groups from the SDProp process by setting the
-16th bit (dwAdminSDExMask) of the string to a certain value, which represents the group(s):
+Administrators can use the dSHeuristics attribute to exclude privilege groups from the SDProp process by setting the 16th bit (dwAdminSDExMask) of the string to a certain value, which represents the group(s):
 
-* For example, to exclude the Account Operators group, an administrator would modify the string, so the 16th character
-is set to 1 (i.e., 0000000001000001).
+- For example, to exclude the Account Operators group, an administrator would modify the string, so the 16th character is set to 1 (i.e., 0000000001000001).
 
-The usage of this exclusion can leave the accounts unprotected and facilitate the misconfiguration of privileges for the
-excluded groups, enabling attackers to add accounts to these groups to maintain long-term persistence with high
-privileges.
+The usage of this exclusion can leave the accounts unprotected and facilitate the misconfiguration of privileges for the excluded groups, enabling attackers to add accounts to these groups to maintain long-term persistence with high privileges.
 
 This rule matches changes of the dsHeuristics object where the 16th bit is set to a value other than zero.
 
@@ -83,34 +76,30 @@ This rule matches changes of the dsHeuristics object where the 16th bit is set t
     - Server Operators eq 2
     - Print Operators eq 4
     - Backup Operators eq 8
-    The field value can range from 0 to f (15). If more than one group is specified, the values will be summed together;
-    for example, Backup Operators and Print Operators will set the `c` value on the bit.
+    The field value can range from 0 to f (15). If more than one group is specified, the values will be summed together; for example, Backup Operators and Print Operators will set the `c` value on the bit.
 
 ### False positive analysis
 
-- While this modification can be done legitimately, it is not a best practice. Any potential benign true positive (B-TP)
-should be mapped and reviewed by the security team for alternatives as this weakens the security of the privileged group.
+- While this modification can be done legitimately, it is not a best practice. Any potential benign true positive (B-TP) should be mapped and reviewed by the security team for alternatives as this weakens the security of the privileged group.
 
 ### Response and remediation
 
 - The change can be reverted by setting the dwAdminSDExMask (16th bit) to 0 in dSHeuristics.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where event.action == "Directory Service Changes" and event.code
-== "5136" and winlog.event_data.AttributeLDAPDisplayName :
-"dSHeuristics" and length(winlog.event_data.AttributeValue) > 15 and
-winlog.event_data.AttributeValue regex~ "[0-9]{15}([1-9a-f]).*"
+[source, js]
 ----------------------------------
+any where event.action == "Directory Service Changes" and
+  event.code == "5136" and
+  winlog.event_data.AttributeLDAPDisplayName : "dSHeuristics" and
+  length(winlog.event_data.AttributeValue) > 15 and
+  winlog.event_data.AttributeValue regex~ "[0-9]{15}([1-9a-f]).*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,26 +107,3 @@ winlog.event_data.AttributeValue regex~ "[0-9]{15}([1-9a-f]).*"
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[adminsdholder-sdprop-exclusion-added-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-any where event.action == "Directory Service Changes" and event.code
-== "5136" and length(winlog.event_data.AttributeValue) > 15 and
-winlog.event_data.AttributeValue regex~ "[0-9]{15}([1-9a-f]).*"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index 398558d659..5cc861738d 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -10,12 +10,13 @@ Detects writing executable files that will be automatically launched by Adobe on
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,61 +28,56 @@ Detects writing executable files that will be automatically launched by Adobe on
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<adobe-hijack-persistence-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Adobe Hijack Persistence
 
-Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched
-whenever Adobe Acrobat Reader is executed.
+Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -95,33 +91,25 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "creation" and file.path : ("?:\\Program
-Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
-"?:\\Program Files\\Adobe\\Acrobat Reader
-DC\\Reader\\AcroCEF\\RdrCEF.exe") and not process.name :
-"msiexec.exe"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+  file.path : ("?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
+               "?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe") and
+  not process.name : "msiexec.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,70 +121,7 @@ DC\\Reader\\AcroCEF\\RdrCEF.exe") and not process.name :
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[adobe-hijack-persistence-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 11 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:creation and file.path:("C:\Program
-Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" or
-"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe")
-and not process.name:msiexec.exe
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file.path:("C:\Program Files (x86)\Adobe\Acrobat Reader
-DC\Reader\AcroCEF\RdrCEF.exe" or "C:\Program Files\Adobe\Acrobat
-Reader DC\Reader\AcroCEF\RdrCEF.exe") and event.action:"File created
-(rule: FileCreate)" and not process.name:msiexec.exe
-----------------------------------
-
-Version 2 (7.6.2 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file.path:("C:\Program Files (x86)\Adobe\Acrobat Reader
-DC\Reader\AcroCEF\RdrCEF.exe" or "C:\Program Files\Adobe\Acrobat
-Reader DC\Reader\AcroCEF\RdrCEF.exe") and event.action:"File created
-(rule: FileCreate)" and not process.name:msiexeec.exe
-----------------------------------
-
+* Sub-technique:
+** Name: Services File Permissions Weakness
+** ID: T1574.010
+** Reference URL: https://attack.mitre.org/techniques/T1574/010/
diff --git a/docs/detections/prebuilt-rules/rule-details/adversary-behavior-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/adversary-behavior-detected-elastic-endgame.asciidoc
index 707b4b560c..1f43cca428 100644
--- a/docs/detections/prebuilt-rules/rule-details/adversary-behavior-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adversary-behavior-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon i
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,75 +13,32 @@ Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon i
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<adversary-behavior-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-(event.action:behavior_protection_event or
-endgame.event_subtype_full:behavior_protection_event)
-----------------------------------
 
+==== Rule query
 
-[[adversary-behavior-detected-elastic-endgame-history]]
-==== Rule version history
 
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.kind:alert and event.module:endgame and
-(event.action:rules_engine_event or
-endgame.event_subtype_full:rules_engine_event)
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
+event.kind:alert and event.module:endgame and (event.action:behavior_protection_event or endgame.event_subtype_full:behavior_protection_event)
 
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Adversary Behavior - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Adversary Behavior - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Adversary Behavior - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
 ----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:rules_engine_event
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/agent-spoofing-mismatched-agent-id.asciidoc b/docs/detections/prebuilt-rules/rule-details/agent-spoofing-mismatched-agent-id.asciidoc
index 8ebe94d572..773f386d75 100644
--- a/docs/detections/prebuilt-rules/rule-details/agent-spoofing-mismatched-agent-id.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/agent-spoofing-mismatched-agent-id.asciidoc
@@ -5,7 +5,7 @@ Detects events that have a mismatch on the expected event agent ID. The status "
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-*
 * metrics-*
@@ -15,41 +15,36 @@ Detects events that have a mismatch on the expected event agent ID. The status "
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<agent-spoofing-mismatched-agent-id-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the necessary field, resulting in false positives.
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.agent_id_status:agent_id_mismatch
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -61,19 +56,3 @@ event.agent_id_status:agent_id_mismatch
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[agent-spoofing-mismatched-agent-id-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/agent-spoofing-multiple-hosts-using-same-agent.asciidoc b/docs/detections/prebuilt-rules/rule-details/agent-spoofing-multiple-hosts-using-same-agent.asciidoc
index d2658fbb4a..519b95923d 100644
--- a/docs/detections/prebuilt-rules/rule-details/agent-spoofing-multiple-hosts-using-same-agent.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/agent-spoofing-multiple-hosts-using-same-agent.asciidoc
@@ -5,7 +5,7 @@ Detects when multiple hosts are using the same agent ID. This could occur in the
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-*
 * metrics-*
@@ -15,41 +15,36 @@ Detects when multiple hosts are using the same agent ID. This could occur in the
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<agent-spoofing-multiple-hosts-using-same-agent-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the necessary field, resulting in false positives.
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.agent_id_status:*
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -61,16 +56,3 @@ event.agent_id_status:*
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[agent-spoofing-multiple-hosts-using-same-agent-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-linux-compiler-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-linux-compiler-activity.asciidoc
index 15b8f1d04c..40460cebf7 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-linux-compiler-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-linux-compiler-activity.asciidoc
@@ -5,44 +5,37 @@ Looks for compiler activity by a user context which does not normally run compil
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_rare_user_compiler
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-* Resource Development
+*Tags*: 
 
-*Version*: 100 (<<anomalous-linux-compiler-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Resource Development
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon compiler activity can be due to an engineer running a local build on a production or staging instance in the course of troubleshooting or fixing a software issue.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -54,22 +47,7 @@ Uncommon compiler activity can be due to an engineer running a local build on a
 ** Name: Obtain Capabilities
 ** ID: T1588
 ** Reference URL: https://attack.mitre.org/techniques/T1588/
-
-[[anomalous-linux-compiler-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (7.15.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Malware
+** ID: T1588.001
+** Reference URL: https://attack.mitre.org/techniques/T1588/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc
index f6f378cd80..6324110d62 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc
@@ -5,63 +5,84 @@ Searches for rare processes running on multiple Linux hosts in an entire fleet o
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_anomalous_process_all_hosts
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<anomalous-process-for-a-linux-population-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-### Investigating an Unusual Linux Process
-Detection alerts from this rule indicate the presence of a Linux process that is rare and unusual for all of the monitored Linux hosts for which Auditbeat data is available. Here are some possible avenues of investigation:
-- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?
-- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.
-- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
-----------------------------------
+### Investigating Anomalous Process For a Linux Population
+
+Searching for abnormal Linux processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
+
+This rule uses a machine learning job to detect a Linux process that is rare and unusual for all of the monitored Linux hosts in your fleet.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, and whether they are located in expected locations.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
+- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
+
+### False Positive Analysis
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+### Response and Remediation
 
-==== Threat mapping
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that   attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,34 +94,7 @@ Detection alerts from this rule indicate the presence of a Linux process that is
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[anomalous-process-for-a-linux-population-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
index 48f087013f..d2c22dff8c 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
@@ -5,16 +5,13 @@ Searches for rare processes running on multiple hosts in an entire fleet or netw
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_process_all_hosts
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -26,45 +23,90 @@ Searches for rare processes running on multiple hosts in an entire fleet or netw
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Persistence
-
-*Version*: 100 (<<anomalous-process-for-a-windows-population-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-### Investigating an Unusual Windows Process
-Detection alerts from this rule indicate the presence of a Windows process that is rare and unusual for all of the Windows hosts for which Winlogbeat data is available. Here are some possible avenues of investigation:
-- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?
-- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.
-- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.
-- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
-- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
-- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. 
-----------------------------------
+###  Investigating Anomalous Process For a Windows Population
+
+Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
+
+This rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
+  - Investigate the process metadata — such as the digital signature, directory, etc. — to obtain more context that can indicate whether the executable is associated with an expected software vendor or package.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
+- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSyste' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Retrieve Service Unisgned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False Positive Analysis
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+### Related Rules
+
+- Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76
+- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
+- Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b
+
+### Response and Remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,34 +118,15 @@ Detection alerts from this rule indicate the presence of a Windows process that
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[anomalous-process-for-a-windows-population-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
index c8cabd8853..6fddbc10c3 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
@@ -5,16 +5,13 @@ Identifies unusual parent-child process relationships that can indicate malware
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_process_creation
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -26,60 +23,98 @@ Identifies unusual parent-child process relationships that can indicate malware
 
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 104
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Persistence
 
-*Version*: 100 (<<anomalous-windows-process-creation-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.7.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
 
-==== Potential false positives
+###  Investigating Anomalous Windows Process Creation
 
-Users running scripts in the course of technical support operations of software upgrades could trigger this alert. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
-==== Threat mapping
+Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
-*Framework*: MITRE ATT&CK^TM^
+This rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.
 
-* Tactic:
-** Name: Persistence
-** ID: TA0003
-** Reference URL: https://attack.mitre.org/tactics/TA0003/
-* Technique:
-** Name: Create or Modify System Process
-** ID: T1543
-** Reference URL: https://attack.mitre.org/techniques/T1543/
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
-[[anomalous-windows-process-creation-history]]
-==== Rule version history
+#### Possible investigation steps
 
-Version 100 (8.5.0 release)::
-* Formatting only
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
+  - Investigate the process metadata — such as the digital signature, directory, etc. — to obtain more context that can indicate whether the executable is associated with an expected software vendor or package.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
+- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Retrieve Service Unisgned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-Version 7 (8.4.0 release)::
-* Formatting only
+### False Positive Analysis
 
-Version 6 (8.3.0 release)::
-* Formatting only
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-Version 5 (7.14.0 release)::
-* Formatting only
+### Related Rules
 
-Version 4 (7.12.0 release)::
-* Formatting only
+- Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76
+- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
+- Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b
 
-Version 3 (7.10.0 release)::
-* Formatting only
+### Response and Remediation
 
-Version 2 (7.9.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
diff --git a/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
index 5150f20762..3ae3216051 100644
--- a/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
@@ -5,7 +5,7 @@ Detects execution via the Apple script interpreter (osascript) followed by a net
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,49 @@ Detects execution via the Apple script interpreter (osascript) followed by a net
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Command and Control
-* Execution
-
-*Version*: 100 (<<apple-script-execution-followed-by-network-connection-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=30s [process
-where event.type == "start" and process.name == "osascript"] [network
-where event.type != "end" and process.name == "osascript" and
-destination.ip != "::1" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
-"192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
-"192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
-"198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4",
-"::1", "FE80::/10", "FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id with maxspan=30s
+ [process where host.os.type == "macos" and event.type == "start" and process.name == "osascript"]
+ [network where host.os.type == "macos" and event.type != "end" and process.name == "osascript" and destination.ip != "::1" and
+  not cidrmatch(destination.ip,
+    "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
+    "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
+    "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,8 +68,10 @@ destination.ip != "::1" and not cidrmatch(destination.ip,
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
+* Sub-technique:
+** Name: AppleScript
+** ID: T1059.002
+** Reference URL: https://attack.mitre.org/techniques/T1059/002/
 * Tactic:
 ** Name: Command and Control
 ** ID: TA0011
@@ -84,31 +80,3 @@ destination.ip != "::1" and not cidrmatch(destination.ip,
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[apple-script-execution-followed-by-network-connection-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=30s [process
-where event.type == "start" and process.name == "osascript"] [network
-where event.type != "end" and process.name == "osascript" and
-destination.ip != "::1" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "172.16.0.0/12",
-"192.168.0.0/16", "127.0.0.0/8",
-"169.254.0.0/16", "224.0.0.0/4",
-"FE80::/10", "FF00::/8") ]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc b/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
index 5be1d5e28c..e80e267788 100644
--- a/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
@@ -5,7 +5,7 @@ Identifies execution of the Apple script interpreter (osascript) without a passw
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,50 @@ Identifies execution of the Apple script interpreter (osascript) without a passw
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://discussions.apple.com/thread/2266150
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Execution
-* Privilege Escalation
-
-*Version*: 100 (<<apple-scripting-execution-with-administrator-privileges-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "osascript" and process.command_line :
-"osascript*with administrator privileges"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
+  process.command_line : "osascript*with administrator privileges"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,8 +69,6 @@ process.name : "osascript" and process.command_line :
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -84,16 +77,3 @@ process.name : "osascript" and process.command_line :
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[apple-scripting-execution-with-administrator-privileges-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc
index 7896ab45cf..9f0afe0333 100644
--- a/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc
@@ -5,7 +5,7 @@ Detects when a Google marketplace application is added to the Google Workspace d
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,83 @@ Detects when a Google marketplace application is added to the Google Workspace d
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/6328701?hl=en#
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Persistence
-
-*Version*: 101 (<<application-added-to-google-workspace-domain-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Applications can be added to a Google Workspace domain by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Application Added to Google Workspace Domain
+
+Google Workspace Marketplace is an online store for free and paid web applications that work with Google Workspace services and third-party software. Listed applications are based on Google APIs or on Google Apps Script and created by both Google and third-party developers.
+
+Marketplace applications require access to specific Google Workspace resources. Applications can be installed by individual users, if they have permission, or can be installed for an entire Google Workspace domain by administrators. Consent screens typically display what permissions and privileges the application requires during installation. As a result, malicious Marketplace applications may require more permissions than necessary or have malicious intent.
+
+Google clearly states that they are not responsible for any product on the Marketplace that originates from a source other than Google.
+
+This rule checks for applications that were manually added to the Marketplace by a Google Workspace account.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- This rule relies on data from `google_workspace.admin`, thus indicating the associated user has administrative privileges to the Marketplace.
+- With access to the Google Workspace admin console, visit the `Security > Investigation tool` with filters for the user email and event is `Assign Role` or `Update Role` to determine if new cloud roles were recently updated.
+- With the user account, review other potentially related events within the last 48 hours.
+- Re-assess the permissions and reviews of the Marketplace applications to determine if they violate organizational policies or introduce unexpected risks.
+- With access to the Google Workspace admin console, determine if the application was installed domain-wide or individually by visiting `Apps > Google Workspace Marketplace Apps`.
+
+### False positive analysis
+
+- Google Workspace administrators might intentionally remove an application from the blocklist due to a re-assessment or a domain-wide required need for the application.
+- Identify the user account associated with this action and assess their administrative privileges with Google Workspace Marketplace.
+- Contact the user to verify that they intentionally removed the application from the blocklist and their reasoning.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,17 +101,14 @@ Applications can be added to a Google Workspace domain by system administrators.
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:ADD_APPLICATION
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:ADD_APPLICATION
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,44 +116,3 @@ event.category:iam and event.action:ADD_APPLICATION
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[application-added-to-google-workspace-domain-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:ADD_APPLICATION
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc b/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc
index 9557092ec7..dda82739b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc
@@ -5,7 +5,7 @@ Google Workspace administrators may be aware of malicious applications within th
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,83 @@ Google Workspace administrators may be aware of malicious applications within th
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/6328701?hl=en#
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Impair Defenses
-
-*Version*: 2 (<<application-removed-from-blocklist-in-google-workspace-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Applications can be added and removed from blocklists by Google Workspace administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Application Removed from Blocklist in Google Workspace
+
+Google Workspace Marketplace is an online store for free and paid web applications that work with Google Workspace services and third-party software. Listed applications are based on Google APIs or Google Apps Script and created by both Google and third-party developers.
+
+Marketplace applications require access to specific Google Workspace resources. Individual users with the appropriate permissions can install applications in their Google Workspace domain. Administrators have additional permissions that allow them to install applications for an entire Google Workspace domain. Consent screens typically display permissions and privileges the user needs to install an application. As a result, malicious Marketplace applications may require more permissions than necessary or have malicious intent.
+
+Google clearly states that they are not responsible for any Marketplace product that originates from a source that isn't Google.
+
+This rule identifies a Marketplace blocklist update that consists of a Google Workspace account with administrative privileges manually removing a previously blocked application.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- This rule relies on data from `google_workspace.admin`, thus indicating the associated user has administrative privileges to the Marketplace.
+- With access to the Google Workspace admin console, visit the `Security > Investigation` tool with filters for the user email and event is `Assign Role` or `Update Role` to determine if new cloud roles were recently updated.
+- After identifying the involved user account, review other potentially related events within the last 48 hours.
+- Re-assess the permissions and reviews of the Marketplace applications to determine if they violate organizational policies or introduce unexpected risks.
+- With access to the Google Workspace admin console, determine if the application was installed domain-wide or individually by visiting `Apps > Google Workspace Marketplace Apps`.
+
+### False positive analysis
+
+- Google Workspace administrators might intentionally remove an application from the blocklist due to a re-assessment or a domain-wide required need for the application.
+- Identify the user account associated with this action and assess their administrative privileges with Google Workspace Marketplace.
+- Contact the user to verify that they intentionally removed the application from the blocklist and their reasoning.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,20 +101,17 @@ Applications can be added and removed from blocklists by Google Workspace admini
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and event.category:"iam" and
-event.type:"change" and event.action:"CHANGE_APPLICATION_SETTING"
-and google_workspace.admin.application.name:"Google Workspace
-Marketplace" and google_workspace.admin.old_value: *allowed*false*
-and google_workspace.admin.new_value: *allowed*true*
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.category:"iam" and event.type:"change"  and
+  event.action:"CHANGE_APPLICATION_SETTING" and
+  google_workspace.admin.application.name:"Google Workspace Marketplace" and
+  google_workspace.admin.old_value: *allowed*false* and google_workspace.admin.new_value: *allowed*true*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -88,10 +123,7 @@ and google_workspace.admin.new_value: *allowed*true*
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[application-removed-from-blocklist-in-google-workspace-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc
index 868dc54142..a47e9899cc 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to create an Okta API token. An adversary may create an Okta AP
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,59 +14,49 @@ Detects attempts to create an Okta API token. An adversary may create an Okta AP
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<attempt-to-create-okta-api-token-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If the behavior of creating Okta API tokens is expected, consider adding exceptions to this rule to filter false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:system.api_token.create
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,37 +68,3 @@ event.dataset:okta.system and event.action:system.api_token.create
 ** Name: Create Account
 ** ID: T1136
 ** Reference URL: https://attack.mitre.org/techniques/T1136/
-
-[[attempt-to-create-okta-api-token-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:system.api_token.create
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc
index fbb83637ee..eb59d6169e 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to deactivate an Okta application. An adversary may attempt to
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,62 +14,75 @@ Detects attempts to deactivate an Okta application. An adversary may attempt to
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Apps.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Impact
-
-*Version*: 102 (<<attempt-to-deactivate-an-okta-application-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if your organization's Okta applications are regularly deactivated and the behavior is expected.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Attempt to Deactivate an Okta Application
+
+This rule detects attempts to deactivate an Okta application. Unauthorized deactivation could lead to disruption of services and pose a significant risk to the organization.
+
+#### Possible investigation steps:
+- Identify the actor associated with the deactivation attempt by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Understand the context of the event from the `okta.debug_context.debug_data` and `okta.authentication_context` fields.
+- Check the `okta.outcome.result` and `okta.outcome.reason` fields to see if the attempt was successful or failed.
+- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
+- Analyze the `okta.transaction.id` and `okta.transaction.type` fields to understand the context of the transaction.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- It might be a false positive if the action was part of a planned activity, performed by an authorized person, or if the `okta.outcome.result` field shows a failure.
+- An unsuccessful attempt might also indicate an authorized user having trouble rather than a malicious activity.
+
+### Response and remediation:
+- If unauthorized deactivation attempts are confirmed, initiate the incident response process.
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Reset the user's password and enforce MFA re-enrollment, if applicable.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the deactivated application was crucial for business operations, coordinate with the relevant team to reactivate it and minimize the impact.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:application.lifecycle.deactivate
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:application.lifecycle.deactivate
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,25 +94,3 @@ event.action:application.lifecycle.deactivate
 ** Name: Service Stop
 ** ID: T1489
 ** Reference URL: https://attack.mitre.org/techniques/T1489/
-
-[[attempt-to-deactivate-an-okta-application-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc
index 3e994e73fd..21a894e7a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to deactivate an Okta network zone. Okta network zones can be c
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,78 @@ Detects attempts to deactivate an Okta network zone. Okta network zones can be c
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Network Security
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-deactivate-an-okta-network-zone-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if your organization's Okta network zones are regularly modified.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Deactivate an Okta Network Zone
+
+The Okta network zones can be configured to restrict or limit access to a network based on IP addresses or geolocations. Deactivating a network zone in Okta may remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.
+
+#### Possible investigation steps
+
+- Identify the actor related to the alert by reviewing the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
+- Examine the `event.action` field to confirm the deactivation of a network zone.
+- Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the network zone that was deactivated.
+- Investigate the `event.time` field to understand when the event happened.
+- Review the actor's activities before and after the event to understand the context of this event.
+
+### False positive analysis
+
+- Check the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's normal behavior, it might be a false positive.
+- Check if the actor is a known administrator or part of the IT team who might have a legitimate reason to deactivate a network zone.
+- Verify the actor's actions with any known planned changes or maintenance activities.
+
+### Response and remediation
 
+- If unauthorized access or actions are confirmed, immediately lock the affected actor account and require a password change.
+- Re-enable the deactivated network zone if it was deactivated without authorization.
+- Review and update the privileges of the actor who initiated the deactivation.
+- Check the security policies and procedures to identify any gaps and update them as necessary.
+- Implement additional monitoring and logging of Okta events to improve visibility of user actions.
+- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:zone.deactivate
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,25 +97,7 @@ event.dataset:okta.system and event.action:zone.deactivate
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-deactivate-an-okta-network-zone-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc
index 2152c437b9..619601e427 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to deactivate a rule within an Okta policy. An adversary may at
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,86 @@ Detects attempts to deactivate a rule within an Okta policy. An adversary may at
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-deactivate-an-okta-policy-rule-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly deactivated in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Deactivate an Okta Policy Rule
+
+Identity and Access Management (IAM) systems like Okta serve as the first line of defense for an organization's network, and are often targeted by adversaries. By disabling security rules, adversaries can circumvent multi-factor authentication, access controls, or other protective measures enforced by these policies, enabling unauthorized access, privilege escalation, or other malicious activities.
+
+This rule detects attempts to deactivate a rule within an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. A threat actor may do this to remove barriers to their activities or enable future attacks.
 
+#### Possible investigation steps:
+
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the deactivation attempt.
+- Check the `okta.outcome.result` field to confirm the policy rule deactivation attempt.
+- Check if there are multiple policy rule deactivation attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the policy rule deactivation attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.
+
+### False positive analysis:
+
+- Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's administrative rights to ensure they are correctly configured.
+
+### Response and remediation:
+
+- If unauthorized policy rule deactivation is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific deactivation technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:policy.rule.deactivate
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,36 +105,7 @@ event.dataset:okta.system and event.action:policy.rule.deactivate
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-deactivate-an-okta-policy-rule-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Deactivate Okta MFA Rule
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:policy.rule.deactivate
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc
index b1710b9123..3e429cf978 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to deactivate an Okta policy. An adversary may attempt to deact
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,85 @@ Detects attempts to deactivate an Okta policy. An adversary may attempt to deact
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-deactivate-an-okta-policy-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If the behavior of deactivating Okta policies is expected, consider adding exceptions to this rule to filter false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Deactivate an Okta Policy
+
+Okta policies define rules to manage user access to resources. Policies such as multi-factor authentication (MFA) are critical for enforcing strong security measures. Deactivation of an Okta policy could potentially weaken the security posture, allowing for unauthorized access or facilitating other malicious activities.
+
+This rule is designed to detect attempts to deactivate an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. For example, disabling an MFA policy could lower the security of user authentication processes.
 
+#### Possible investigation steps:
+
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the deactivation attempt.
+- Check the `okta.outcome.result` field to confirm the policy deactivation attempt.
+- Check if there are multiple policy deactivation attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the policy deactivation attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.
+
+### False positive analysis:
+
+- Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's administrative rights to ensure they are correctly configured.
+
+### Response and remediation:
+
+- If unauthorized policy deactivation is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific deactivation technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:policy.lifecycle.deactivate
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,36 +104,7 @@ event.dataset:okta.system and event.action:policy.lifecycle.deactivate
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-deactivate-an-okta-policy-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Deactivate Okta Policy
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:policy.lifecycle.deactivate
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-mfa-for-an-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-mfa-for-an-okta-user-account.asciidoc
index cb043da9bb..90ad60474b 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-mfa-for-an-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-mfa-for-an-okta-user-account.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to deactivate multi-factor authentication (MFA) for an Okta use
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,59 +14,50 @@ Detects attempts to deactivate multi-factor authentication (MFA) for an Okta use
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<attempt-to-deactivate-mfa-for-an-okta-user-account-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If the behavior of deactivating MFA for Okta user accounts is expected, consider adding exceptions to this rule to filter false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:user.mfa.factor.deactivate
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,36 +69,3 @@ event.dataset:okta.system and event.action:user.mfa.factor.deactivate
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[attempt-to-deactivate-mfa-for-an-okta-user-account-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Deactivate MFA for Okta User Account
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:user.mfa.factor.deactivate
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc
index 737005516a..275dccc084 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to delete an Okta application. An adversary may attempt to modi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,49 @@ Detects attempts to delete an Okta application. An adversary may attempt to modi
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Impact
-
-*Version*: 102 (<<attempt-to-delete-an-okta-application-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if your organization's Okta applications are regularly deleted and the behavior is expected.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:application.lifecycle.delete
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:application.lifecycle.delete
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,25 +68,3 @@ event.action:application.lifecycle.delete
 ** Name: Service Stop
 ** ID: T1489
 ** Reference URL: https://attack.mitre.org/techniques/T1489/
-
-[[attempt-to-delete-an-okta-application-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc
index 20e49f705e..eb486a244a 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to delete an Okta network zone. Okta network zones can be confi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,78 @@ Detects attempts to delete an Okta network zone. Okta network zones can be confi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Network Security
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-delete-an-okta-network-zone-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are regularly deleted.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Delete an Okta Network Zone
+
+Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. Deleting a network zone in Okta might remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.
+
+#### Possible investigation steps:
+
+- Identify the actor associated with the alert by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
+- Examine the `event.action` field to confirm the deletion of a network zone.
+- Investigate the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` fields to identify the network zone that was deleted.
+- Review the `event.time` field to understand when the event happened.
+- Check the actor's activities before and after the event to understand the context of this event.
+
+### False positive analysis:
+
+- Verify the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's typical behavior, it might be a false positive.
+- Check if the actor is a known administrator or a member of the IT team who might have a legitimate reason to delete a network zone.
+- Cross-verify the actor's actions with any known planned changes or maintenance activities.
+
+### Response and remediation:
 
+- If unauthorized access or actions are confirmed, immediately lock the affected actor's account and require a password change.
+- If a network zone was deleted without authorization, create a new network zone with similar settings as the deleted one.
+- Review and update the privileges of the actor who initiated the deletion.
+- Identify any gaps in the security policies and procedures and update them as necessary.
+- Implement additional monitoring and logging of Okta events to improve visibility of user actions.
+- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:zone.delete
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,25 +97,7 @@ event.dataset:okta.system and event.action:zone.delete
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-delete-an-okta-network-zone-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc
index af20405ef0..4f78f40a86 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to delete a rule within an Okta policy. An adversary may attemp
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,85 @@ Detects attempts to delete a rule within an Okta policy. An adversary may attemp
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-delete-an-okta-policy-rule-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Delete an Okta Policy Rule
+
+Okta policy rules are integral components of an organization's security controls, as they define how user access to resources is managed. Deletion of a rule within an Okta policy could potentially weaken the organization's security posture, allowing for unauthorized access or facilitating other malicious activities.
 
+This rule detects attempts to delete an Okta policy rule, which could indicate an adversary's attempt to weaken an organization's security controls. Adversaries may do this to circumvent security measures and enable further malicious activities.
+
+#### Possible investigation steps:
+
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the deletion attempt.
+- Check the `okta.outcome.result` field to confirm the policy rule deletion attempt.
+- Check if there are multiple policy rule deletion attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the policy rule deletion attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.
+
+### False positive analysis:
+
+- Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deletion attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's administrative rights to ensure they are correctly configured.
+
+### Response and remediation:
+
+- If unauthorized policy rule deletion is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific deletion technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:policy.rule.delete
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,25 +104,7 @@ event.dataset:okta.system and event.action:policy.rule.delete
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-delete-an-okta-policy-rule-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc
index 6625545619..24da865f91 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to delete an Okta policy. An adversary may attempt to delete an
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,85 @@ Detects attempts to delete an Okta policy. An adversary may attempt to delete an
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-delete-an-okta-policy-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Okta policies are regularly deleted in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Delete an Okta Policy
+
+Okta policies are critical to managing user access and enforcing security controls within an organization. The deletion of an Okta policy could drastically weaken an organization's security posture by allowing unrestricted access or facilitating other malicious activities.
+
+This rule detects attempts to delete an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. Adversaries may do this to bypass security barriers and enable further malicious activities.
 
+#### Possible investigation steps:
+
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the deletion attempt.
+- Check the `okta.outcome.result` field to confirm the policy deletion attempt.
+- Check if there are multiple policy deletion attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the policy deletion attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.
+
+### False positive analysis:
+
+- Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deletion attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's administrative rights to ensure they are correctly configured.
+
+### Response and remediation:
+
+- If unauthorized policy deletion is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific deletion technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:policy.lifecycle.delete
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,36 +104,7 @@ event.dataset:okta.system and event.action:policy.lifecycle.delete
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-delete-an-okta-policy-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Delete Okta Policy
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:policy.lifecycle.delete
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
index 3cd2f2346c..6909d0df11 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security featur
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,45 +14,42 @@ Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security featur
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.apple.com/en-us/HT202491
 * https://community.carbonblack.com/t5/Threat-Advisories-Documents/TAU-TIN-Shlayer-OSX/ta-p/68397
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<attempt-to-disable-gatekeeper-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:(spctl and "--master-disable")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.args:(spctl and "--master-disable")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,22 +61,3 @@ process.args:(spctl and "--master-disable")
 ** Name: Subvert Trust Controls
 ** ID: T1553
 ** Reference URL: https://attack.mitre.org/techniques/T1553/
-
-[[attempt-to-disable-gatekeeper-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:(spctl and "--master-disable")
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc
new file mode 100644
index 0000000000..5478ac2f9f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc
@@ -0,0 +1,77 @@
+[[attempt-to-disable-iptables-or-firewall]]
+=== Attempt to Disable IPTables or Firewall
+
+Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+ (
+   /* disable FW */
+   (
+     (process.name == "ufw" and process.args == "disable") or
+     (process.name == "iptables" and process.args == "-F" and process.args_count == 2)
+   ) or
+
+   /* stop FW service */
+   (
+     ((process.name == "service" and process.args == "stop") or
+       (process.name == "chkconfig" and process.args == "off") or
+       (process.name == "systemctl" and process.args in ("disable", "stop", "kill"))) and
+    process.args in ("firewalld", "ip6tables", "iptables")
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc
index 5c5b086785..5f5125aa96 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc
@@ -3,54 +3,55 @@
 
 Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls.
 
-*Rule type*: query
+*Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<attempt-to-disable-syslog-service-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-((process.name:service and process.args:stop) or
-(process.name:chkconfig and process.args:off) or
-(process.name:systemctl and process.args:(disable or stop or kill)))
-and process.args:(syslog or rsyslog or "syslog-ng")
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and
+ ( (process.name == "service" and process.args == "stop") or
+   (process.name == "chkconfig" and process.args == "off") or
+   (process.name == "systemctl" and process.args in ("disable", "stop", "kill"))
+ ) and process.args in ("syslog", "rsyslog", "syslog-ng")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -62,39 +63,7 @@ and process.args:(syslog or rsyslog or "syslog-ng")
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-disable-syslog-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(executed or process_started) and ((process.name:service
-and process.args:stop) or (process.name:chkconfig and
-process.args:off) or (process.name:systemctl and process.args:(disable
-or stop or kill))) and process.args:(syslog or rsyslog or "syslog-ng")
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
index 6b77ccbed3..c9635d0973 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to enable the root account using the dsenableroot command. T
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,44 +14,41 @@ Identifies attempts to enable the root account using the dsenableroot command. T
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://ss64.com/osx/dsenableroot.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<attempt-to-enable-the-root-account-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:dsenableroot and not process.args:"-d"
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:dsenableroot and not process.args:"-d"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,13 +60,7 @@ process.name:dsenableroot and not process.args:"-d"
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[attempt-to-enable-the-root-account-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc
new file mode 100644
index 0000000000..950674b484
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc
@@ -0,0 +1,71 @@
+[[attempt-to-install-kali-linux-via-wsl]]
+=== Attempt to Install Kali Linux via WSL
+
+Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows/wsl/wsl-config
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+ (process.name : "wsl.exe" and process.args : ("-d", "--distribution", "-i", "--install") and process.args : "kali*") or 
+ process.executable : 
+        ("?:\\Users\\*\\AppData\\Local\\packages\\kalilinux*", 
+         "?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
+         "?:\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe")
+ )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
index fc9371c86a..669a794dac 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
@@ -5,7 +5,7 @@ Adversaries may install a root certificate on a compromised system to avoid warn
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,43 @@ Adversaries may install a root certificate on a compromised system to avoid warn
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://ss64.com/osx/security-cert.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<attempt-to-install-root-certificate-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain applications may install root certificates for the purpose of inspecting SSL traffic.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:security and process.args:"add-trusted-cert" and not pr
-ocess.parent.executable:("/Library/Bitdefender/AVP/product/bin/BDCoreI
-ssues" or "/Applications/Bitdefender/SecurityNetworkInstallerApp.app/C
-ontents/MacOS/SecurityNetworkInstallerApp" )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.name:security and process.args:"add-trusted-cert" and
+  not process.parent.executable:("/Library/Bitdefender/AVP/product/bin/BDCoreIssues" or "/Applications/Bitdefender/SecurityNetworkInstallerApp.app/Contents/MacOS/SecurityNetworkInstallerApp"
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,19 +62,7 @@ ontents/MacOS/SecurityNetworkInstallerApp" )
 ** Name: Subvert Trust Controls
 ** ID: T1553
 ** Reference URL: https://attack.mitre.org/techniques/T1553/
-
-[[attempt-to-install-root-certificate-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:security and process.args:"add-trusted-cert"
-----------------------------------
-
+* Sub-technique:
+** Name: Install Root Certificate
+** ID: T1553.004
+** Reference URL: https://attack.mitre.org/techniques/T1553/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc
index 42e0a5721d..6cb262cfd7 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to modify an Okta application. An adversary may attempt to modi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,62 +14,50 @@ Detects attempts to modify an Okta application. An adversary may attempt to modi
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Apps.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Impact
-
-*Version*: 102 (<<attempt-to-modify-an-okta-application-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if your organization's Okta applications are regularly modified and the behavior is expected.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:application.lifecycle.update
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:application.lifecycle.update
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,25 +65,3 @@ event.action:application.lifecycle.update
 ** Name: Impact
 ** ID: TA0040
 ** Reference URL: https://attack.mitre.org/tactics/TA0040/
-
-[[attempt-to-modify-an-okta-application-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc
index 13f2fe6e07..fd04a5df90 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to modify an Okta network zone. Okta network zones can be confi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,62 +14,84 @@ Detects attempts to modify an Okta network zone. Okta network zones can be confi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Network Security
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-modify-an-okta-network-zone-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are regularly modified.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Modify an Okta Network Zone
 
+The modification of an Okta network zone is a critical event as it could potentially allow an adversary to gain unrestricted access to your network. This rule detects attempts to modify, delete, or deactivate an Okta network zone, which may suggest an attempt to remove or weaken an organization's security controls.
 
-==== Rule query
+#### Possible investigation steps:
+
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the modification attempt.
+- Check the `okta.outcome.result` field to confirm the network zone modification attempt.
+- Check if there are multiple network zone modification attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the modification attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.
+
+### False positive analysis:
 
+- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's administrative rights to ensure they are correctly configured.
 
-[source,js]
+### Response and remediation:
+
+- If unauthorized modification is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-event.dataset:okta.system and event.action:(zone.update or
-network_zone.rule.disabled or zone.remove_blacklist)
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:(zone.update or network_zone.rule.disabled or zone.remove_blacklist)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,47 +103,7 @@ network_zone.rule.disabled or zone.remove_blacklist)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-modify-an-okta-network-zone-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Modify Okta Network Zone
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:okta.system and event.action:(zone.update or
-zone.deactivate or zone.delete or network_zone.rule.disabled or
-zone.remove_blacklist)
-----------------------------------
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:(zone.update or zone.deactivate or zone.delete or
-network_zone.rule.disabled or zone.remove_blacklist)
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc
index 0c8709564e..67a4deffe4 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to modify a rule within an Okta policy. An adversary may attemp
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,61 +14,84 @@ Detects attempts to modify a rule within an Okta policy. An adversary may attemp
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-modify-an-okta-policy-rule-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Modify an Okta Policy Rule
+
+The modification of an Okta policy rule can be an indication of malicious activity as it may aim to weaken an organization's security controls.
+
+#### Possible investigation steps:
+
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the modification attempt.
+- Check the `okta.outcome.result` field to confirm the rule modification attempt.
+- Check if there are multiple rule modification attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the modification attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.
 
+### False positive analysis:
+
+- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's administrative rights to ensure they are correctly configured.
+
+### Response and remediation:
+
+- If unauthorized modification is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:policy.rule.update
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,45 +103,7 @@ event.dataset:okta.system and event.action:policy.rule.update
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-modify-an-okta-policy-rule-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Modify Okta MFA Rule
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:okta.system and event.action:(policy.rule.update or
-policy.rule.delete)
-----------------------------------
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:(policy.rule.update or policy.rule.delete)
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc
index b714b8c9e0..d5f55ec794 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to modify an Okta policy. An adversary may attempt to modify an
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,60 +14,73 @@ Detects attempts to modify an Okta policy. An adversary may attempt to modify an
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Defense Evasion
-
-*Version*: 102 (<<attempt-to-modify-an-okta-policy-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if Okta policies are regularly modified in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Attempt to Modify an Okta Policy
+
+Modifications to Okta policies may indicate attempts to weaken an organization's security controls. If such an attempt is detected, consider the following steps for investigation.
+
+#### Possible investigation steps:
+- Identify the actor associated with the event. Check the fields `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name`.
+- Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.
+- Check the nature of the policy modification. You can review the `okta.target` field, especially `okta.target.display_name` and `okta.target.id`.
+- Examine the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the modification attempt.
+- Check if there have been other similar modification attempts in a short time span from the same actor or IP address.
+
+### False positive analysis:
+- This alert might be a false positive if Okta policies are regularly updated in your organization as a part of normal operations.
+- Check if the actor associated with the event has legitimate rights to modify the Okta policies.
+- Verify the actor's geographical location and the time of the modification attempt. If these align with the actor's regular behavior, it could be a false positive.
+
+### Response and remediation:
+- If unauthorized modification is confirmed, initiate the incident response process.
+- Lock the actor's account and enforce password change as an immediate response.
+- Reset MFA tokens for the actor and enforce re-enrollment, if applicable.
+- Review any other actions taken by the actor to assess the overall impact.
+- If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.
+- Consider a security review of your Okta policies and rules to ensure they follow security best practices.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:policy.lifecycle.update
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,36 +92,7 @@ event.dataset:okta.system and event.action:policy.lifecycle.update
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-modify-an-okta-policy-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Modify Okta Policy
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:policy.lifecycle.update
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
index 66ad97c8b1..b87bc14479 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of macOS built-in commands to mount a Server Message Bl
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,59 +14,56 @@ Identifies the execution of macOS built-in commands to mount a Server Message Bl
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.freebsd.org/cgi/man.cgi?mount_smbfs
 * https://ss64.com/osx/mount.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<attempt-to-mount-smb-share-via-command-line-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-process.name : "mount_smbfs" or (process.name : "open" and
-process.args : "smb://*") or (process.name : "mount" and
-process.args : "smbfs") or (process.name : "osascript" and
-process.command_line : "osascript*mount volume*smb://*") ) and not
-process.parent.executable : "/Applications/Google
-Drive.app/Contents/MacOS/Google Drive"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  (
+    process.name : "mount_smbfs" or
+    (process.name : "open" and process.args : "smb://*") or
+    (process.name : "mount" and process.args : "smbfs") or
+    (process.name : "osascript" and process.command_line : "osascript*mount volume*smb://*")
+  ) and
+  not process.parent.executable : "/Applications/Google Drive.app/Contents/MacOS/Google Drive"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,25 +75,7 @@ Drive.app/Contents/MacOS/Google Drive"
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[attempt-to-mount-smb-share-via-command-line-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-process.name : "mount_smbfs" or (process.name : "open" and
-process.args : "smb://*") or (process.name : "mount" and
-process.args : "smbfs") or (process.name : "osascript" and
-process.command_line : "osascript*mount volume*smb://*") )
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
index 9f5fdf79f0..2bdfaafe0f 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
@@ -5,7 +5,7 @@ Identifies a potential Gatekeeper bypass. In macOS, when applications or program
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,58 +14,55 @@ Identifies a potential Gatekeeper bypass. In macOS, when applications or program
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
 * https://ss64.com/osx/xattr.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<attempt-to-remove-file-quarantine-attribute-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "xattr" and ( (process.args :
-"com.apple.quarantine" and process.args : ("-d", "-w")) or
-(process.args : "-c") or (process.command_line : ("/bin/bash -c
-xattr -c *", "/bin/zsh -c xattr -c *", "/bin/sh -c xattr -c *")) )
-and not process.args_count > 12
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.name : "xattr" and
+  (
+    (process.args : "com.apple.quarantine" and process.args : ("-d", "-w")) or
+    (process.args : "-c") or
+    (process.command_line : ("/bin/bash -c xattr -c *", "/bin/zsh -c xattr -c *", "/bin/sh -c xattr -c *"))
+  ) and not process.args_count > 12
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,39 +74,7 @@ and not process.args_count > 12
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[attempt-to-remove-file-quarantine-attribute-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : "xattr" and ( (process.args :
-"com.apple.quarantine" and process.args : ("-d", "-w")) or
-(process.args : "-c" and process.command_line : (
-"/bin/bash -c xattr -c *", "/bin/zsh -c xattr -c *",
-"/bin/sh -c xattr -c *" ) ) )
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name == "xattr" and process.args == "com.apple.quarantine" and
-process.args == "-d"
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc
index b25799db16..95afb08703 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to reset an Okta user's enrolled multi-factor authentication (M
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,59 +14,50 @@ Detects attempts to reset an Okta user's enrolled multi-factor authentication (M
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<attempt-to-reset-mfa-factors-for-an-okta-user-account-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if the MFA factors for Okta user accounts are regularly reset in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:user.mfa.factor.reset_all
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,36 +69,3 @@ event.dataset:okta.system and event.action:user.mfa.factor.reset_all
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[attempt-to-reset-mfa-factors-for-an-okta-user-account-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Rule name changed from: Attempt to Reset MFA Factors for Okta User Account
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:user.mfa.factor.reset_all
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc
index 6ca6cacfa1..06ea51ab03 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to revoke an Okta API token. An adversary may attempt to rev
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,59 +14,71 @@ Identifies attempts to revoke an Okta API token. An adversary may attempt to rev
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<attempt-to-revoke-okta-api-token-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If the behavior of revoking Okta API tokens is expected, consider adding exceptions to this rule to filter false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempt to Revoke Okta API Token
+
+The rule alerts when attempts are made to revoke an Okta API token. The API tokens are critical for integration services, and revoking them may lead to disruption in services. Therefore, it's important to validate these activities.
+
+#### Possible investigation steps:
+- Identify the actor associated with the API token revocation attempt. You can use the `okta.actor.alternate_id` field for this purpose.
+- Determine the client used by the actor. Review the `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context` fields.
+- Verify if the API token revocation was authorized or part of some planned activity.
+- Check the `okta.outcome.result` and `okta.outcome.reason` fields to see if the attempt was successful or failed.
+- Analyze the past activities of the actor involved in this action. An actor who usually performs such activities may indicate a legitimate reason.
+- Evaluate the actions that happened just before and after this event. It can help understand the full context of the activity.
 
+### False positive analysis:
+- It might be a false positive if the action was part of a planned activity or was performed by an authorized person.
+
+### Response and remediation:
+- If unauthorized revocation attempts are confirmed, initiate the incident response process.
+- Block the IP address or device used in the attempts, if they appear suspicious.
+- Reset the user's password and enforce MFA re-enrollment, if applicable.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the revoked token was used for critical integrations, coordinate with the relevant team to minimize the impact.
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:system.api_token.revoke
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,37 +90,3 @@ event.dataset:okta.system and event.action:system.api_token.revoke
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[attempt-to-revoke-okta-api-token-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:system.api_token.revoke
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
index 47ad65af7b..50c2ca8a41 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to unload the Elastic Endpoint Security kernel extension via
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,42 +14,39 @@ Identifies attempts to unload the Elastic Endpoint Security kernel extension via
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<attempt-to-unload-elastic-endpoint-security-kernel-extension-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:kextunload and
-process.args:("/System/Library/Extensions/EndpointSecurity.kext" or
-"EndpointSecurity.kext")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:kextunload and process.args:("/System/Library/Extensions/EndpointSecurity.kext" or "EndpointSecurity.kext")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -61,8 +58,10 @@ process.args:("/System/Library/Extensions/EndpointSecurity.kext" or
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -71,13 +70,7 @@ process.args:("/System/Library/Extensions/EndpointSecurity.kext" or
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[attempt-to-unload-elastic-endpoint-security-kernel-extension-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc
index 4352580d6c..94332eff46 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,55 +14,85 @@ Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<attempted-bypass-of-okta-mfa-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempted Bypass of Okta MFA
+
+Multi-factor authentication (MFA) is a crucial security measure in preventing unauthorized access. Okta MFA, like other MFA solutions, requires the user to provide multiple means of identification at login. An adversary might attempt to bypass Okta MFA to gain unauthorized access to an application.
+
+This rule detects attempts to bypass Okta MFA. It might indicate a serious attempt to compromise a user account within the organization's network.
+
+#### Possible investigation steps
 
+- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
+- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
+- Examine the `okta.outcome.reason` field for additional context around the bypass attempt.
+- Check the `okta.outcome.result` field to confirm the MFA bypass attempt.
+- Check if there are multiple unsuccessful MFA attempts from the same actor or IP address (`okta.client.ip`).
+- Check for successful logins immediately following the MFA bypass attempt.
+- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the bypass attempt.
+
+### False positive analysis
+
+- Check if there were issues with the MFA system at the time of the bypass attempt. This could indicate a system error rather than a genuine bypass attempt.
+- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the login attempt. If these match the actor's normal behavior, it might be a false positive.
+- Verify the actor's MFA settings to ensure they are correctly configured.
+
+### Response and remediation
+
+- If unauthorized access is confirmed, initiate the incident response process.
+- Immediately lock the affected actor account and require a password change.
+- Consider resetting MFA tokens for the actor and require re-enrollment.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+- If a specific MFA bypass technique was used, ensure your systems are patched or configured to prevent such techniques.
+- Assess the criticality of affected services and servers.
+- Work with your IT team to minimize the impact on users and maintain business continuity.
+- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
+- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:user.mfa.attempt_bypass
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,37 +104,3 @@ event.dataset:okta.system and event.action:user.mfa.attempt_bypass
 ** Name: Multi-Factor Authentication Interception
 ** ID: T1111
 ** Reference URL: https://attack.mitre.org/techniques/T1111/
-
-[[attempted-bypass-of-okta-mfa-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:user.mfa.attempt_bypass
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
index 6bc07ccf1f..0fba8a2a0c 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to brute force a Microsoft 365 user account. An adversary ma
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,63 +14,53 @@ Identifies attempts to brute force a Microsoft 365 user account. An adversary ma
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blueteamblog.com/7-ways-to-monitor-your-office-365-logs-using-siem
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<attempts-to-brute-force-a-microsoft-365-user-account-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Willem D'Haese, Austin Songer
+* Elastic
+* Willem D'Haese
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(AzureActiveDirectory or
-Exchange) and event.category:authentication and
-event.action:(UserLoginFailed or
-PasswordLogonInitialAuthUsingPassword) and not
-o365.audit.LogonError:(UserAccountNotFound or
-EntitlementGrantsNotFound or UserStrongAuthEnrollmentRequired or
-UserStrongAuthClientAuthNRequired or InvalidReplyTo)
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:(AzureActiveDirectory or Exchange) and
+  event.category:authentication and event.action:(UserLoginFailed or PasswordLogonInitialAuthUsingPassword) and
+  not o365.audit.LogonError:(UserAccountNotFound or EntitlementGrantsNotFound or UserStrongAuthEnrollmentRequired or
+                             UserStrongAuthClientAuthNRequired or InvalidReplyTo)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,62 +72,3 @@ UserStrongAuthClientAuthNRequired or InvalidReplyTo)
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[attempts-to-brute-force-a-microsoft-365-user-account-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(AzureActiveDirectory or
-Exchange) and event.category:authentication and
-event.action:(UserLoginFailed or
-PasswordLogonInitialAuthUsingPassword) and not
-o365.audit.LogonError:(UserAccountNotFound or
-EntitlementGrantsNotFound or UserStrongAuthEnrollmentRequired or
-UserStrongAuthClientAuthNRequired or InvalidReplyTo) and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(AzureActiveDirectory or
-Exchange) and event.category:authentication and
-event.action:(UserLoginFailed or
-PasswordLogonInitialAuthUsingPassword) and not
-o365.audit.LogonError:(UserAccountNotFound or
-EntitlementGrantsNotFound or UserStrongAuthEnrollmentRequired or
-UserStrongAuthClientAuthNRequired or InvalidReplyTo) and
-event.outcome:failure
-----------------------------------
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:AzureActiveDirectory and
-event.category:authentication and event.action:UserLoginFailed and
-event.outcome:failure
-----------------------------------
-
-Version 3 (7.13.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc
index ddc260bc87..cacaf935b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Okta user account is locked out 3 times within a 3 hour windo
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,55 +14,84 @@ Identifies when an Okta user account is locked out 3 times within a 3 hour windo
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-180m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<attempts-to-brute-force-an-okta-user-account-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, @BenB196, Austin Songer
+* Elastic
+* @BenB196
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Attempts to Brute Force an Okta User Account
+
+Brute force attacks aim to guess user credentials through exhaustive trial-and-error attempts. In this context, Okta accounts are targeted.
+
+This rule fires when an Okta user account has been locked out 3 times within a 3-hour window. This could indicate an attempted brute force or password spraying attack to gain unauthorized access to the user account. Okta's default authentication policy locks a user account after 10 failed authentication attempts.
+
+#### Possible investigation steps:
 
+- Identify the actor related to the alert by reviewing `okta.actor.alternate_id` field in the alert. This should give the username of the account being targeted.
+- Review the `okta.event_type` field to understand the nature of the events that led to the account lockout.
+- Check the `okta.severity` and `okta.display_message` fields for more context around the lockout events.
+- Look for correlation of events from the same IP address. Multiple lockouts from the same IP address might indicate a single source for the attack.
+- If the IP is not familiar, investigate it. The IP could be a proxy, VPN, Tor node, cloud datacenter, or a legitimate IP turned malicious.
+- Determine if the lockout events occurred during the user's regular activity hours. Unusual timing may indicate malicious activity.
+- Examine the authentication methods used during the lockout events by checking the `okta.authentication_context.credential_type` field.
+
+### False positive analysis:
+
+- Determine whether the account owner or an internal user made repeated mistakes in entering their credentials, leading to the account lockout.
+- Ensure there are no known network or application issues that might cause these events.
+
+### Response and remediation:
+
+- Alert the user and your IT department immediately.
+- If unauthorized access is confirmed, initiate your incident response process.
+- Investigate the source of the attack. If a specific machine or network is compromised, additional steps may need to be taken to address the issue.
+- Require the affected user to change their password.
+- If the attack is ongoing, consider blocking the IP address initiating the brute force attack.
+- Implement account lockout policies to limit the impact of brute force attacks.
+- Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.
+- Check if the compromised account was used to access or alter any sensitive data or systems.
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and event.action:user.account.lock
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,33 +103,3 @@ event.dataset:okta.system and event.action:user.account.lock
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[attempts-to-brute-force-an-okta-user-account-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:okta.system and event.action:user.account.lock
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
index 3617e719d3..78e3504161 100644
--- a/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
@@ -5,7 +5,7 @@ Authorization plugins are used to extend the authorization services API and impl
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,47 +14,44 @@ Authorization plugins are used to extend the authorization services API and impl
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.apple.com/documentation/security/authorization_plug-ins
 * https://www.xorrior.com/persistent-credential-theft/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<authorization-plugin-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.path:(/Library/Security/SecurityAgentPlugins/* and not
-/Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle/*)
-and not process.name:shove and process.code_signature.trusted:true
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and not event.type:deletion and
+  file.path:(/Library/Security/SecurityAgentPlugins/* and
+  not /Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle/*) and
+  not process.name:shove and process.code_signature.trusted:true
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,20 +63,7 @@ and not process.name:shove and process.code_signature.trusted:true
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[authorization-plugin-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.path:(/Library/Security/SecurityAgentPlugins/* and not /Library
-/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle/Contents/*)
-----------------------------------
-
+* Sub-technique:
+** Name: Authentication Package
+** ID: T1547.002
+** Reference URL: https://attack.mitre.org/techniques/T1547/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc
index 1b1cf28792..927d7a4587 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of an AWS log trail that specifies the settings for deli
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,50 @@ Identifies the creation of an AWS log trail that specifies the settings for deli
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/create-trail.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 101 (<<aws-cloudtrail-log-created-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trail creations may be made by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Trail creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:CreateTrail
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:CreateTrail and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,40 +66,6 @@ and event.outcome:success
 ** ID: TA0009
 ** Reference URL: https://attack.mitre.org/tactics/TA0009/
 * Technique:
-** Name: Data from Cloud Storage Object
+** Name: Data from Cloud Storage
 ** ID: T1530
 ** Reference URL: https://attack.mitre.org/techniques/T1530/
-
-[[aws-cloudtrail-log-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:CreateTrail and event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc
index 4581182774..e26322207d 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an AWS log trail. An adversary may delete trails in a
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,47 @@ Identifies the deletion of an AWS log trail. An adversary may delete trails in a
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/delete-trail.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Investigation Guide
-
-*Version*: 103 (<<aws-cloudtrail-log-deleted-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trail deletions may be made by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Trail deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS CloudTrail Log Deleted
 
-Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your
-Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to
-actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services
-account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and
-other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and
-troubleshooting.
+Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
 
-This rule identifies the deletion of an AWS log trail using the API `DeleteTrail` action. Attackers can do this to
-cover their tracks and impact security monitoring that relies on this source.
+This rule identifies the deletion of an AWS log trail using the API `DeleteTrail` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
 #### Possible investigation steps
 
@@ -76,18 +64,14 @@ cover their tracks and impact security monitoring that relies on this source.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - Investigate the deleted log trail's criticality and whether the responsible team is aware of the deletion.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -99,31 +83,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:DeleteTrail
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:DeleteTrail and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,40 +112,7 @@ and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-cloudtrail-log-deleted-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteTrail and event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc
index 6ec5495d2f..3e7cd52514 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc
@@ -5,7 +5,7 @@ Identifies suspending the recording of AWS API calls and log file delivery for t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,47 @@ Identifies suspending the recording of AWS API calls and log file delivery for t
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/stop-logging.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Investigation Guide
-
-*Version*: 103 (<<aws-cloudtrail-log-suspended-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Suspending the recording of a trail may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Trail suspensions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS CloudTrail Log Suspended
 
-Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your
-Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to
-actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services
-account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and
-other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and
-troubleshooting.
+Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
 
-This rule identifies the suspension of an AWS log trail using the API `StopLogging` action. Attackers can do this to
-cover their tracks and impact security monitoring that relies on this source.
+This rule identifies the suspension of an AWS log trail using the API `StopLogging` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
 #### Possible investigation steps
 
@@ -76,18 +64,14 @@ cover their tracks and impact security monitoring that relies on this source.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - Investigate the deleted log trail's criticality and whether the responsible team is aware of the deletion.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -99,31 +83,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:StopLogging
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:StopLogging and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,37 +112,7 @@ and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-cloudtrail-log-suspended-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:StopLogging and event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc
index f9a70d5f2c..33283a5049 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc
@@ -5,7 +5,7 @@ Identifies an update to an AWS log trail setting that specifies the delivery of
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,47 @@ Identifies an update to an AWS log trail setting that specifies the delivery of
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/update-trail.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Investigation Guide
-
-*Version*: 103 (<<aws-cloudtrail-log-updated-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Resources: Investigation Guide
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trail updates may be made by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Trail updates from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS CloudTrail Log Updated
 
-Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your
-Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to
-actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services
-account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and
-other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and
-troubleshooting.
+Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
 
-This rule identifies a modification on CloudTrail settings using the API `UpdateTrail` action. Attackers can do this to
-cover their tracks and impact security monitoring that relies on this source.
+This rule identifies a modification on CloudTrail settings using the API `UpdateTrail` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
 #### Possible investigation steps
 
@@ -77,17 +65,13 @@ cover their tracks and impact security monitoring that relies on this source.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -99,31 +83,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:UpdateTrail
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:UpdateTrail and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,47 +112,15 @@ and event.outcome:success
 ** Name: Data Manipulation
 ** ID: T1565
 ** Reference URL: https://attack.mitre.org/techniques/T1565/
-
-
+* Sub-technique:
+** Name: Stored Data Manipulation
+** ID: T1565.001
+** Reference URL: https://attack.mitre.org/techniques/T1565/001/
 * Tactic:
 ** Name: Collection
 ** ID: TA0009
 ** Reference URL: https://attack.mitre.org/tactics/TA0009/
 * Technique:
-** Name: Data from Cloud Storage Object
+** Name: Data from Cloud Storage
 ** ID: T1530
 ** Reference URL: https://attack.mitre.org/techniques/T1530/
-
-[[aws-cloudtrail-log-updated-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:UpdateTrail and event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc
index 799cccc9db..4bd877ba24 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alar
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,45 +14,38 @@ Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alar
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudwatch/delete-alarms.html
 * https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAlarms.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Investigation Guide
-
-*Version*: 103 (<<aws-cloudwatch-alarm-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Alarm deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -77,17 +70,13 @@ tracks and evade security defenses.
 - Check if there is a justification for this behavior.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -99,31 +88,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:monitoring.amazonaws.com and event.action:DeleteAlarms
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:monitoring.amazonaws.com and event.action:DeleteAlarms and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,40 +117,7 @@ and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-cloudwatch-alarm-deletion-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteAlarms and event.dataset:aws.cloudtrail and
-event.provider:monitoring.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc
index 2d4604591b..7398865b9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a specified AWS CloudWatch log group. When a log grou
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,61 +14,49 @@ Identifies the deletion of a specified AWS CloudWatch log group. When a log grou
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/delete-log-group.html
 * https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Investigation Guide
-
-*Version*: 103 (<<aws-cloudwatch-log-group-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Resources: Investigation Guide
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Log group deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS CloudWatch Log Group Deletion
 
-Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of
-logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize
-logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your
-applications running smoothly.
+Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications running smoothly.
 
-A log group is a group of log streams that share the same retention, monitoring, and access control settings. You can
-define log groups and specify which streams to put into each group. There is no limit on the number of log streams that
-can belong to one log group.
+A log group is a group of log streams that share the same retention, monitoring, and access control settings. You can define log groups and specify which streams to put into each group. There is no limit on the number of log streams that can belong to one log group.
 
-This rule looks for the deletion of a log group using the API `DeleteLogGroup` action. Attackers can do this to cover
-their tracks and impact security monitoring that relies on these sources.
+This rule looks for the deletion of a log group using the API `DeleteLogGroup` action. Attackers can do this to cover their tracks and impact security monitoring that relies on these sources.
 
 #### Possible investigation steps
 
@@ -78,18 +66,14 @@ their tracks and impact security monitoring that relies on these sources.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - Investigate the deleted log group's criticality and whether the responsible team is aware of the deletion.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -101,30 +85,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:logs.amazonaws.com and
-event.action:DeleteLogGroup and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:logs.amazonaws.com and event.action:DeleteLogGroup and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,8 +114,6 @@ event.action:DeleteLogGroup and event.outcome:success
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -146,40 +122,7 @@ event.action:DeleteLogGroup and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-cloudwatch-log-group-deletion-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteLogGroup and event.dataset:aws.cloudtrail and
-event.provider:logs.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc
index 1ee285caff..68b09ce0d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an AWS CloudWatch log stream, which permanently delet
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,61 +14,49 @@ Identifies the deletion of an AWS CloudWatch log stream, which permanently delet
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/delete-log-stream.html
 * https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogStream.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Impact
-* Investigation Guide
-
-*Version*: 103 (<<aws-cloudwatch-log-stream-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Tactic: Impact
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A log stream may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Log stream deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS CloudWatch Log Stream Deletion
 
-Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of
-logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize
-logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your
-applications running smoothly.
+Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications running smoothly.
 
-A log stream is a sequence of log events that share the same source. Each separate source of logs in CloudWatch Logs
-makes up a separate log stream.
+A log stream is a sequence of log events that share the same source. Each separate source of logs in CloudWatch Logs makes up a separate log stream.
 
-This rule looks for the deletion of a log stream using the API `DeleteLogStream` action. Attackers can do this to cover
-their tracks and impact security monitoring that relies on these sources.
+This rule looks for the deletion of a log stream using the API `DeleteLogStream` action. Attackers can do this to cover their tracks and impact security monitoring that relies on these sources.
 
 #### Possible investigation steps
 
@@ -78,18 +66,14 @@ their tracks and impact security monitoring that relies on these sources.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - Investigate the deleted log stream's criticality and whether the responsible team is aware of the deletion.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -101,30 +85,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:logs.amazonaws.com and
-event.action:DeleteLogStream and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:logs.amazonaws.com and event.action:DeleteLogStream and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,8 +114,6 @@ event.action:DeleteLogStream and event.outcome:success
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -146,40 +122,7 @@ event.action:DeleteLogStream and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-cloudwatch-log-stream-deletion-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteLogStream and event.dataset:aws.cloudtrail and
-event.provider:logs.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc
index 5eb70f2acc..0d819daf6a 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to delete an AWS Config Service resource. An adversary may t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,78 +14,64 @@ Identifies attempts to delete an AWS Config Service resource. An adversary may t
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html
 * https://docs.aws.amazon.com/config/latest/APIReference/API_Operations.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Investigation Guide
-
-*Version*: 103 (<<aws-config-resource-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Privileged IAM users with security responsibilities may be expected to make changes to the Config service in order to align with local security policies and requirements. Automation, orchestration, and security tools may also make changes to the Config service, where they are used to automate setup or configuration of AWS accounts. Other kinds of user or service contexts do not commonly make changes to this service.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS Config Resource Deletion
 
-AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the
-resources are related to one another and how they were configured in the past so that you can see how the configurations
-and relationships change over time.
+AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.
 
-This rule looks for the deletion of AWS Config resources using various API actions. Attackers can do this to cover their
-tracks and impact security monitoring that relies on these sources.
+This rule looks for the deletion of AWS Config resources using various API actions. Attackers can do this to cover their tracks and impact security monitoring that relies on these sources.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Identify the AWS resource that was involved and its criticality, ownership, and role in the environment. Also investigate
-if the resource is security-related.
+- Identify the AWS resource that was involved and its criticality, ownership, and role in the environment. Also investigate if the resource is security-related.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -97,34 +83,27 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com
-and event.action:(DeleteConfigRule or DeleteOrganizationConfigRule
-or DeleteConfigurationAggregator or DeleteConfigurationRecorder or
-DeleteConformancePack or DeleteOrganizationConformancePack or
-DeleteDeliveryChannel or DeleteRemediationConfiguration or
-DeleteRetentionConfiguration)
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com and
+    event.action:(DeleteConfigRule or DeleteOrganizationConfigRule or DeleteConfigurationAggregator or
+    DeleteConfigurationRecorder or DeleteConformancePack or DeleteOrganizationConformancePack or
+    DeleteDeliveryChannel or DeleteRemediationConfiguration or DeleteRetentionConfiguration)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,36 +115,7 @@ DeleteRetentionConfiguration)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-config-resource-deletion-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Rule name changed from: AWS Config Service Tampering
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset: aws.cloudtrail and event.action: DeleteConfigRule and
-event.provider: config.amazonaws.com
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc
index 7c2b5dd1b0..0e6e71b59c 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc
@@ -5,7 +5,7 @@ Identifies an AWS configuration change to stop recording a designated set of res
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,49 @@ Identifies an AWS configuration change to stop recording a designated set of res
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/stop-configuration-recorder.html
 * https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 101 (<<aws-configuration-recorder-stopped-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Recording changes from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com
-and event.action:StopConfigurationRecorder and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com and event.action:StopConfigurationRecorder and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,38 +68,7 @@ and event.action:StopConfigurationRecorder and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-configuration-recorder-stopped-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:StopConfigurationRecorder and
-event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com
-and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-credentials-searched-for-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-credentials-searched-for-inside-a-container.asciidoc
new file mode 100644
index 0000000000..9d5a8dd5c6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/aws-credentials-searched-for-inside-a-container.asciidoc
@@ -0,0 +1,70 @@
+[[aws-credentials-searched-for-inside-a-container]]
+=== AWS Credentials Searched For Inside A Container
+
+This rule detects the use of system search utilities like grep and find to search for AWS credentials inside a container. Unauthorized access to these sensitive files could lead to further compromise of the container environment or facilitate a container breakout to the underlying cloud environment.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://sysdig.com/blog/threat-detection-aws-cloud-containers/
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.module == "cloud_defend" and     
+  event.type == "start" and
+  
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
+(process.name : ("grep", "egrep", "fgrep", "find", "locate", "mlocate") or process.args : ("grep", "egrep", "fgrep", "find", "locate", "mlocate")) and 
+process.args : ("*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*", "*access_key*", "*.aws/credentials*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
+* Sub-technique:
+** Name: Credentials In Files
+** ID: T1552.001
+** Reference URL: https://attack.mitre.org/techniques/T1552/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc
index 2ed6e8beac..ae03dd58c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora da
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,13 +14,13 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora da
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/delete-db-cluster.html
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
@@ -29,49 +29,40 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora da
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/delete-db-instance.html
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBInstance.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-deletion-of-rds-instance-or-cluster-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Clusters or instances may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Cluster or instance deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:(DeleteDBCluster or DeleteGlobalCluster or
-DeleteDBInstance) and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:(DeleteDBCluster or DeleteGlobalCluster or DeleteDBInstance)
+and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,57 +74,3 @@ DeleteDBInstance) and event.outcome:success
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-[[aws-deletion-of-rds-instance-or-cluster-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:(DeleteDBCluster or DeleteGlobalCluster or
-DeleteDBInstance) and event.outcome:success
-----------------------------------
-
-Version 7 (8.2.0 release)::
-* Rule name changed from: AWS RDS Cluster Deletion
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:(DeleteDBCluster or DeleteGlobalCluster) and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(DeleteDBCluster or DeleteGlobalCluster) and
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc
index 4899175576..085e558881 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default i
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,50 @@ Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default i
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disable-ebs-encryption-by-default.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Data Protection
-
-*Version*: 101 (<<aws-ec2-encryption-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Disabling encryption may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Disabling encryption by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:DisableEbsEncryptionByDefault and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:DisableEbsEncryptionByDefault and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,38 +69,7 @@ event.action:DisableEbsEncryptionByDefault and event.outcome:success
 ** Name: Data Manipulation
 ** ID: T1565
 ** Reference URL: https://attack.mitre.org/techniques/T1565/
-
-[[aws-ec2-encryption-disabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DisableEbsEncryptionByDefault and
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Stored Data Manipulation
+** ID: T1565.001
+** Reference URL: https://attack.mitre.org/techniques/T1565/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc
index 5387cc9ee9..1c6f83582f 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc
@@ -5,7 +5,7 @@ Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2)
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,61 +14,54 @@ Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2)
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorFilter.html
 * https://github.com/easttimor/aws-incident-response
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<aws-ec2-full-network-packet-capture-detected-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Exfiltration
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Traffic Mirroring may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Traffic Mirroring from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:(CreateTrafficMirrorFilter or
-CreateTrafficMirrorFilterRule or CreateTrafficMirrorSession or
-CreateTrafficMirrorTarget) and event.outcome:success
-----------------------------------
+event.action:(CreateTrafficMirrorFilter or CreateTrafficMirrorFilterRule or CreateTrafficMirrorSession or CreateTrafficMirrorTarget) and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,8 +73,6 @@ CreateTrafficMirrorTarget) and event.outcome:success
 ** Name: Automated Exfiltration
 ** ID: T1020
 ** Reference URL: https://attack.mitre.org/techniques/T1020/
-
-
 * Tactic:
 ** Name: Collection
 ** ID: TA0009
@@ -90,27 +81,3 @@ CreateTrafficMirrorTarget) and event.outcome:success
 ** Name: Data Staged
 ** ID: T1074
 ** Reference URL: https://attack.mitre.org/techniques/T1074/
-
-[[aws-ec2-full-network-packet-capture-detected-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:(CreateTrafficMirrorFilter or
-CreateTrafficMirrorFilterRule or CreateTrafficMirrorSession or
-CreateTrafficMirrorTarget) and event.outcome:success
-----------------------------------
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc
index 4b0d6435af..0be813bdf2 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access con
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,62 +14,52 @@ Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access con
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-network-acl.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAcl.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-network-acl-entry.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAclEntry.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<aws-ec2-network-access-control-list-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Network ACL's may be created by a network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Network ACL creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:(CreateNetworkAcl or CreateNetworkAclEntry) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(CreateNetworkAcl or CreateNetworkAclEntry) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,41 +71,3 @@ event.outcome:success
 ** Name: External Remote Services
 ** ID: T1133
 ** Reference URL: https://attack.mitre.org/techniques/T1133/
-
-[[aws-ec2-network-access-control-list-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(CreateNetworkAcl or CreateNetworkAclEntry) and
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc
index 9a0c8bb3f3..2871cf6be7 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,62 +14,52 @@ Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-network-acl.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAcl.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-network-acl-entry.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAclEntry.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<aws-ec2-network-access-control-list-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Network ACL's may be deleted by a network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Network ACL deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:(DeleteNetworkAcl or DeleteNetworkAclEntry) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(DeleteNetworkAcl or DeleteNetworkAclEntry) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,41 +71,7 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-ec2-network-access-control-list-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(DeleteNetworkAcl or DeleteNetworkAclEntry) and
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc
index ecbb677a37..b617d75968 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc
@@ -5,7 +5,7 @@ An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometim
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,56 +14,47 @@ An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometim
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-snapshot-attribute.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-* Exfiltration
-* Investigation Guide
-
-*Version*: 103 (<<aws-ec2-snapshot-activity-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Exfiltration
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-IAM users may occasionally share EC2 snapshots with another AWS account belonging to the same organization. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS EC2 Snapshot Activity
 
-Amazon EC2 snapshots are a mechanism to create point-in-time references to data that reside in storage volumes. System
-administrators commonly use this for backup operations and data recovery.
+Amazon EC2 snapshots are a mechanism to create point-in-time references to data that reside in storage volumes. System administrators commonly use this for backup operations and data recovery.
 
-This rule looks for the modification of snapshot attributes using the API `ModifySnapshotAttribute` action. This can be
-used to share snapshots with unauthorized third parties, giving others access to all the data on the snapshot.
+This rule looks for the modification of snapshot attributes using the API `ModifySnapshotAttribute` action. This can be used to share snapshots with unauthorized third parties, giving others access to all the data on the snapshot.
 
 #### Possible investigation steps
 
@@ -74,19 +65,15 @@ used to share snapshots with unauthorized third parties, giving others access to
 - Contact the account owner and confirm whether they are aware of this activity.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Check if the shared permissions of the snapshot were modified to `Public` or include unknown account IDs.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -98,30 +85,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:ModifySnapshotAttribute
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:ModifySnapshotAttribute
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,35 +114,3 @@ event.action:ModifySnapshotAttribute
 ** Name: Transfer Data to Cloud Account
 ** ID: T1537
 ** Reference URL: https://attack.mitre.org/techniques/T1537/
-
-[[aws-ec2-snapshot-activity-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:aws and event.dataset:aws.cloudtrail and
-event.provider:ec2.amazonaws.com and
-event.action:ModifySnapshotAttribute
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc
index e84dd10d4b..99f051ec31 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc
@@ -5,7 +5,7 @@ Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) expo
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,58 +14,51 @@ Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) expo
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-ec2-vm-export-failure-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Exfiltration
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-VM exports may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. VM exports from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:CreateInstanceExportTask and event.outcome:failure
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:CreateInstanceExportTask and event.outcome:failure
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +70,6 @@ event.action:CreateInstanceExportTask and event.outcome:failure
 ** Name: Transfer Data to Cloud Account
 ** ID: T1537
 ** Reference URL: https://attack.mitre.org/techniques/T1537/
-
-
 * Tactic:
 ** Name: Collection
 ** ID: TA0009
@@ -87,16 +78,3 @@ event.action:CreateInstanceExportTask and event.outcome:failure
 ** Name: Data from Local System
 ** ID: T1005
 ** Reference URL: https://attack.mitre.org/techniques/T1005/
-
-[[aws-ec2-vm-export-failure-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc
index b0ae301228..7fcb7525e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc
@@ -5,7 +5,7 @@ Detects when an EFS File System or Mount is deleted. An adversary could break an
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,61 +14,50 @@ Detects when an EFS File System or Mount is deleted. An adversary could break an
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
 * https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Data Protection
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Impact
 
-*Version*: 101 (<<aws-efs-file-system-or-mount-deleted-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-File System or Mount being deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. File System Mount deletion by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:elasticfilesystem.amazonaws.com and
-event.action:(DeleteMountTarget or DeleteFileSystem) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:elasticfilesystem.amazonaws.com and
+event.action:(DeleteMountTarget or DeleteFileSystem) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,30 +69,3 @@ event.outcome:success
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-[[aws-efs-file-system-or-mount-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:elasticfilesystem.amazonaws.com and
-event.action:(DeleteMountTarget or DeleteFileSystem) and
-event.outcome:success
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc
index 73219d5474..01d2be2efb 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc
@@ -5,7 +5,7 @@ Identifies when an ElastiCache security group has been created.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,49 @@ Identifies when an ElastiCache security group has been created.
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSecurityGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<aws-elasticache-security-group-created-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:elasticache.amazonaws.com and event.action:"Create
-Cache Security Group" and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:"Create Cache Security Group" and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,26 +68,7 @@ Cache Security Group" and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-elasticache-security-group-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:elasticache.amazonaws.com and event.action:"Create
-Cache Security Group" and event.outcome:success
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc
index d0477e4239..706ef58c35 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies when an ElastiCache security group has been modified or deleted.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,62 +14,50 @@ Identifies when an ElastiCache security group has been modified or deleted.
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/Welcome.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<aws-elasticache-security-group-modified-or-deleted-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:elasticache.amazonaws.com and event.action:("Delete
-Cache Security Group" or "Authorize Cache Security Group Ingress" or
-"Revoke Cache Security Group Ingress" or
-"AuthorizeCacheSecurityGroupEgress" or
+event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:("Delete Cache Security Group" or
+"Authorize Cache Security Group Ingress" or  "Revoke Cache Security Group Ingress" or "AuthorizeCacheSecurityGroupEgress" or
 "RevokeCacheSecurityGroupEgress") and event.outcome:success
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,29 +69,7 @@ Cache Security Group" or "Authorize Cache Security Group Ingress" or
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-elasticache-security-group-modified-or-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:elasticache.amazonaws.com and event.action:("Delete
-Cache Security Group" or "Authorize Cache Security Group Ingress" or
-"Revoke Cache Security Group Ingress" or
-"AuthorizeCacheSecurityGroupEgress" or
-"RevokeCacheSecurityGroupEgress") and event.outcome:success
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc
index 897affc2f2..94ad08ff60 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies when a user has disabled or deleted an EventBridge rule. This activit
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,61 +14,50 @@ Identifies when a user has disabled or deleted an EventBridge rule. This activit
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html
 * https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DisableRule.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Impact
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Impact
 
-*Version*: 101 (<<aws-eventbridge-rule-disabled-or-deleted-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-EventBridge Rules could be deleted or disabled by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. EventBridge Rules being deleted or disabled by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:eventbridge.amazonaws.com and event.action:(DeleteRule
-or DisableRule) and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:eventbridge.amazonaws.com and event.action:(DeleteRule or DisableRule) and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,29 +69,3 @@ or DisableRule) and event.outcome:success
 ** Name: Service Stop
 ** ID: T1489
 ** Reference URL: https://attack.mitre.org/techniques/T1489/
-
-[[aws-eventbridge-rule-disabled-or-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:eventbridge.amazonaws.com and event.action:(DeleteRule
-or DisableRule) and event.outcome:success
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc
index d1f52a5322..1bdc1fe4ec 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of commands and scripts via System Manager. Execution m
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,79 +14,65 @@ Identifies the execution of commands and scripts via System Manager. Execution m
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-plugins.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Initial Access
-* Investigation Guide
-
-*Version*: 103 (<<aws-execution-via-system-manager-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Tactic: Initial Access
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Suspicious commands from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS Execution via System Manager
 
-Amazon EC2 Systems Manager is a management service designed to help users automatically collect software inventory, apply
-operating system patches, create system images, and configure Windows and Linux operating systems.
+Amazon EC2 Systems Manager is a management service designed to help users automatically collect software inventory, apply operating system patches, create system images, and configure Windows and Linux operating systems.
 
-This rule looks for the execution of commands and scripts using System Manager. Note that the actual contents of these
-scripts and commands are not included in the event, so analysts must gain visibility using an host-level security product.
+This rule looks for the execution of commands and scripts using System Manager. Note that the actual contents of these scripts and commands are not included in the event, so analysts must gain visibility using an host-level security product.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
-- Validate that the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Validate that the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Investigate the commands or scripts using host-level visibility.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences involving other users.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
 ### Response and remediation
 
@@ -98,30 +84,24 @@ combination of user and IP address conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ssm.amazonaws.com and
-event.action:SendCommand and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ssm.amazonaws.com and event.action:SendCommand and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,38 +113,7 @@ event.action:SendCommand and event.outcome:success
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[aws-execution-via-system-manager-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:aws and event.dataset:aws.cloudtrail and
-event.provider:ssm.amazonaws.com and event.action:SendCommand and
-event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc
index 48b7cb375a..3e67893692 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDut
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,49 @@ Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDut
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/delete-detector.html
 * https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 101 (<<aws-guardduty-detector-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The GuardDuty detector may be deleted by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Detector deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:guardduty.amazonaws.com and event.action:DeleteDetector
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:guardduty.amazonaws.com and event.action:DeleteDetector and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,40 +68,7 @@ and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-guardduty-detector-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteDetector and event.dataset:aws.cloudtrail and
-event.provider:guardduty.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc
index 743db51e90..d191aaad0b 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may at
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,58 +14,46 @@ Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may at
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://labs.bishopfox.com/tech-blog/5-privesc-attack-vectors-in-aws
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<aws-iam-assume-role-policy-update-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Policy updates from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS IAM Assume Role Policy Update
 
-An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar
-to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot
-do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone
-who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated
-with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
+An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
 
-The role trust policy is a JSON document in which you define the principals you trust to assume the role. This policy is
-a required resource-based policy that is attached to a role in IAM. An attacker may attempt to modify this policy by
-using the `UpdateAssumeRolePolicy` API action to gain the privileges of that role.
+The role trust policy is a JSON document in which you define the principals you trust to assume the role. This policy is a required resource-based policy that is attached to a role in IAM. An attacker may attempt to modify this policy by using the `UpdateAssumeRolePolicy` API action to gain the privileges of that role.
 
 #### Possible investigation steps
 
@@ -73,14 +61,11 @@ using the `UpdateAssumeRolePolicy` API action to gain the privileges of that rol
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher
-confidence. Consider adding exceptions — preferably with a combination of the user agent and user ID conditions — to
-cover administrator activities and infrastructure as code tooling.
+- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of the user agent and user ID conditions — to cover administrator activities and infrastructure as code tooling.
 
 ### Response and remediation
 
@@ -93,30 +78,23 @@ cover administrator activities and infrastructure as code tooling.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
 - Use AWS [policy versioning](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html) to restore the trust policy to the desired state.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and
-event.action:UpdateAssumeRolePolicy and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:UpdateAssumeRolePolicy and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -128,35 +106,3 @@ event.action:UpdateAssumeRolePolicy and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[aws-iam-assume-role-policy-update-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:aws and event.dataset:aws.cloudtrail and
-event.provider:iam.amazonaws.com and
-event.action:UpdateAssumeRolePolicy and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc
index b25af8e64f..980b2b2099 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc
@@ -5,7 +5,7 @@ Identifies a high number of failed attempts to assume an AWS Identity and Access
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,75 +14,63 @@ Identifies a high number of failed attempts to assume an AWS Identity and Access
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
 * https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<aws-iam-brute-force-of-assume-role-policy-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS IAM Brute Force of Assume Role Policy
 
-An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar
-to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot
-do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone
-who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated
-with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
+An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
 
-Attackers may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or
-hijack the discovered role.
+Attackers may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Verify if the `RoleName` parameter contains a unique value in all requests or if the activity is potentially a brute
-force attack.
+- Verify if the `RoleName` parameter contains a unique value in all requests or if the activity is potentially a brute force attack.
 - Verify if the user account successfully updated a trust policy in the last 24 hours.
 - Examine whether this role existed in the environment by looking for past occurrences in your logs.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
-- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal
-time of day?
+- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
 - Examine the account's commands, API calls, and data management actions in the last 24 hours.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- Verify the roles targeted in the failed attempts, and whether the subject role previously existed in the environment.
-If only one role was targeted in the requests and that role previously existed, it may be a false positive, since
-automations can continue targeting roles that existed in the environment in the past and cause false positives (FPs).
+- Verify the roles targeted in the failed attempts, and whether the subject role previously existed in the environment. If only one role was targeted in the requests and that role previously existed, it may be a false positive, since automations can continue targeting roles that existed in the environment in the past and cause false positives (FPs).
 
 ### Response and remediation
 
@@ -94,32 +82,25 @@ automations can continue targeting roles that existed in the environment in the
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com
-and event.action:UpdateAssumeRolePolicy and
-aws.cloudtrail.error_code:MalformedPolicyDocumentException and
-event.outcome:failure
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and
+  event.provider:iam.amazonaws.com and event.action:UpdateAssumeRolePolicy and
+  aws.cloudtrail.error_code:MalformedPolicyDocumentException and event.outcome:failure
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -131,37 +112,3 @@ event.outcome:failure
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[aws-iam-brute-force-of-assume-role-policy-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.1 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:aws and event.dataset:aws.cloudtrail and
-event.provider:iam.amazonaws.com and
-event.action:UpdateAssumeRolePolicy and
-aws.cloudtrail.error_code:MalformedPolicyDocumentException and
-event.outcome:failure
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc
index b70ae5c9a5..f1f435b350 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc
@@ -5,7 +5,7 @@ Identifies the deactivation of a specified multi-factor authentication (MFA) dev
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,49 @@ Identifies the deactivation of a specified multi-factor authentication (MFA) dev
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/deactivate-mfa-device.html
 * https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Investigation Guide
-
-*Version*: 103 (<<aws-iam-deactivation-of-mfa-device-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Resources: Investigation Guide
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A MFA device may be deactivated by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. MFA device deactivations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS IAM Deactivation of MFA Device
 
-Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your
-user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for
-their user name and password (the first factor—what they know), as well as for an authentication code from their AWS MFA
-device (the second factor—what they have). Taken together, these multiple factors provide increased security for your
-AWS account settings and resources.
+Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for their user name and password (the first factor—what they know), as well as for an authentication code from their AWS MFA device (the second factor—what they have). Taken together, these multiple factors provide increased security for your AWS account settings and resources.
 
 For more information about using MFA in AWS, access the [official documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html).
 
-This rule looks for the deactivation or deletion of AWS MFA devices. These modifications weaken account security and can
-lead to the compromise of accounts and other assets.
+This rule looks for the deactivation or deletion of AWS MFA devices. These modifications weaken account security and can lead to the compromise of accounts and other assets.
 
 #### Possible investigation steps
 
@@ -75,13 +64,11 @@ lead to the compromise of accounts and other assets.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- While this activity can be done by administrators, all users must use MFA. The security team should address any
-potential benign true positive (B-TP), as this configuration can risk the user and domain.
+- While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
 ### Response and remediation
 
@@ -93,29 +80,22 @@ potential benign true positive (B-TP), as this configuration can risk the user a
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and
-event.action:(DeactivateMFADevice or DeleteVirtualMFADevice) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:(DeactivateMFADevice or DeleteVirtualMFADevice) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -127,34 +107,3 @@ event.outcome:success
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[aws-iam-deactivation-of-mfa-device-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeactivateMFADevice and event.dataset:aws.cloudtrail and
-event.provider:iam.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc
index f91392d28c..d3b3b3582a 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a group in AWS Identity and Access Management (IAM).
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies the creation of a group in AWS Identity and Access Management (IAM).
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-group.html
 * https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<aws-iam-group-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Group creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and
-event.action:CreateGroup and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:CreateGroup and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,40 +69,7 @@ event.action:CreateGroup and event.outcome:success
 ** Name: Create Account
 ** ID: T1136
 ** Reference URL: https://attack.mitre.org/techniques/T1136/
-
-[[aws-iam-group-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:CreateGroup and event.dataset:aws.cloudtrail and
-event.provider:iam.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Account
+** ID: T1136.003
+** Reference URL: https://attack.mitre.org/techniques/T1136/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc
index 0e5c91a7bc..504ba26e2d 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a specified AWS Identity and Access Management (IAM)
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,49 @@ Identifies the deletion of a specified AWS Identity and Access Management (IAM)
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
 * https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 101 (<<aws-iam-group-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A resource group may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Resource group deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and
-event.action:DeleteGroup and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:DeleteGroup and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,37 +68,3 @@ event.action:DeleteGroup and event.outcome:success
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[aws-iam-group-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteGroup and event.dataset:aws.cloudtrail and
-event.provider:iam.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc
index ca91e8b129..26501c9e65 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc
@@ -5,7 +5,7 @@ Identifies AWS IAM password recovery requests. An adversary may attempt to gain
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,58 +14,49 @@ Identifies AWS IAM password recovery requests. An adversary may attempt to gain
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.cadosecurity.com/an-ongoing-aws-phishing-campaign/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<aws-iam-password-recovery-requested-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be requesting changes in your environment. Password reset attempts from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com
-and event.action:PasswordRecoveryRequested and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:PasswordRecoveryRequested and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,37 +68,3 @@ and event.action:PasswordRecoveryRequested and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[aws-iam-password-recovery-requested-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:PasswordRecoveryRequested and
-event.provider:signin.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc
index 3df76db1e6..bae3407cb4 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc
@@ -5,7 +5,7 @@ Identifies the addition of a user to a specified group in AWS Identity and Acces
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,54 +14,45 @@ Identifies the addition of a user to a specified group in AWS Identity and Acces
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Credential Access
-* Persistence
-* Investigation Guide
-
-*Version*: 103 (<<aws-iam-user-addition-to-group-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Adding users to a specified group may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. User additions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS IAM User Addition to Group
 
-AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify
-who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to
-your workforce and systems to ensure least-privilege permissions.
+AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions.
 
 This rule looks for the addition of users to a specified user group.
 
@@ -71,14 +62,11 @@ This rule looks for the addition of users to a specified user group.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher
-confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions — to
-reduce noise from onboarding processes and administrator activities.
+- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions — to reduce noise from onboarding processes and administrator activities.
 
 ### Response and remediation
 
@@ -90,30 +78,23 @@ reduce noise from onboarding processes and administrator activities.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and
-event.action:AddUserToGroup and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:AddUserToGroup and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -121,8 +102,6 @@ event.action:AddUserToGroup and event.outcome:success
 ** Name: Credential Access
 ** ID: TA0006
 ** Reference URL: https://attack.mitre.org/tactics/TA0006/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -131,37 +110,3 @@ event.action:AddUserToGroup and event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[aws-iam-user-addition-to-group-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:AddUserToGroup and event.dataset:aws.cloudtrail and
-event.provider:iam.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc
index 49322696a3..14d0f6eb30 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to disable or schedule the deletion of an AWS KMS Customer M
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies attempts to disable or schedule the deletion of an AWS KMS Customer M
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/cli/latest/reference/kms/disable-key.html
 * https://docs.aws.amazon.com/cli/latest/reference/kms/schedule-key-deletion.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Impact
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Tactic: Impact
 
-*Version*: 1
+*Version*: 3
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Xavier Pich
+* Xavier Pich
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A KMS customer managed key may be disabled or scheduled for deletion by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Key deletions by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:kms.amazonaws.com and
-event.action:("DisableKey" or "ScheduleKeyDeletion") and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:kms.amazonaws.com and event.action:("DisableKey" or "ScheduleKeyDeletion") and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc
index 51391b1327..0ed7313249 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc
@@ -5,7 +5,7 @@ Identifies a high number of failed authentication attempts to the AWS management
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,49 @@ Identifies a high number of failed authentication attempts to the AWS management
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<aws-management-console-brute-force-of-root-user-identity-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com
-and event.action:ConsoleLogin and
-aws.cloudtrail.user_identity.type:Root and event.outcome:failure
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and aws.cloudtrail.user_identity.type:Root and event.outcome:failure
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,22 +68,3 @@ aws.cloudtrail.user_identity.type:Root and event.outcome:failure
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[aws-management-console-brute-force-of-root-user-identity-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.13.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc
index ca7965778e..a4a6d0381a 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc
@@ -5,7 +5,7 @@ Identifies a successful login to the AWS Management Console by the Root user.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,54 +14,44 @@ Identifies a successful login to the AWS Management Console by the Root user.
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<aws-management-console-root-login-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-It's strongly recommended that the root user is not used for everyday tasks, including the administrative ones. Verify whether the IP address, location, and/or hostname should be logging in as root in your environment. Unfamiliar root logins should be investigated immediately. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS Management Console Root Login
 
-The AWS root account is the one identity that has complete access to all AWS services and resources in the account,
-which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your
-everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create
-your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and
-service management tasks. AWS provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
+The AWS root account is the one identity that has complete access to all AWS services and resources in the account, which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. AWS provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
 
 This rule looks for attempts to log in to the AWS Management Console as the root user.
 
@@ -69,8 +59,7 @@ This rule looks for attempts to log in to the AWS Management Console as the root
 
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Examine whether this activity is common in the environment by looking for past occurrences on your logs.
-- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the
-  calling user?
+- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user?
 - Examine the commands, API calls, and data management actions performed by the account in the last 24 hours.
 - Contact the account owner and confirm whether they are aware of this activity.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking access to servers,
@@ -78,8 +67,7 @@ services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- The alert can be dismissed if this operation is done under change management and approved according to the
-organization's policy for performing a task that needs this privilege level.
+- The alert can be dismissed if this operation is done under change management and approved according to the organization's policy for performing a task that needs this privilege level.
 
 ### Response and remediation
 
@@ -92,22 +80,17 @@ organization's policy for performing a task that needs this privilege level.
     - Identify if there are any regulatory or legal ramifications related to this activity.
 - Configure multi-factor authentication for the user.
 - Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com
-and event.action:ConsoleLogin and
-aws.cloudtrail.user_identity.type:Root and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and aws.cloudtrail.user_identity.type:Root and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -119,8 +102,6 @@ aws.cloudtrail.user_identity.type:Root and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -129,42 +110,3 @@ aws.cloudtrail.user_identity.type:Root and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[aws-management-console-root-login-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:ConsoleLogin and event.dataset:aws.cloudtrail and
-event.provider:signin.amazonaws.com and
-aws.cloudtrail.user_identity.type:Root and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:ConsoleLogin and event.module:aws and
-event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com
-and aws.cloudtrail.user_identity.type:Root and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc
index eedcf275aa..ecafbf07ec 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,62 +14,52 @@ Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/create-db-cluster.html
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBCluster.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/create-global-cluster.html
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateGlobalCluster.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-rds-cluster-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Valid clusters may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Cluster creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:(CreateDBCluster or CreateGlobalCluster) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:(CreateDBCluster or CreateGlobalCluster) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,47 +71,7 @@ event.outcome:success
 ** Name: External Remote Services
 ** ID: T1133
 ** Reference URL: https://attack.mitre.org/techniques/T1133/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
-
-[[aws-rds-cluster-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(CreateDBCluster or CreateGlobalCluster) and
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc
index 49d7ddf4d6..99f170e8b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc
@@ -5,7 +5,7 @@ Identifies that an Amazon Relational Database Service (RDS) cluster or instance
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,62 +14,52 @@ Identifies that an Amazon Relational Database Service (RDS) cluster or instance
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/stop-db-cluster.html
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBCluster.html
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/stop-db-instance.html
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBInstance.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-rds-instance-cluster-stoppage-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Valid clusters or instances may be stopped by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Cluster or instance stoppages from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:(StopDBCluster or StopDBInstance) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:(StopDBCluster or StopDBInstance) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,35 +71,3 @@ event.outcome:success
 ** Name: Service Stop
 ** ID: T1489
 ** Reference URL: https://attack.mitre.org/techniques/T1489/
-
-[[aws-rds-instance-cluster-stoppage-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(StopDBCluster or StopDBInstance) and
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc
index 1686c1be7e..7bdfb42be1 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of an Amazon Relational Database Service (RDS) Aurora da
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies the creation of an Amazon Relational Database Service (RDS) Aurora da
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-* Persistence
-
-*Version*: 101 (<<aws-rds-instance-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A database instance may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Instances creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:CreateDBInstance and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBInstance and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,22 +65,3 @@ event.action:CreateDBInstance and event.outcome:success
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[aws-rds-instance-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc
index ee3aa7f291..53eed16644 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of an Amazon Relational Database Service (RDS) Security
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,58 +14,49 @@ Identifies the creation of an Amazon Relational Database Service (RDS) Security
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSecurityGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 101 (<<aws-rds-security-group-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An RDS security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:CreateDBSecurityGroup and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBSecurityGroup and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,22 +68,7 @@ event.action:CreateDBSecurityGroup and event.outcome:success
 ** Name: Create Account
 ** ID: T1136
 ** Reference URL: https://attack.mitre.org/techniques/T1136/
-
-[[aws-rds-security-group-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Account
+** ID: T1136.003
+** Reference URL: https://attack.mitre.org/techniques/T1136/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc
index c7fcde3306..ae8599af9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Security
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,58 +14,49 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Security
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSecurityGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 101 (<<aws-rds-security-group-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An RDS security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:DeleteDBSecurityGroup and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:DeleteDBSecurityGroup and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,22 +68,3 @@ event.action:DeleteDBSecurityGroup and event.outcome:success
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[aws-rds-security-group-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc
index cd63737dfe..e76c21e9b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc
@@ -5,7 +5,7 @@ Identifies the export of an Amazon Relational Database Service (RDS) Aurora data
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies the export of an Amazon Relational Database Service (RDS) Aurora data
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-* Exfiltration
-
-*Version*: 101 (<<aws-rds-snapshot-export-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Exfiltration
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Exporting snapshots may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Snapshot exports from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:StartExportTask and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:StartExportTask and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,16 +65,3 @@ event.action:StartExportTask and event.outcome:success
 ** Name: Exfiltration
 ** ID: TA0010
 ** Reference URL: https://attack.mitre.org/tactics/TA0010/
-
-[[aws-rds-snapshot-export-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc
index 8a318676e3..d8f0a3dc06 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc
@@ -5,7 +5,7 @@ Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are so
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,51 @@ Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are so
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html
 * https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/rds__explore_snapshots/main.py
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-* Defense Evasion
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<aws-rds-snapshot-restored-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Restoring snapshots may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Snapshot restoration by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and
-event.action:RestoreDBInstanceFromDBSnapshot and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:RestoreDBInstanceFromDBSnapshot and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,22 +70,7 @@ event.action:RestoreDBInstanceFromDBSnapshot and event.outcome:success
 ** Name: Modify Cloud Compute Infrastructure
 ** ID: T1578
 ** Reference URL: https://attack.mitre.org/techniques/T1578/
-
-[[aws-rds-snapshot-restored-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Revert Cloud Instance
+** ID: T1578.004
+** Reference URL: https://attack.mitre.org/techniques/T1578/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc
index 1af914b762..2b00b72ec7 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of an Amazon Redshift cluster. Unexpected creation of th
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,49 @@ Identifies the creation of an Amazon Redshift cluster. Unexpected creation of th
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateCluster.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-* Persistence
-
-*Version*: 101 (<<aws-redshift-cluster-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Valid clusters may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Cluster creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:redshift.amazonaws.com
-and event.action:CreateCluster and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:redshift.amazonaws.com and event.action:CreateCluster and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,16 +64,3 @@ and event.action:CreateCluster and event.outcome:success
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[aws-redshift-cluster-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc
index 3190281b82..79e58457ca 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to login to AWS as the root user without using multi-factor
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,71 +14,56 @@ Identifies attempts to login to AWS as the root user without using multi-factor
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<aws-root-login-without-mfa-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Some organizations allow login with the root user without MFA, however, this is not considered best practice by AWS and increases the risk of compromised credentials.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS Root Login Without MFA
 
-Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your
-user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for
-their user name and password, as well as for an authentication code from their AWS MFA device. Taken together, these
-multiple factors provide increased security for your AWS account settings and resources.
+Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for their user name and password, as well as for an authentication code from their AWS MFA device. Taken together, these multiple factors provide increased security for your AWS account settings and resources.
 
 For more information about using MFA in AWS, access the [official documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html).
 
-The AWS root account is the one identity that has complete access to all AWS services and resources in the account,
-which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your
-everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create
-your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and
-service management tasks. Amazon provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
+The AWS root account is the one identity that has complete access to all AWS services and resources in the account, which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. Amazon provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
 
-This rule looks for attempts to log in to AWS as the root user without using multi-factor authentication (MFA), meaning
-the account is not secured properly.
+This rule looks for attempts to log in to AWS as the root user without using multi-factor authentication (MFA), meaning the account is not secured properly.
 
 #### Possible investigation steps
 
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Examine whether this activity is common in the environment by looking for past occurrences on your logs.
-- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the
-  calling user?
+- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user?
 - Examine the commands, API calls, and data management actions performed by the account in the last 24 hours.
 - Contact the account owner and confirm whether they are aware of this activity.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking access to servers,
@@ -86,8 +71,7 @@ services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- While this activity is not inherently malicious, the root account must use MFA. The security team should address any
-potential benign true positive (B-TP), as this configuration can risk the entire cloud environment.
+- While this activity is not inherently malicious, the root account must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the entire cloud environment.
 
 ### Response and remediation
 
@@ -100,24 +84,20 @@ potential benign true positive (B-TP), as this configuration can risk the entire
     - Identify if there are any regulatory or legal ramifications related to this activity.
 - Configure multi-factor authentication for the user.
 - Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com
-and event.action:ConsoleLogin and
-aws.cloudtrail.user_identity.type:Root and
-aws.cloudtrail.console_login.additional_eventdata.mfa_used:false and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and
+  aws.cloudtrail.user_identity.type:Root and
+  aws.cloudtrail.console_login.additional_eventdata.mfa_used:false and
+  event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -129,37 +109,3 @@ event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[aws-root-login-without-mfa-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:aws and event.dataset:aws.cloudtrail and
-event.provider:signin.amazonaws.com and event.action:ConsoleLogin and
-aws.cloudtrail.user_identity.type:Root and
-aws.cloudtrail.console_login.additional_eventdata.mfa_used:false and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc
index b7ec991bda..05f00b7d0a 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when a transfer lock was removed from a Route 53 domain. It is recomm
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,51 @@ Identifies when a transfer lock was removed from a Route 53 domain. It is recomm
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html
 * https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-route-53-domain-transfer-lock-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com
-and event.action:DisableDomainTransferLock and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com and event.action:DisableDomainTransferLock and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,22 +70,7 @@ and event.action:DisableDomainTransferLock and event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
 ** Reference URL: https://attack.mitre.org/tactics/TA0006/
-
-[[aws-route-53-domain-transfer-lock-disabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc
index 6fbe1670db..c0a026a590 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc
@@ -5,7 +5,7 @@ Identifies when a request has been made to transfer a Route 53 domain to another
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies when a request has been made to transfer a Route 53 domain to another
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-route-53-domain-transferred-to-another-account-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com
-and event.action:TransferDomainToAnotherAwsAccount and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com and event.action:TransferDomainToAnotherAwsAccount and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,22 +69,7 @@ event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
 ** Reference URL: https://attack.mitre.org/tactics/TA0006/
-
-[[aws-route-53-domain-transferred-to-another-account-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc
index 7396c3fc71..d049576792 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc
@@ -5,7 +5,7 @@ Identifies when an AWS Route Table has been created.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,62 +14,53 @@ Identifies when an AWS Route Table has been created.
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.datadoghq.com/security_platform/default_rules/aws-ec2-route-table-modified/
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-* Persistence
-
-*Version*: 101 (<<aws-route-table-created-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Route Tables may be created by a system or network administrators. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Route Table creation by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. Automated processes that use Terraform may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:(CreateRoute
-or CreateRouteTable) and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:(CreateRoute or CreateRouteTable) and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,29 +68,3 @@ or CreateRouteTable) and event.outcome:success
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[aws-route-table-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:(CreateRoute
-or CreateRouteTable) and event.outcome:success
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc
index a926f78323..ec7bd5841b 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies when an AWS Route Table has been modified or deleted.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,13 +14,13 @@ Identifies when an AWS Route Table has been modified or deleted.
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/easttimor/aws-incident-response#network-routing
 * https://docs.datadoghq.com/security_platform/default_rules/aws-ec2-route-table-modified/
@@ -30,51 +30,41 @@ Identifies when an AWS Route Table has been modified or deleted.
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-* Persistence
-
-*Version*: 101 (<<aws-route-table-modified-or-deleted-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Route Table could be modified or deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Route Table being modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. Also automated processes that use Terraform may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:cloudtrail.amazonaws.com and event.action:(ReplaceRoute
-or ReplaceRouteTableAssociation or DeleteRouteTable or DeleteRoute or
-DisassociateRouteTable) and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:(ReplaceRoute or ReplaceRouteTableAssociation or
+DeleteRouteTable or DeleteRoute or DisassociateRouteTable) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,22 +72,3 @@ DisassociateRouteTable) and event.outcome:success
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[aws-route-table-modified-or-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc
index 455b41fa13..2bc22f0481 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc
@@ -5,7 +5,7 @@ Identifies when a Route53 private hosted zone has been associated with VPC.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,58 +14,50 @@ Identifies when a Route53 private hosted zone has been associated with VPC.
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/Route53/latest/APIReference/API_AssociateVPCWithHostedZone.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Persistence
 
-*Version*: 101 (<<aws-route53-private-hosted-zone-associated-with-a-vpc-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A private hosted zone may be asssociated with a VPC by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com
-and event.action:AssociateVPCWithHostedZone and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com and event.action:AssociateVPCWithHostedZone and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,22 +69,3 @@ and event.action:AssociateVPCWithHostedZone and event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[aws-route53-private-hosted-zone-associated-with-a-vpc-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com
-and event.action:AssociateVPCWithHostedZone and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc
index 1cbfc38206..0832346dba 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of various Amazon Simple Storage Service (S3) bucket con
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,13 +14,13 @@ Identifies the deletion of various Amazon Simple Storage Service (S3) bucket con
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html
 * https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html
@@ -28,50 +28,42 @@ Identifies the deletion of various Amazon Simple Storage Service (S3) bucket con
 * https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html
 * https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketLifecycle.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<aws-s3-bucket-configuration-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Asset Visibility
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Bucket components may be deleted by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Bucket component deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:aws.cloudtrail and event.provider:s3.amazonaws.com and
-event.action:(DeleteBucketPolicy or DeleteBucketReplication or
-DeleteBucketCors or DeleteBucketEncryption or
-DeleteBucketLifecycle) and event.outcome:success
-----------------------------------
+  event.action:(DeleteBucketPolicy or DeleteBucketReplication or DeleteBucketCors or
+                DeleteBucketEncryption or DeleteBucketLifecycle)
+  and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,42 +72,6 @@ DeleteBucketLifecycle) and event.outcome:success
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[aws-s3-bucket-configuration-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(DeleteBucketPolicy or DeleteBucketReplication or
-DeleteBucketCors or DeleteBucketEncryption or DeleteBucketLifecycle)
-and event.dataset:aws.cloudtrail and event.provider:s3.amazonaws.com
-and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc
index 643fd0a857..6609c0a49f 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc
@@ -5,7 +5,7 @@ Identifies when SAML activity has occurred in AWS. An adversary could manipulate
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,51 @@ Identifies when SAML activity has occurred in AWS. An adversary could manipulate
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
 * https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<aws-saml-activity-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. SAML Provider updates by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-event.dataset:aws.cloudtrail and event.provider:(iam.amazonaws.com or
-sts.amazonaws.com) and event.action:(Assumerolewithsaml or
+event.dataset:aws.cloudtrail and event.provider:(iam.amazonaws.com or sts.amazonaws.com) and event.action:(Assumerolewithsaml or
 UpdateSAMLProvider) and event.outcome:success
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,8 +70,10 @@ UpdateSAMLProvider) and event.outcome:success
 ** Name: Use Alternate Authentication Material
 ** ID: T1550
 ** Reference URL: https://attack.mitre.org/techniques/T1550/
-
-
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -89,26 +82,3 @@ UpdateSAMLProvider) and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[aws-saml-activity-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:(iam.amazonaws.com or
-sts.amazonaws.com) and event.action:(Assumerolewithsaml or
-UpdateSAMLProvider) and event.outcome:success
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc
index 079699dc7a..8df3d83042 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc
@@ -5,7 +5,7 @@ Identifies a change to an AWS Security Group Configuration. A security group is
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,61 +14,52 @@ Identifies a change to an AWS Security Group Configuration. A security group is
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-security-groups.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<aws-security-group-configuration-change-detection-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.15.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:(AuthorizeSecurityGroupEgress or CreateSecurityGroup or
-ModifyInstanceAttribute or ModifySecurityGroupRules or
-RevokeSecurityGroupEgress or RevokeSecurityGroupIngress) and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(AuthorizeSecurityGroupEgress or
+CreateSecurityGroup or ModifyInstanceAttribute or ModifySecurityGroupRules or RevokeSecurityGroupEgress or
+RevokeSecurityGroupIngress) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,8 +67,6 @@ event.outcome:success
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -86,43 +75,7 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-security-group-configuration-change-detection-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:(AuthorizeSecurityGroupEgress or CreateSecurityGroup or
-ModifyInstanceAttribute or ModifySecurityGroupRules or
-RevokeSecurityGroupEgress or RevokeSecurityGroupIngress) and
-event.outcome:success
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and
-event.action:(AuthorizeSecurityGroupEgress or CreateSecurityGroup or
-ModifyInstanceAttribute or ModifySecurityGroupRules or
-RevokeSecurityGroupEgress or RevokeSecurityGroupIngress) and
-event.outcome:success
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc
index b0f74f5beb..18f6609298 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of AssumeRole. AssumeRole returns a set of temporary security
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,50 @@ Identifies the use of AssumeRole. AssumeRole returns a set of temporary security
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Privilege Escalation
 
-*Version*: 101 (<<aws-security-token-service-sts-assumerole-usage-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated processes that use Terraform may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and
-event.action:AssumedRole and
-aws.cloudtrail.user_identity.session_context.session_issuer.type:Role
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:AssumedRole and
+aws.cloudtrail.user_identity.session_context.session_issuer.type:Role and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,8 +69,6 @@ and event.outcome:success
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -89,27 +77,7 @@ and event.outcome:success
 ** Name: Use Alternate Authentication Material
 ** ID: T1550
 ** Reference URL: https://attack.mitre.org/techniques/T1550/
-
-[[aws-security-token-service-sts-assumerole-usage-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and
-event.action:AssumedRole and
-aws.cloudtrail.user_identity.session_context.session_issuer.type:Role
-and event.outcome:success
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc
index f53a713f82..7857a6aeef 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc
@@ -5,7 +5,7 @@ Identifies the suspicious use of GetSessionToken. Tokens could be created and us
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies the suspicious use of GetSessionToken. Tokens could be created and us
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Identity and Access Audit
+* Tactic: Privilege Escalation
 
-*Version*: 101 (<<aws-sts-getsessiontoken-abuse-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and
-event.action:GetSessionToken and
+event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:GetSessionToken and
 aws.cloudtrail.user_identity.type:IAMUser and event.outcome:success
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,8 +69,6 @@ aws.cloudtrail.user_identity.type:IAMUser and event.outcome:success
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -88,23 +77,7 @@ aws.cloudtrail.user_identity.type:IAMUser and event.outcome:success
 ** Name: Use Alternate Authentication Material
 ** ID: T1550
 ** Reference URL: https://attack.mitre.org/techniques/T1550/
-
-[[aws-sts-getsessiontoken-abuse-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and
-event.action:GetSessionToken and
-aws.cloudtrail.user_identity.type:IAMUser and event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc
index b7de6a6d41..093301dc26 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (E
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,55 +14,47 @@ Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (E
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
 * https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-* Investigation Guide
-
-*Version*: 103 (<<aws-vpc-flow-logs-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Log Auditing
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Flow log deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating AWS VPC Flow Logs Deletion
 
-VPC Flow Logs is an AWS feature that enables you to capture information about the IP traffic going to and from network
-interfaces in your virtual private cloud (VPC). Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.
+VPC Flow Logs is an AWS feature that enables you to capture information about the IP traffic going to and from network interfaces in your virtual private cloud (VPC). Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.
 
-This rule identifies the deletion of VPC flow logs using the API `DeleteFlowLogs` action. Attackers can do this to cover
-their tracks and impact security monitoring that relies on this source.
+This rule identifies the deletion of VPC flow logs using the API `DeleteFlowLogs` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
 #### Possible investigation steps
 
@@ -72,19 +64,14 @@ their tracks and impact security monitoring that relies on this source.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and IP address conditions.
-- Administrators may rotate these logs after a certain period as part of their retention policy or after importing them
-to a SIEM.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
+- Administrators may rotate these logs after a certain period as part of their retention policy or after importing them to a SIEM.
 
 ### Response and remediation
 
@@ -96,30 +83,24 @@ to a SIEM.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and
-event.action:DeleteFlowLogs and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:DeleteFlowLogs and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -131,39 +112,7 @@ event.action:DeleteFlowLogs and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-vpc-flow-logs-deletion-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Rule name changed from: AWS EC2 Flow Log Deletion
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteFlowLogs and event.dataset:aws.cloudtrail and
-event.provider:ec2.amazonaws.com and event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc
index ba6b9624bf..d7d66901ad 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a specified AWS Web Application Firewall (WAF) access
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,59 +14,50 @@ Identifies the deletion of a specified AWS Web Application Firewall (WAF) access
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/waf-regional/delete-web-acl.html
 * https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteWebACL.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<aws-waf-access-control-list-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Firewall ACL's may be deleted by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Web ACL deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.action:DeleteWebACL and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.action:DeleteWebACL and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,40 +69,7 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-waf-access-control-list-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:DeleteWebACL and event.dataset:aws.cloudtrail and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc
index bf214030e1..a51c7ef26c 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule o
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-aws*
@@ -14,60 +14,50 @@ Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule o
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://awscli.amazonaws.com/v2/documentation/api/latest/reference/waf/delete-rule-group.html
 * https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<aws-waf-rule-or-rule-group-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-WAF rules or rule groups may be deleted by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Rule deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.provider:(waf.amazonaws.com or
-waf-regional.amazonaws.com or wafv2.amazonaws.com) and
-event.action:(DeleteRule or DeleteRuleGroup) and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:aws.cloudtrail and event.provider:(waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) and event.action:(DeleteRule or DeleteRuleGroup) and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,49 +69,7 @@ event.action:(DeleteRule or DeleteRuleGroup) and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[aws-waf-rule-or-rule-group-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:aws.cloudtrail and event.action:(DeleteRule or
-DeleteRuleGroup) and event.outcome:success
-----------------------------------
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:aws and event.dataset:aws.cloudtrail and
-event.action:(DeleteRule or DeleteRuleGroup) and event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc
index 5567cc8263..52bbdfe300 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc
@@ -5,7 +5,7 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,42 +14,40 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk
 * https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
 * https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<azure-active-directory-high-risk-sign-in-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Willem D'Haese
+* Elastic
+* Willem D'Haese
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -68,13 +66,11 @@ This rule identifies events produced by Microsoft Identity Protection with high
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and device conditions.
+If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
 
 ### Response and remediation
 
@@ -86,31 +82,24 @@ combination of user and device conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:azure.signinlogs and
-(azure.signinlogs.properties.risk_level_during_signin:high or
-azure.signinlogs.properties.risk_level_aggregated:high) and
-event.outcome:(success or Success)
-----------------------------------
+  (azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high) and
+  event.outcome:(success or Success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -122,29 +111,3 @@ event.outcome:(success or Success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[azure-active-directory-high-risk-sign-in-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.15.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.signinlogs and
-azure.signinlogs.properties.risk_level_during_signin:high and
-event.outcome:(success or Success)
-----------------------------------
-
-Version 2 (7.13.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc
index 8ee40cc5c4..bbc7978c2b 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc
@@ -5,7 +5,7 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,43 +14,40 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
 * https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
 * https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk
 * https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#investigation-framework
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
 
-*Version*: 103 (<<azure-active-directory-high-risk-user-sign-in-heuristic-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 8.0.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -58,8 +55,7 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 
 Microsoft Identity Protection is an Azure AD security tool that detects various types of identity risks and attacks.
 
-This rule identifies events produced by the Microsoft Identity Protection with a risk state equal to `confirmedCompromised`
-or `atRisk`.
+This rule identifies events produced by the Microsoft Identity Protection with a risk state equal to `confirmedCompromised` or `atRisk`.
 
 #### Possible investigation steps
 
@@ -70,13 +66,11 @@ or `atRisk`.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and device conditions.
+If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
 
 ### Response and remediation
 
@@ -88,30 +82,23 @@ combination of user and device conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:azure.signinlogs and
-azure.signinlogs.properties.risk_state:("confirmedCompromised" or
-"atRisk") and event.outcome:(success or Success)
-----------------------------------
+  azure.signinlogs.properties.risk_state:("confirmedCompromised" or "atRisk") and event.outcome:(success or Success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -123,16 +110,3 @@ azure.signinlogs.properties.risk_state:("confirmedCompromised" or
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[azure-active-directory-high-risk-user-sign-in-heuristic-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc
index 13c5c9ef8d..2f4d67829a 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc
@@ -5,7 +5,7 @@ Identifies a sign-in using the Azure Active Directory PowerShell module. PowerSh
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,57 +14,46 @@ Identifies a sign-in using the Azure Active Directory PowerShell module. PowerSh
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
 * https://docs.microsoft.com/en-us/microsoft-365/enterprise/connect-to-microsoft-365-powershell?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<azure-active-directory-powershell-sign-in-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Sign-ins using PowerShell may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be signing into your environment. Sign-ins from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Azure Active Directory PowerShell Sign-in
 
-Azure Active Directory PowerShell for Graph (Azure AD PowerShell) is a module IT professionals commonly use to manage
-their Azure Active Directory. The cmdlets in the Azure AD PowerShell module enable you to retrieve data from the
-directory, create new objects in the directory, update existing objects, remove objects, as well as configure the
-directory and its features.
+Azure Active Directory PowerShell for Graph (Azure AD PowerShell) is a module IT professionals commonly use to manage their Azure Active Directory. The cmdlets in the Azure AD PowerShell module enable you to retrieve data from the directory, create new objects in the directory, update existing objects, remove objects, as well as configure the directory and its features.
 
-This rule identifies sign-ins that use the Azure Active Directory PowerShell module, which can indicate unauthorized
-access if done outside of IT or engineering.
+This rule identifies sign-ins that use the Azure Active Directory PowerShell module, which can indicate unauthorized access if done outside of IT or engineering.
 
 #### Possible investigation steps
 
@@ -73,15 +62,12 @@ access if done outside of IT or engineering.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Consider the source IP address and geolocation for the involved user account. Do they look normal?
 - Contact the account owner and confirm whether they are aware of this activity.
-- Investigate suspicious actions taken by the user using the module, for example, modifications in security settings
-that weakens the security policy, persistence-related tasks, and data access.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- Investigate suspicious actions taken by the user using the module, for example, modifications in security settings that weakens the security policy, persistence-related tasks, and data access.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- If this activity is expected and noisy in your environment, consider adding IT, Engineering, and other authorized users
-as exceptions — preferably with a combination of user and device conditions.
+- If this activity is expected and noisy in your environment, consider adding IT, Engineering, and other authorized users as exceptions — preferably with a combination of user and device conditions.
 
 ### Response and remediation
 
@@ -93,32 +79,24 @@ as exceptions — preferably with a combination of user and device conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:azure.signinlogs and
-azure.signinlogs.properties.app_display_name:"Azure Active Directory
-PowerShell" and
-azure.signinlogs.properties.token_issuer_type:AzureAD and
-event.outcome:(success or Success)
-----------------------------------
+  azure.signinlogs.properties.app_display_name:"Azure Active Directory PowerShell" and
+  azure.signinlogs.properties.token_issuer_type:AzureAD and event.outcome:(success or Success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -130,25 +108,7 @@ event.outcome:(success or Success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[azure-active-directory-powershell-sign-in-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc
index bb310074ee..481a3798c7 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc
@@ -5,7 +5,7 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,57 +14,50 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#global-administrator
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-ad-global-administrator-role-assigned-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.properties.category:RoleManagement and
-azure.auditlogs.operation_name:"Add member to role" and azure.auditlog
-s.properties.target_resources.0.modified_properties.1.new_value:"\"Glo
-bal Administrator\""
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.properties.category:RoleManagement and
+azure.auditlogs.operation_name:"Add member to role" and
+azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value:"\"Global Administrator\""
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,19 +69,7 @@ bal Administrator\""
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[azure-ad-global-administrator-role-assigned-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Additional Cloud Roles
+** ID: T1098.003
+** Reference URL: https://attack.mitre.org/techniques/T1098/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc
index 3088d81dcb..7c4a8a7936 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of suppression rules in Azure. Suppression rules are a m
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,60 +14,50 @@ Identifies the creation of suppression rules in Azure. Suppression rules are a m
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 * https://docs.microsoft.com/en-us/rest/api/securitycenter/alerts-suppression-rules/update
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<azure-alert-suppression-rule-created-or-modified-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 8.0.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Suppression Rules can be created legitimately by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Suppression Rules created by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE" and event.outcome:
-"success"
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE" and
+event.outcome: "success"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,26 +69,3 @@ event.dataset:azure.activitylogs and azure.activitylogs.operation_name
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-alert-suppression-rule-created-or-modified-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE" and event.outcome:
-"success"
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc
index ebc700fc5f..b20e83c829 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when a new credential is added to an application in Azure. An applica
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies when a new credential is added to an application in Azure. An applica
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-application-credential-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Application credential additions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Application credential additions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Update application - Certificates and
-secrets management" and event.outcome:(success or Success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update application - Certificates and secrets management" and event.outcome:(success or Success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,25 +67,7 @@ secrets management" and event.outcome:(success or Success)
 ** Name: Use Alternate Authentication Material
 ** ID: T1550
 ** Reference URL: https://attack.mitre.org/techniques/T1550/
-
-[[azure-application-credential-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc
index 6d8f5a5ccf..5576427780 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Azure Automation account is created. Azure Automation account
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,58 +14,51 @@ Identifies when an Azure Automation account is created. Azure Automation account
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://powerzure.readthedocs.io/en/latest/Functions/operational.html#create-backdoor
 * https://github.com/hausec/PowerZure
 * https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a
 * https://azure.microsoft.com/en-in/blog/azure-automation-runbook-management/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-automation-account-created-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WRITE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WRITE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +70,6 @@ event.outcome:(Success or success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -87,42 +78,3 @@ event.outcome:(Success or success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[azure-automation-account-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WRITE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WRITE and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc
index 639c4a4344..5ceb539cb2 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Azure Automation runbook is created or modified. An adversary
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,100 +14,55 @@ Identifies when an Azure Automation runbook is created or modified. An adversary
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://powerzure.readthedocs.io/en/latest/Functions/operational.html#create-backdoor
 * https://github.com/hausec/PowerZure
 * https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a
 * https://azure.microsoft.com/en-in/blog/azure-automation-runbook-management/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<azure-automation-runbook-created-or-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name: (
-"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE" or
-"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE" or
-"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION" )
-and event.outcome:(Success or success)
-----------------------------------
-
-
-[[azure-automation-runbook-created-or-modified-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:(MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE or
-MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE or
-MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION) and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
+event.dataset:azure.activitylogs and
+  azure.activitylogs.operation_name:
+  (
+    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE" or
+    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE" or
+    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION"
+  ) and
+  event.outcome:(Success or success)
 
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
 ----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:(MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE or
-MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE or
-MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION) and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc
index 1021cad802..309833f4fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Azure Automation runbook is deleted. An adversary may delete
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,53 @@ Identifies when an Azure Automation runbook is deleted. An adversary may delete
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://powerzure.readthedocs.io/en/latest/Functions/operational.html#create-backdoor
 * https://github.com/hausec/PowerZure
 * https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a
 * https://azure.microsoft.com/en-in/blog/azure-automation-runbook-management/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 101 (<<azure-automation-runbook-deleted-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_
-name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and
+    azure.activitylogs.operation_name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and
+    event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,56 +68,3 @@ event.outcome:(Success or success)
 ** Name: Defense Evasion
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
-
-[[azure-automation-runbook-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_
-name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc
index 8e87957426..5d76b6e861 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Azure Automation webhook is created. Azure Automation runbook
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,97 +14,54 @@ Identifies when an Azure Automation webhook is created. Azure Automation runbook
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://powerzure.readthedocs.io/en/latest/Functions/operational.html#create-backdoor
 * https://github.com/hausec/PowerZure
 * https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a
 * https://www.ciraltos.com/webhooks-and-azure-automation-runbooks/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<azure-automation-webhook-created-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name: (
-"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/ACTION" or
-"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE" ) and
-event.outcome:(Success or success)
-----------------------------------
-
-
-[[azure-automation-webhook-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:(MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/ACTION or
-MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE) and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
+event.dataset:azure.activitylogs and
+  azure.activitylogs.operation_name:
+    (
+      "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/ACTION" or
+      "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE"
+    ) and
+  event.outcome:(Success or success)
 
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
 ----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:(MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/ACTION or
-MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE) and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc
index 2ec5905d72..f2b2a2dcb2 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies changes to container access levels in Azure. Anonymous public read ac
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies changes to container access levels in Azure. Anonymous public read ac
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
-
-*Version*: 101 (<<azure-blob-container-access-level-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Asset Visibility
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Access level modifications may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Access level modifications from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,8 +67,6 @@ event.outcome:(Success or success)
 ** Name: Cloud Service Discovery
 ** ID: T1526
 ** Reference URL: https://attack.mitre.org/techniques/T1526/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -88,42 +75,3 @@ event.outcome:(Success or success)
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[azure-blob-container-access-level-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc
index 323796feee..a32dc4e807 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when the Azure role-based access control (Azure RBAC) permissions are
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,61 +14,51 @@ Identifies when the Azure role-based access control (Azure RBAC) permissions are
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<azure-blob-permissions-modification-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Blob permissions may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name:( "MICROSOFT.STORAGE/STORAGEACC
-OUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION" or "M
-ICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYP
-ERMISSIONS/ACTION") and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(
+     "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION" or
+     "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYPERMISSIONS/ACTION") and
+  event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,25 +70,3 @@ ERMISSIONS/ACTION") and event.outcome:(Success or success)
 ** Name: File and Directory Permissions Modification
 ** ID: T1222
 ** Reference URL: https://attack.mitre.org/techniques/T1222/
-
-[[azure-blob-permissions-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name:( "MICROSOFT.STORAGE/STORAGEACC
-OUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION" or "M
-ICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYP
-ERMISSIONS/ACTION") and event.outcome:(Success or success)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc
index 14a62038b1..571caaa1e5 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc
@@ -5,7 +5,7 @@ Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,61 +14,50 @@ Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://adsecurity.org/?p=4277
 * https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 101 (<<azure-command-execution-on-virtual-machine-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Log Auditing
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Command execution on a virtual machine may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Command execution from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,42 +69,3 @@ event.outcome:(Success or success)
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[azure-command-execution-on-virtual-machine-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc
index bf53ca2e54..708bdff0e8 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Azure Conditional Access policy is modified. Azure Conditiona
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,55 +14,49 @@ Identifies when an Azure Conditional Access policy is modified. Azure Conditiona
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<azure-conditional-access-policy-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:(azure.activitylogs or azure.auditlogs) and
-event.action:"Update conditional access policy" and
-event.outcome:(Success or success)
-----------------------------------
+event.action:"Update conditional access policy" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,47 +68,3 @@ event.outcome:(Success or success)
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[azure-conditional-access-policy-modified-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(azure.activitylogs or azure.auditlogs) and (
-azure.activitylogs.operation_name:"Update policy" or
-azure.auditlogs.operation_name:"Update policy" ) and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(azure.activitylogs or azure.auditlogs) and (
-azure.activitylogs.operation_name:"Update policy" or
-azure.auditlogs.operation_name:"Update policy" ) and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc
index 7c1e5709db..2ba4ca859e 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of diagnostic settings in Azure, which send platform log
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,47 @@ Identifies the deletion of diagnostic settings in Azure, which send platform log
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 101 (<<azure-diagnostic-settings-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Deletion of diagnostic settings may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Diagnostic settings deletion from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,42 +66,7 @@ event.outcome:(Success or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-diagnostic-settings-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE and
-event.outcome:Success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc
index 7102e21784..426015a78d 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc
@@ -5,7 +5,7 @@ Identifies when an Event Hub Authorization Rule is created or updated in Azure.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies when an Event Hub Authorization Rule is created or updated in Azure.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 101 (<<azure-event-hub-authorization-rule-created-or-updated-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Log Auditing
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Authorization rule additions or modifications may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Authorization rule additions or modifications from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,11 +64,9 @@ event.outcome:(Success or success)
 ** ID: TA0009
 ** Reference URL: https://attack.mitre.org/tactics/TA0009/
 * Technique:
-** Name: Data from Cloud Storage Object
+** Name: Data from Cloud Storage
 ** ID: T1530
 ** Reference URL: https://attack.mitre.org/techniques/T1530/
-
-
 * Tactic:
 ** Name: Exfiltration
 ** ID: TA0010
@@ -88,42 +75,3 @@ event.outcome:(Success or success)
 ** Name: Transfer Data to Cloud Account
 ** ID: T1537
 ** Reference URL: https://attack.mitre.org/techniques/T1537/
-
-[[azure-event-hub-authorization-rule-created-or-updated-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc
index f326214376..d14060328b 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies an Event Hub deletion in Azure. An Event Hub is an event processing s
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,61 +14,50 @@ Identifies an Event Hub deletion in Azure. An Event Hub is an event processing s
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about
 * https://azure.microsoft.com/en-in/services/event-hubs/
 * https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-features
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 101 (<<azure-event-hub-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Log Auditing
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Event Hub deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Event Hub deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,45 +69,7 @@ event.outcome:(Success or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-event-hub-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE and
-event.outcome:Success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc
index 2fe41f6ec6..c84bb7b894 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc
@@ -5,7 +5,7 @@ Identifies an invitation to an external user in Azure Active Directory (AD). Azu
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,60 +14,48 @@ Identifies an invitation to an external user in Azure Active Directory (AD). Azu
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-1-0
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-external-guest-user-invitation-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Guest user invitations may be sent out by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Guest user invitations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Invite external user" and
-azure.auditlogs.properties.target_resources.*.display_name:guest and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Invite external user" and azure.auditlogs.properties.target_resources.*.display_name:guest and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,8 +67,6 @@ event.outcome:(Success or success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -89,36 +75,3 @@ event.outcome:(Success or success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[azure-external-guest-user-invitation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Invite external user" and
-azure.auditlogs.properties.target_resources.*.display_name:guest and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc
index 3b324e105d..114e2b6a33 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a firewall policy in Azure. An adversary may delete a
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies the deletion of a firewall policy in Azure. An adversary may delete a
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/firewall-manager/policy-overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<azure-firewall-policy-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Firewall policy deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Firewall policy deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,44 +67,7 @@ event.outcome:(Success or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-firewall-policy-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE and event.outcome:(Success
-or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE and event.outcome:Success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc
index fe95988d6b..315d0a2c8c 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#networking
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Network Security
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<azure-frontdoor-web-application-firewall-waf-policy-deleted-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Azure Front Web Application Firewall (WAF) Policy deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Azure Front Web Application Firewall (WAF) Policy deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.NETWORK/FRONTDOORWEBAPPLICATIONFIREWALLPOLICIES/DELETE"
-and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/FRONTDOORWEBAPPLICATIONFIREWALLPOLICIES/DELETE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,19 +67,7 @@ and event.outcome:(Success or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-frontdoor-web-application-firewall-waf-policy-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc
index 50b5cd80fe..f0350e0323 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc
@@ -5,7 +5,7 @@ Identifies potential full network packet capture in Azure. Packet Capture is an
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,62 +14,53 @@ Identifies potential full network packet capture in Azure. Packet Capture is an
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Monitoring
+* Domain: Cloud
+* Data Source: Azure
+* Tactic: Credential Access
 
-*Version*: 101 (<<azure-full-network-packet-capture-detected-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Full Network Packet Capture may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Full Network Packet Capture from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name: (
-"MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION" or
-"MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION" or
-"MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE" ) and
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:
+    (
+        MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION or
+        MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION or
+        MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE
+    ) and
 event.outcome:(Success or success)
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,26 +72,3 @@ event.outcome:(Success or success)
 ** Name: Network Sniffing
 ** ID: T1040
 ** Reference URL: https://attack.mitre.org/techniques/T1040/
-
-[[azure-full-network-packet-capture-detected-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name: (
-"MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION" or
-"MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION" or
-"MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE" ) and
-event.outcome:(Success or success)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc
index a9575a261f..5343ac7f7b 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc
@@ -5,7 +5,7 @@ Identifies an Azure Active Directory (AD) Global Administrator role addition to
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,63 +14,52 @@ Identifies an Azure Active Directory (AD) Global Administrator role addition to
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-global-administrator-role-addition-to-pim-user-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Global administrator additions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Global administrator additions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.properties.category:RoleManagement and
-azure.auditlogs.operation_name:("Add eligible member to role in PIM
-completed (permanent)" or "Add
-member to role in PIM completed (timebound)") and
-azure.auditlogs.properties.target_resources.*.display_name:"Global
-Administrator" and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.properties.category:RoleManagement and
+    azure.auditlogs.operation_name:("Add eligible member to role in PIM completed (permanent)" or
+                                    "Add member to role in PIM completed (timebound)") and
+    azure.auditlogs.properties.target_resources.*.display_name:"Global Administrator" and
+    event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,39 +71,3 @@ Administrator" and event.outcome:(Success or success)
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[azure-global-administrator-role-addition-to-pim-user-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.properties.category:RoleManagement and
-azure.auditlogs.operation_name:("Add eligible member to role in PIM
-completed (permanent)" or "Add member to role in PIM completed
-(timebound)") and
-azure.auditlogs.properties.target_resources.*.display_name:"Global
-Administrator" and event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc
index 2117884214..3cf20294f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to a Key Vault in Azure. The Key Vault is a service tha
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,61 +14,49 @@ Identifies modifications to a Key Vault in Azure. The Key Vault is a service tha
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts
 * https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Data Protection
-
-*Version*: 102 (<<azure-key-vault-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Key vault modifications may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Key vault modifications from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name:"MICROSOFT.KEYVAULT/VAULTS/WRITE"
-and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.KEYVAULT/VAULTS/WRITE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,42 +68,7 @@ and event.outcome:(Success or success)
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-[[azure-key-vault-modified-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name:MICROSOFT.KEYVAULT/VAULTS/WRITE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name:MICROSOFT.KEYVAULT/VAULTS/WRITE and
-event.outcome:Success
-----------------------------------
-
+* Sub-technique:
+** Name: Credentials In Files
+** ID: T1552.001
+** Reference URL: https://attack.mitre.org/techniques/T1552/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc
index 6c2d98644c..803416351d 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies when events are deleted in Azure Kubernetes. Kubernetes events are ob
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,49 @@ Identifies when events are deleted in Azure Kubernetes. Kubernetes events are ob
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Log Auditing
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Log Auditing
+* Tactic: Defense Evasion
 
-*Version*: 101 (<<azure-kubernetes-events-deleted-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Events deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE"
-and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE" and
+event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,32 +68,7 @@ and event.outcome:(Success or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-kubernetes-events-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE"
-and event.outcome:(Success or success)
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc
index b8cd4a8191..62e26f3bfe 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kuber
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,49 @@ Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kuber
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Asset Visibility
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Asset Visibility
+* Tactic: Impact
 
-*Version*: 101 (<<azure-kubernetes-pods-deleted-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Pods deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE" and
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE" and
 event.outcome:(Success or success)
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,29 +64,3 @@ event.outcome:(Success or success)
 ** Name: Impact
 ** ID: TA0040
 ** Reference URL: https://attack.mitre.org/tactics/TA0040/
-
-[[azure-kubernetes-pods-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE" and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc
index 57e3a6c92a..50d87dfe47 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of role binding or cluster role bindings. You can assign
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,58 +14,52 @@ Identifies the creation of role binding or cluster role bindings. You can assign
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
 * https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Privilege Escalation
 
-*Version*: 101 (<<azure-kubernetes-rolebindings-created-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 8.0.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name: ("MICROSOFT.KUBERNETES/CONN
-ECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE" or
-"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUS
-TERROLEBINDINGS/WRITE") and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:
+	("MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE" or
+	 "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE") and
+event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,25 +67,3 @@ TERROLEBINDINGS/WRITE") and event.outcome:(Success or success)
 ** Name: Privilege Escalation
 ** ID: TA0004
 ** Reference URL: https://attack.mitre.org/tactics/TA0004/
-
-[[azure-kubernetes-rolebindings-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and
-azure.activitylogs.operation_name: ("MICROSOFT.KUBERNETES/CONN
-ECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE" or
-"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUS
-TERROLEBINDINGS/WRITE") and event.outcome:(Success or success)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc
index 2abfa8985d..d94f3640f8 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a Network Watcher in Azure. Network Watchers are used
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies the deletion of a Network Watcher in Azure. Network Watchers are used
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Network Security
-
-*Version*: 101 (<<azure-network-watcher-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Network Security Monitoring
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Network Watcher deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Network Watcher deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE" and event.outcome:(Success
-or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,44 +67,7 @@ or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-network-watcher-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE and event.outcome:(Success
-or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE and event.outcome:Success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc
index 8e47a8c9f3..2b76402507 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc
@@ -5,7 +5,7 @@ Azure Active Directory (AD) Privileged Identity Management (PIM) is a service th
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,65 +14,57 @@ Azure Active Directory (AD) Privileged Identity Management (PIM) is a service th
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles-assign-roles
 * https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<azure-privilege-identity-management-role-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Azure Privilege Identity Management Role Modified
 
-Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and
-monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles
-such as Global Administrator and Application Administrator.
+Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator.
 
-This rule identifies the update of PIM role settings, which can indicate that an attacker has already gained enough
-access to modify role assignment settings.
+This rule identifies the update of PIM role settings, which can indicate that an attacker has already gained enough access to modify role assignment settings.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Consider the source IP address and geolocation for the user who issued the command. Do they look normal for the user?
-- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal
-time of day?
+- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Examine the account's commands, API calls, and data management actions in the last 24 hours.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
@@ -88,31 +80,23 @@ and data accessed by the account in the last 24 hours.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Restore the PIM roles to the desired state.
 - Consider enabling multi-factor authentication for users.
 - Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Update role setting in PIM" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update role setting in PIM" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -124,8 +108,6 @@ event.outcome:(Success or success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -134,35 +116,3 @@ event.outcome:(Success or success)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[azure-privilege-identity-management-role-modified-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Update role setting in PIM" and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc
index b7f12bbdbf..5dcd685891 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a resource group in Azure, which includes all resourc
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies the deletion of a resource group in Azure, which includes all resourc
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 101 (<<azure-resource-group-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Log Auditing
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Deletion of a resource group may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Resource group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,8 +67,6 @@ event.outcome:(Success or success)
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -88,42 +75,7 @@ event.outcome:(Success or success)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[azure-resource-group-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE and
-event.outcome:Success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc
index 95b59a3846..be292479fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc
@@ -5,7 +5,7 @@ Identifies when a new service principal is added in Azure. An application, hoste
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,75 +14,61 @@ Identifies when a new service principal is added in Azure. An application, hoste
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
 * https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<azure-service-principal-addition-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A service principal may be created by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Service principal additions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Azure Service Principal Addition
 
-Service Principals are identities used by applications, services, and automation tools to access specific resources.
-They grant specific access based on the assigned API permissions. Most organizations that work a lot with Azure AD make
-use of service principals. Whenever an application is registered, it automatically creates an application object and a
-service principal in an Azure AD tenant.
+Service Principals are identities used by applications, services, and automation tools to access specific resources. They grant specific access based on the assigned API permissions. Most organizations that work a lot with Azure AD make use of service principals. Whenever an application is registered, it automatically creates an application object and a service principal in an Azure AD tenant.
 
-This rule looks for the addition of service principals. This behavior may enable attackers to impersonate legitimate
-service principals to camouflage their activities among noisy automations/apps.
+This rule looks for the addition of service principals. This behavior may enable attackers to impersonate legitimate service principals to camouflage their activities among noisy automations/apps.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Consider the source IP address and geolocation for the user who issued the command. Do they look normal for the user?
-- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal
-time of day?
+- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?
 - Check if this operation was approved and performed according to the organization's change management policy.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Examine the account's commands, API calls, and data management actions in the last 24 hours.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a
-combination of user and device conditions.
+If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
 
 ### Response and remediation
 
@@ -94,29 +80,22 @@ combination of user and device conditions.
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other
-IAM users.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-service principal" and event.outcome:(success or Success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal" and event.outcome:(success or Success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -128,25 +107,7 @@ service principal" and event.outcome:(success or Success)
 ** Name: Use Alternate Authentication Material
 ** ID: T1550
 ** Reference URL: https://attack.mitre.org/techniques/T1550/
-
-[[azure-service-principal-addition-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc
index 48b8301538..42459bb422 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc
@@ -5,7 +5,7 @@ Identifies when new Service Principal credentials have been added in Azure. In m
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,58 +14,49 @@ Identifies when new Service Principal credentials have been added in Azure. In m
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/content/dam/collateral/en/wp-m-unc2452.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-service-principal-credentials-added-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Service principal credential additions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Credential additions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-service principal credentials" and event.outcome:(success or Success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal credentials" and event.outcome:(success or Success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,25 +68,3 @@ service principal credentials" and event.outcome:(success or Success)
 ** Name: Resource Hijacking
 ** ID: T1496
 ** Reference URL: https://attack.mitre.org/techniques/T1496/
-
-[[azure-service-principal-credentials-added-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-service principal credentials." and event.outcome:(success or Success)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc
index 9682a2464c..04e8f8637f 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc
@@ -5,7 +5,7 @@ Identifies a rotation to storage account access keys in Azure. Regenerating acce
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,59 +14,48 @@ Identifies a rotation to storage account access keys in Azure. Regenerating acce
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<azure-storage-account-key-regenerated-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-It's recommended that you rotate your access keys periodically to help keep your storage account secure. Normal key rotation can be exempted from the rule. An abnormal time frame and/or a key rotation from unfamiliar users, hosts, or locations should be investigated.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:"MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,42 +67,3 @@ event.outcome:(Success or success)
 ** Name: Steal Application Access Token
 ** ID: T1528
 ** Reference URL: https://attack.mitre.org/techniques/T1528/
-
-[[azure-storage-account-key-regenerated-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and
-event.outcome:(Success or success)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc
index 4d99614495..d7cbdd5d9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies when a virtual network device is modified or deleted. This can be a n
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,70 +14,54 @@ Identifies when a virtual network device is modified or deleted. This can be a n
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Network Security
-* Impact
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Network Security Monitoring
+* Tactic: Impact
 
-*Version*: 101 (<<azure-virtual-network-device-modified-or-deleted-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Virtual Network Device modification or deletion may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Virtual Network Device modification or deletion by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or
-"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or
-"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or
-"MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and event.outcome:(Success
-or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
+"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
+"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or
+"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
+"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or "MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
+"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or "MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and
+event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,53 +69,3 @@ or success)
 ** Name: Impact
 ** ID: TA0040
 ** Reference URL: https://attack.mitre.org/tactics/TA0040/
-
-[[azure-virtual-network-device-modified-or-deleted-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or
-"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or
-"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or
-"MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and event.outcome:(Success
-or success)
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.activitylogs and azure.activitylogs.operation_name
-:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or
-"MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE"or
-"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or
-"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or
-"MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or
-"MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and event.outcome:(Success
-or success)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc
index 5d3ee9f10a..e3fed0ef20 100644
--- a/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc
@@ -5,53 +5,50 @@ Adversaries may encode/decode data in an attempt to evade detection by host- or
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<base16-or-base32-encoding-decoding-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated tools such as Jenkins may encode or decode files as part of their normal behavior. These events can be filtered by the process executable or username values.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(base16 or base32 or base32plain or base32hex)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
+  process.name:(base16 or base32 or base32plain or base32hex)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -60,40 +57,10 @@ process.name:(base16 or base32 or base32plain or base32hex)
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
 ** Name: Deobfuscate/Decode Files or Information
 ** ID: T1140
 ** Reference URL: https://attack.mitre.org/techniques/T1140/
-
-[[base16-or-base32-encoding-decoding-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(executed or process_started) and process.name:(base16 or
-base32 or base32plain or base32hex)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/bash-shell-profile-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/bash-shell-profile-modification.asciidoc
index 0cdd466f03..07bee56784 100644
--- a/docs/detections/prebuilt-rules/rule-details/bash-shell-profile-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bash-shell-profile-modification.asciidoc
@@ -5,7 +5,7 @@ Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * auditbeat-*
@@ -14,61 +14,64 @@ Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Linux
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<bash-shell-profile-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Changes to the Shell Profile tend to be noisy, a tuning per your environment will be required.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and event.type:change and process.name:(* and
-not (sudo or vim or
-zsh or env or
-nano or bash or
-Terminal or xpcproxy or
-login or cat or
-cp or launchctl or
-java)) and not process.executable:(/Applications/* or
-/private/var/folders/* or /usr/local/*) and
-file.path:(/private/etc/rc.local or /etc/rc.local or
-/home/*/.profile or /home/*/.profile1 or
-/home/*/.bash_profile or /home/*/.bash_profile1 or
-/home/*/.bashrc or /Users/*/.bash_profile or
-/Users/*/.zshenv)
+[source, js]
 ----------------------------------
+event.category:file and event.type:change and
+  process.name:(* and not (sudo or
+                           vim or
+                           zsh or
+                           env or
+                           nano or
+                           bash or
+                           Terminal or
+                           xpcproxy or
+                           login or
+                           cat or
+                           cp or
+                           launchctl or
+                           java)) and
+  not process.executable:(/Applications/* or /private/var/folders/* or /usr/local/*) and
+  file.path:(/private/etc/rc.local or
+             /etc/rc.local or
+             /home/*/.profile or
+             /home/*/.profile1 or
+             /home/*/.bash_profile or
+             /home/*/.bash_profile1 or
+             /home/*/.bashrc or
+             /Users/*/.bash_profile or
+             /Users/*/.zshenv)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,16 +83,7 @@ file.path:(/private/etc/rc.local or /etc/rc.local or
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[bash-shell-profile-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Unix Shell Configuration Modification
+** ID: T1546.004
+** Reference URL: https://attack.mitre.org/techniques/T1546/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc
index 4f0003b650..fd16a7a4ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc
@@ -5,62 +5,61 @@ Identifies the execution of a binary by root in Linux shared memory directories:
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://linuxsecurity.com/features/fileless-malware-on-linux
 * https://twitter.com/GossiTheDog/status/1522964028284411907
 * https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* BPFDoor
-
-*Version*: 101 (<<binary-executed-from-shared-memory-directory-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Threat: BPFDoor
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Directories /dev/shm and /run/shm are temporary file storage directories in Linux. They are intended to appear as a mounted file system, but uses virtual memory instead of a persistent storage device and thus are used for mounting file systems in legitimate purposes.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and event.action == "exec" and
-user.name == "root" and process.executable : (
-"/dev/shm/*", "/run/shm/*", "/var/run/*",
-"/var/lock/*" ) and not process.executable : (
-"/var/run/docker/*")
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+    event.action : ("exec", "exec_event") and user.name == "root" and
+    process.executable : (
+        "/dev/shm/*",
+        "/run/shm/*",
+        "/var/run/*",
+        "/var/lock/*"
+    ) and
+    not process.executable : ( "/var/run/docker/*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,33 +71,3 @@ user.name == "root" and process.executable : (
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[binary-executed-from-shared-memory-directory-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and event.action == "exec"
-and user.name == "root" and process.executable : (
-"/dev/shm/*", "/run/shm/*", "/var/run/*",
-"/var/lock/*" ) and not process.executable : (
-"/var/run/docker/*")
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and event.action == "exec"
-and user.name == "root" and process.executable : (
-"/dev/shm/*", "/run/shm/*", "/var/run/*",
-"/var/lock/*" )
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc b/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc
index 8a465acc84..8d4a00f2bc 100644
--- a/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc
@@ -5,56 +5,52 @@ Detects when the tc (transmission control) binary is utilized to set a BPF (Berk
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* logs-*
+* logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/h3xduck/TripleCross/blob/master/src/helpers/deployer.sh
 * https://man7.org/linux/man-pages/man8/tc.8.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* TripleCross
-
-*Version*: 100 (<<bpf-filter-applied-using-tc-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Threat: TripleCross
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type != "end" and process.executable :
-"/usr/sbin/tc" and process.args : "filter" and process.args : "add"
-and process.args : "bpf" and not process.parent.executable:
-"/usr/sbin/libvirtd"
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type != "end" and process.executable : "/usr/sbin/tc" and process.args : "filter" and process.args : "add" and process.args : "bpf" and not process.parent.executable: "/usr/sbin/libvirtd"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,10 +62,7 @@ and process.args : "bpf" and not process.parent.executable:
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[bpf-filter-applied-using-tc-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index fd4480acc6..990ae7cf78 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -10,85 +10,76 @@ Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<bypass-uac-via-event-viewer-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Bypass UAC via Event Viewer
 
-Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels)
-to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.
-UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the
-local administrators group and enter an administrator password when prompted.
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
 For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
 
-During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command`
-registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location
-of another binary or script is added to this registry value, it will be executed as a high-integrity process without a
-UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by
-`eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
+During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
@@ -103,34 +94,28 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"eventvwr.exe" and not process.executable :
-("?:\\Windows\\SysWOW64\\mmc.exe",
-"?:\\Windows\\System32\\mmc.exe",
-"?:\\Windows\\SysWOW64\\WerFault.exe",
-"?:\\Windows\\System32\\WerFault.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "eventvwr.exe" and
+  not process.executable :
+            ("?:\\Windows\\SysWOW64\\mmc.exe",
+             "?:\\Windows\\System32\\mmc.exe",
+             "?:\\Windows\\SysWOW64\\WerFault.exe",
+             "?:\\Windows\\System32\\WerFault.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -142,79 +127,7 @@ process where event.type == "start" and process.parent.name :
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[bypass-uac-via-event-viewer-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "eventvwr.exe" and not process.executable :
-("?:\\Windows\\SysWOW64\\mmc.exe",
-"?:\\Windows\\System32\\mmc.exe",
-"?:\\Windows\\SysWOW64\\WerFault.exe",
-"?:\\Windows\\System32\\WerFault.exe")
-----------------------------------
-
-Version 12 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "eventvwr.exe" and not process.executable :
-("?:\\Windows\\SysWOW64\\mmc.exe",
-"?:\\Windows\\System32\\mmc.exe",
-"?:\\Windows\\SysWOW64\\WerFault.exe",
-"?:\\Windows\\System32\\WerFault.exe")
-----------------------------------
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.15.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:eventvwr.exe and not
-process.executable:("C:\Windows\SysWOW64\mmc.exe" or
-"C:\Windows\System32\mmc.exe")
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.parent.name:eventvwr.exe and event.action:"Process Create
-(rule: ProcessCreate)" and not
-process.executable:("C:\Windows\SysWOW64\mmc.exe" or
-"C:\Windows\System32\mmc.exe")
-----------------------------------
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-sdclt.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-sdclt.asciidoc
new file mode 100644
index 0000000000..b5bad18598
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-sdclt.asciidoc
@@ -0,0 +1,78 @@
+[[bypass-uac-via-sdclt]]
+=== Bypass UAC via Sdclt
+
+Identifies User Account Control (UAC) bypass via sdclt.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* add winlogbeat-* when process.code_signature.* fields are populated */
+/* still needs testing, applicable binary was not available on test machine */
+
+sequence with maxspan=1m
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "sdclt.exe" and
+     /* uncomment once in winlogbeat */
+     /* process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true and */
+     process.args : "/kickoffelev"
+  ] by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "sdclt.exe" and
+     not (process.executable : "C:\\Windows\\System32\\sdclt.exe" or
+          process.executable : "C:\\Windows\\System32\\control.exe" or
+          process.executable : "C:\\Windows\\SysWOW64\\sdclt.exe" or
+          process.executable : "C:\\Windows\\SysWOW64\\control.exe")
+  ] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc b/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc
index d3769dc8b8..d1974ca1bf 100644
--- a/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc
@@ -5,54 +5,55 @@ Detects the use of the chkconfig binary to manually add a service for management
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* logs-*
+* logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-* Lightning Framework
-
-*Version*: 100 (<<chkconfig-service-add-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Threat: Lightning Framework
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.executable :
-"/usr/sbin/chkconfig" and process.args : "--add") or (process.args
-: "*chkconfig" and process.args : "--add")
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and
+( 
+  (process.executable : "/usr/sbin/chkconfig" and process.args : "--add") or
+  (process.args : "*chkconfig" and process.args : "--add")
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,17 +65,7 @@ process where event.type == "start" and (process.executable :
 ** Name: Boot or Logon Initialization Scripts
 ** ID: T1037
 ** Reference URL: https://attack.mitre.org/techniques/T1037/
-
-[[chkconfig-service-add-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.executable :
-"/usr/sbin/chkconfig" and process.args : "--add") or (process.args
-: "*chkconfig" and process.args : "--add")
-----------------------------------
-
+* Sub-technique:
+** Name: RC Scripts
+** ID: T1037.004
+** Reference URL: https://attack.mitre.org/techniques/T1037/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
index dedd251583..9286288db8 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
@@ -5,7 +5,7 @@ Identifies when a user attempts to clear console history. An adversary may clear
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,64 +16,57 @@ Identifies when a user attempts to clear console history. An adversary may clear
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://stefanos.cloud/kb/how-to-clear-the-powershell-command-history/
 * https://www.shellhacks.com/clear-history-powershell/
 * https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Version*: 102 (<<clearing-windows-console-history-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 8.0.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Clearing Windows Console History
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of
-logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the
-execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.
+Attackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
   - Verify if any other anti-forensics behaviors were observed.
-- Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be
-trying to cover up.
+- Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be trying to cover up.
 
 ### False positive analysis
 
@@ -83,33 +76,25 @@ trying to cover up.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
   - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-process.pe.original_file_name == "PowerShell.EXE") and
-(process.args : "*Clear-History*" or (process.args : ("*Remove-
-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-
-PSReadlineOption).HistorySavePath*")) or (process.args : "*Set-
-PSReadlineOption*" and process.args : "*SaveNothing*"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or process.pe.original_file_name == "PowerShell.EXE") and
+     (process.args : "*Clear-History*" or
+     (process.args : ("*Remove-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-PSReadlineOption).HistorySavePath*")) or
+     (process.args : "*Set-PSReadlineOption*" and process.args : "*SaveNothing*"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,36 +103,10 @@ PSReadlineOption*" and process.args : "*SaveNothing*"))
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[clearing-windows-console-history-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.action == "start" and (process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-process.pe.original_file_name == "PowerShell.EXE") and
-(process.args : "*Clear-History*" or (process.args : ("*Remove-
-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-
-PSReadlineOption).HistorySavePath*")) or (process.args : "*Set-
-PSReadlineOption*" and process.args : "*SaveNothing*"))
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Clear Command History
+** ID: T1070.003
+** Reference URL: https://attack.mitre.org/techniques/T1070/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
index d5bf56d453..280b5b79d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,50 +16,48 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<clearing-windows-event-logs-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Clearing Windows Event Logs
 
-Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries
-can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
 
 This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-EventLog` cmdlet to clear event logs.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -68,42 +66,38 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity
-and there are justifications for this action.
-- Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear
-non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider
-adding exceptions — preferably with a combination of user and command line conditions.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for this action.
+- Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous
-  actions, if any, are investigated accordingly with their response playbooks.
+  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ( (process.name :
-"wevtutil.exe" or process.pe.original_file_name == "wevtutil.exe") and
-process.args : ("/e:false", "cl", "clear-log") ) or (
-process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
-and process.args : "Clear-EventLog" )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (process.name : "wevtutil.exe" or process.pe.original_file_name == "wevtutil.exe") and
+    process.args : ("/e:false", "cl", "clear-log")
+  ) or
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+    process.args : "Clear-EventLog"
+  )
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -112,100 +106,10 @@ and process.args : "Clear-EventLog" )
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[clearing-windows-event-logs-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("process_started", "start") and
-(process.name : "wevtutil.exe" or process.pe.original_file_name ==
-"wevtutil.exe") and process.args : ("/e:false", "cl", "clear-log")
-or process.name : ("powershell.exe", "pwsh.exe",
-"powershell_ise.exe") and process.args : "Clear-EventLog"
-----------------------------------
-
-Version 15 (8.4.0 release)::
-* Formatting only
-
-Version 13 (8.3.0 release)::
-* Formatting only
-
-Version 12 (8.2.0 release)::
-* Formatting only
-
-Version 11 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("process_started", "start") and
-(process.name : "wevtutil.exe" or process.pe.original_file_name ==
-"wevtutil.exe") and process.args : ("/e:false", "cl", "clear-log")
-or process.name : "powershell.exe" and process.args : "Clear-
-EventLog"
-----------------------------------
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(process_started or start) and
-(process.name:"wevtutil.exe" or
-process.pe.original_file_name:"wevtutil.exe") and
-process.args:("/e:false" or cl or "clear-log") or
-process.name:"powershell.exe" and process.args:"Clear-EventLog"
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:wevtutil.exe and process.args:cl or
-process.name:powershell.exe and process.args:Clear-EventLog
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:wevtutil.exe and process.args:cl or
-process.name:powershell.exe and process.args:Clear-EventLog
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-(process.name:"wevtutil.exe" and process.args:"cl") or
-(process.name:"powershell.exe" and process.args:"Clear-EventLog")
-----------------------------------
-
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc
index 7ea88dd65b..672471cc76 100644
--- a/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc
@@ -5,73 +5,60 @@ Cobalt Strike is a threat emulation platform commonly modified and used by adver
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.morphisec.com/fin7-attacks-restaurant-industry
 * https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
 * https://www.elastic.co/security-labs/collecting-cobalt-strike-beacons-with-the-elastic-stack
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 101 (<<cobalt-strike-command-and-control-beacon-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This rule should be tailored to either exclude systems, as sources or destinations, in which this behavior is expected.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Threat intel
 
 This activity has been observed in FIN7 campaigns.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network OR network_traffic) AND type:(tls OR http) AND
-network.transport:tcp AND
-destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/
+[source, js]
 ----------------------------------
+event.dataset: (network_traffic.tls or network_traffic.http) AND destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,35 +70,11 @@ destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[cobalt-strike-command-and-control-beacon-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network OR network_traffic) AND type:(tls OR http) AND
-network.transport:tcp AND
-destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
new file mode 100644
index 0000000000..809683a5e8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -0,0 +1,124 @@
+[[code-signing-policy-modification-through-built-in-tools]]
+=== Code Signing Policy Modification Through Built-in tools
+
+Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Code Signing Policy Modification Through Built-in tools
+
+Windows Driver Signature Enforcement (DSE) is a security feature introduced by Microsoft to enforce that only signed drivers can be loaded and executed into the kernel (ring 0). This feature was introduced to prevent attackers from loading their malicious drivers on targets. If the driver has an invalid signature, the system will not allow it to be loaded.
+
+This protection is essential for maintaining the security of the system. However, attackers or even administrators can disable this feature and load untrusted drivers, as this can put the system at risk. Therefore, it is important to keep this feature enabled and only load drivers from trusted sources to ensure the integrity and security of the system.
+
+This rule identifies commands that can disable the Driver Signature Enforcement feature.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Use Osquery and endpoint driver events (`event.category = "driver"`) to investigate if suspicious drivers were loaded into the system after the command was executed.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+### False positive analysis
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+### Related Rules
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name: "bcdedit.exe" or process.pe.original_file_name == "bcdedit.exe") and process.args: ("-set", "/set") and
+  process.args: ("TESTSIGNING", "nointegritychecks", "loadoptions", "DISABLE_INTEGRITY_CHECKS")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Code Signing Policy Modification
+** ID: T1553.006
+** Reference URL: https://attack.mitre.org/techniques/T1553/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
new file mode 100644
index 0000000000..1d2a715c06
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -0,0 +1,127 @@
+[[code-signing-policy-modification-through-registry]]
+=== Code Signing Policy Modification Through Registry
+
+Identifies attempts to disable/modify the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Code Signing Policy Modification Through Registry
+
+Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets.
+
+This protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.
+
+This rule identifies registry modifications that can disable DSE.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Use Osquery and endpoint driver events (`event.category = "driver"`) to investigate if suspicious drivers were loaded into the system after the registry was modified.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+### False positive analysis
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+### Related Rules
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type : ("creation", "change") and
+(
+  registry.path : "HKEY_USERS\\*\\Software\\Policies\\Microsoft\\Windows NT\\Driver Signing\\BehaviorOnFailedVerify" and
+  registry.value: "BehaviorOnFailedVerify" and
+  registry.data.strings : ("0", "0x00000000", "1", "0x00000001")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Code Signing Policy Modification
+** ID: T1553.006
+** Reference URL: https://attack.mitre.org/techniques/T1553/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
index e799442337..51ee4e3436 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
@@ -5,7 +5,7 @@ A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,63 +16,58 @@ A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
 * https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20FILEWRITES%20(METHODOLOGY).ioc
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
-
-*Version*: 102 (<<command-execution-via-solarwinds-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted SolarWinds child processes. Verify process details such as network connections and file writes.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name: ("cmd.exe",
-"powershell.exe") and process.parent.name: (
-"ConfigurationWizard*.exe", "NetflowDatabaseMaintenance*.exe",
-"NetFlowService*.exe", "SolarWinds.Administration*.exe",
-"SolarWinds.Collector.Service*.exe", "SolarwindsDiagnostics*.exe"
-)
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name: ("cmd.exe", "powershell.exe") and
+process.parent.name: (
+     "ConfigurationWizard*.exe",
+     "NetflowDatabaseMaintenance*.exe",
+     "NetFlowService*.exe",
+     "SolarWinds.Administration*.exe",
+     "SolarWinds.Collector.Service*.exe",
+     "SolarwindsDiagnostics*.exe"
+     )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,8 +79,6 @@ process where event.type == "start" and process.name: ("cmd.exe",
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -94,38 +87,7 @@ process where event.type == "start" and process.name: ("cmd.exe",
 ** Name: Supply Chain Compromise
 ** ID: T1195
 ** Reference URL: https://attack.mitre.org/techniques/T1195/
-
-[[command-execution-via-solarwinds-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name: ("cmd.exe", "powershell.exe") and process.parent.name: (
-"ConfigurationWizard*.exe", "NetflowDatabaseMaintenance*.exe",
-"NetFlowService*.exe", "SolarWinds.Administration*.exe",
-"SolarWinds.Collector.Service*.exe", "SolarwindsDiagnostics*.exe"
-)
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
index bef3807975..070d5e2c3b 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
@@ -15,7 +15,7 @@ Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,45 +27,98 @@ Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-
-*Version*: 100 (<<command-prompt-network-connection-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
 
-Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool.
+==== Investigation guide
 
-==== Rule query
 
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Command Prompt Network Connection
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using a command and control channel. However, they can also abuse signed utilities to drop these files.
+
+This rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+  - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.
+- Investigate the target host that the signed binary is communicating with.
+  - Check if the domain is newly registered or unexpected.
+  - Check the reputation of the domain or IP address.
+- Examine if any file was downloaded and check if it is an executable or script.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the downloaded file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and file name conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-[source,js]
 ----------------------------------
-sequence by process.entity_id [process where process.name :
-"cmd.exe" and event.type == "start"] [network where process.name :
-"cmd.exe" and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32",
-"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
-"192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and process.name : "cmd.exe" and event.type == "start"]
+  [network where host.os.type == "windows" and process.name : "cmd.exe" and
+     not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+                                  "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
+                                  "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
+                                  "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+                                  "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+                                  "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +130,6 @@ sequence by process.entity_id [process where process.name :
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
 * Tactic:
 ** Name: Command and Control
 ** ID: TA0011
@@ -87,60 +138,3 @@ sequence by process.entity_id [process where process.name :
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[command-prompt-network-connection-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"cmd.exe" and event.type == "start"] [network where process.name :
-"cmd.exe" and not cidrmatch(destination.ip, "10.0.0.0/8",
-"172.16.0.0/12", "192.168.0.0/16")]
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:cmd.exe and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:cmd.exe and event.action:"Network connection detected
-(rule: NetworkConnect)" and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:cmd.exe and event.action:"Network connection detected
-(rule: NetworkConnect)" and not destination.ip:10.0.0.0/8 and not
-destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
index cc4cb80b6e..d87935840c 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
@@ -5,7 +5,7 @@ Identifies command shell activity started via RunDLL32, which is commonly abused
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,58 +16,53 @@ Identifies command shell activity started via RunDLL32, which is commonly abused
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<command-shell-activity-started-via-rundll32-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Microsoft Windows installers leveraging RunDLL32 for installation.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : ("cmd.exe",
-"powershell.exe") and process.parent.name : "rundll32.exe" and
-process.parent.command_line != null and /* common FPs can be added
-here */ not process.parent.args :
-("C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
-"C:\\WINDOWS\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.name : ("cmd.exe", "powershell.exe") and
+  process.parent.name : "rundll32.exe" and process.parent.command_line != null and
+  /* common FPs can be added here */
+  not process.parent.args : ("C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
+                             "C:\\WINDOWS\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,37 +74,19 @@ here */ not process.parent.args :
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[command-shell-activity-started-via-rundll32-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("cmd.exe", "powershell.exe") and process.parent.name
-: "rundll32.exe" and /* common FPs can be added here */ not
-process.parent.args :
-"C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL"
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
diff --git a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
index 644915273e..cb2bb81daa 100644
--- a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
@@ -5,47 +5,47 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<component-object-model-hijacking-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -55,8 +55,7 @@ Adversaries can insert malicious code that can be executed in place of legitimat
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
@@ -82,49 +81,62 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where /* not necessary but good for filtering privileged
-installations */ user.domain != "NT AUTHORITY" and ( (registry.path
-: "HK*\\InprocServer32\\" and registry.data.strings: ("scrobj.dll",
-"C:\\*\\scrobj.dll") and not registry.path :
-"*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or /* in general COM
-Registry changes on Users Hive is less noisy and worth alerting */
-(registry.path : ("HKEY_USERS\\*\\InprocServer32\\*",
-"HKEY_USERS\\*\\LocalServer32\\*",
-"HKEY_USERS\\*\\DelegateExecute\\*",
-"HKEY_USERS\\*\\TreatAs\\*",
-"HKEY_USERS\\*\\ScriptletURL\\*") and not (process.executable :
-"?:\\Program Files*\\Veeam\\Backup and
-Replication\\Console\\veeam.backup.shell.exe" and registry.path
-: "HKEY_USERS\\S-1-*_Classes\\CLSID\\*\\LocalServer32\\")) or
-(registry.path : "HKLM\\*\\InProcServer32\\*" and
-registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")) ) and
-/* removes false-positives generated by OneDrive and Teams */ not
-process.name :
-("OneDrive.exe","OneDriveSetup.exe","FileSyncConfig.exe","Teams.exe")
-and /* Teams DLL loaded by regsvr */ not (process.name:
-"regsvr32.exe" and registry.data.strings : "*Microsoft.Teams.*.dll")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+  /* not necessary but good for filtering privileged installations */
+  user.domain != "NT AUTHORITY" and
+  (
+    (
+      registry.path : ("HK*\\InprocServer32\\", "\\REGISTRY\\*\\InprocServer32\\") and
+      registry.data.strings: ("scrobj.dll", "C:\\*\\scrobj.dll") and
+      not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*"
+    ) or
+
+    /* in general COM Registry changes on Users Hive is less noisy and worth alerting */
+    (registry.path : (
+        "HKEY_USERS\\*\\InprocServer32\\",
+        "HKEY_USERS\\*\\LocalServer32\\",
+        "HKEY_USERS\\*\\DelegateExecute*",
+        "HKEY_USERS\\*\\TreatAs*",
+        "HKEY_USERS\\*\\ScriptletURL*",
+        "\\REGISTRY\\USER\\*\\InprocServer32\\",
+        "\\REGISTRY\\USER\\*\\LocalServer32\\",
+        "\\REGISTRY\\USER\\*\\DelegateExecute*",
+        "\\REGISTRY\\USER\\*\\TreatAs*", 
+        "\\REGISTRY\\USER\\*\\ScriptletURL*"
+    ) and not 
+    (
+      process.executable : "?:\\Program Files*\\Veeam\\Backup and Replication\\Console\\veeam.backup.shell.exe" and
+        registry.path : (
+          "HKEY_USERS\\S-1-*_Classes\\CLSID\\*\\LocalServer32\\",
+          "\\REGISTRY\\USER\\S-1-*_Classes\\CLSID\\*\\LocalServer32\\"))
+    ) or
+
+    (
+      registry.path : ("HKLM\\*\\InProcServer32\\*", "\\REGISTRY\\MACHINE\\*\\InProcServer32\\*") and
+        registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")
+    )
+  ) and
+
+  /* removes false-positives generated by OneDrive and Teams */
+  not process.name: ("OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe") and
+
+  /* Teams DLL loaded by regsvr */
+  not (process.name: "regsvr32.exe" and registry.data.strings : "*Microsoft.Teams.*.dll")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,134 +148,7 @@ and /* Teams DLL loaded by regsvr */ not (process.name:
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[component-object-model-hijacking-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where (registry.path : "HK*}\\InprocServer32\\" and
-registry.data.strings: ("scrobj.dll", "C:\\*\\scrobj.dll") and not
-registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or
-/* in general COM Registry changes on Users Hive is less noisy and
-worth alerting */ (registry.path :
-("HKEY_USERS\\*Classes\\*\\InprocServer32\\",
-"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
-"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
-"HKEY_USERS\\*Classes\\*\\TreatAs\\",
-"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and not
-(process.executable : "?:\\Program Files*\\Veeam\\Backup and
-Replication\\Console\\veeam.backup.shell.exe" and registry.path
-: "HKEY_USERS\\S-1-5-21-*_Classes\\CLSID\\*\\LocalServer32\\") and /*
-not necessary but good for filtering privileged installations */
-user.domain != "NT AUTHORITY" ) and /* removes false-positives
-generated by OneDrive and Teams */ not process.name :
-("OneDrive.exe","OneDriveSetup.exe","FileSyncConfig.exe","Teams.exe")
-and /* Teams DLL loaded by regsvr */ not (process.name:
-"regsvr32.exe" and registry.data.strings : "*Microsoft.Teams.*.dll")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where (registry.path : "HK*}\\InprocServer32\\" and
-registry.data.strings: ("scrobj.dll", "C:\\*\\scrobj.dll") and not
-registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or
-/* in general COM Registry changes on Users Hive is less noisy and
-worth alerting */ (registry.path :
-("HKEY_USERS\\*Classes\\*\\InprocServer32\\",
-"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
-"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
-"HKEY_USERS\\*Classes\\*\\TreatAs\\",
-"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and not
-(process.executable : "?:\\Program Files*\\Veeam\\Backup and
-Replication\\Console\\veeam.backup.shell.exe" and registry.path
-: "HKEY_USERS\\S-1-5-21-*_Classes\\CLSID\\*\\LocalServer32\\") and /*
-not necessary but good for filtering privileged installations */
-user.domain != "NT AUTHORITY" ) and /* removes false-positives
-generated by OneDrive and Teams */ not process.name :
-("OneDrive.exe","OneDriveSetup.exe","FileSyncConfig.exe","Teams.exe")
-and /* Teams DLL loaded by regsvr */ not (process.name:
-"regsvr32.exe" and registry.data.strings : "*Microsoft.Teams.*.dll")
-----------------------------------
-
-Version 7 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where /* uncomment once length is stable
-length(bytes_written_string) > 0 and */ (registry.path :
-"HK*}\\InprocServer32\\" and registry.data.strings: ("scrobj.dll",
-"C:\\*\\scrobj.dll") and not registry.path :
-"*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or /* in general
-COM Registry changes on Users Hive is less noisy and worth alerting */
-(registry.path : ("HKEY_USERS\\*Classes\\*\\InprocServer32\\",
-"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
-"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
-"HKEY_USERS\\*Classes\\*\\TreatAs\\",
-"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and not
-(process.executable : "?:\\Program Files*\\Veeam\\Backup and
-Replication\\Console\\veeam.backup.shell.exe" and registry.path
-: "HKEY_USERS\\S-1-5-21-*_Classes\\CLSID\\*\\LocalServer32\\") and /*
-not necessary but good for filtering privileged installations */
-user.domain != "NT AUTHORITY")
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where /* uncomment once length is stable
-length(bytes_written_string) > 0 and */ (registry.path :
-"HK*}\\InprocServer32\\" and registry.data.strings: ("scrobj.dll",
-"C:\\*\\scrobj.dll") and not registry.path :
-"*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or /* in general
-COM Registry changes on Users Hive is less noisy and worth alerting */
-(registry.path : ("HKEY_USERS\\*Classes\\*\\InprocServer32\\",
-"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
-"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
-"HKEY_USERS\\*Classes\\*\\TreatAs\\",
-"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and /* not
-necessary but good for filtering privileged installations */
-user.domain != "NT AUTHORITY")
-----------------------------------
-
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where /* uncomment once length is stable
-length(bytes_written_string) > 0 and */ (registry.path :
-"HK*}\\InprocServer32\\" and registry.data.strings: ("scrobj.dll",
-"C:\\*\\scrobj.dll") and not registry.path :
-"*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or /* in general
-COM Registry changes on Users Hive is less noisy and worth alerting */
-(registry.path : ("HKEY_USERS\\*Classes\\*\\InprocXServer32\\",
-"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
-"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
-"HKEY_USERS\\*Classes\\*\\TreatAs\\",
-"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and /* not
-necessary but good for filtering privileged installations */
-user.domain != "NT AUTHORITY")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Component Object Model Hijacking
+** ID: T1546.015
+** Reference URL: https://attack.mitre.org/techniques/T1546/015/
diff --git a/docs/detections/prebuilt-rules/rule-details/compression-dll-loaded-by-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/compression-dll-loaded-by-unusual-process.asciidoc
new file mode 100644
index 0000000000..8927e16374
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/compression-dll-loaded-by-unusual-process.asciidoc
@@ -0,0 +1,68 @@
+[[compression-dll-loaded-by-unusual-process]]
+=== Compression DLL Loaded by Unusual Process
+
+Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: Elastic Endgame
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where 
+  dll.name : ("System.IO.Compression.FileSystem.ni.dll", "System.IO.Compression.ni.dll") and
+  
+  /* FP Patterns */
+  not process.executable :
+      ("?:\\Program Files\\*",
+       "?:\\Program Files (x86)\\*",
+       "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe",
+       "?:\\Windows\\System32\\sdiagnhost.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Archive Collected Data
+** ID: T1560
+** Reference URL: https://attack.mitre.org/techniques/T1560/
diff --git a/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
index f44786ef7f..14e2cc5d5b 100644
--- a/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
@@ -5,7 +5,7 @@ Detects when the Console Window Host (conhost.exe) process is spawned by a suspi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,58 +16,51 @@ Detects when the Console Window Host (conhost.exe) process is spawned by a suspi
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<conhost-spawned-by-suspicious-parent-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Conhost Spawned By Suspicious Parent Process
 
-The Windows Console Host, or `conhost.exe`, is both the server application for all of the Windows Console APIs as well as
-the classic Windows user interface for working with command-line applications.
+The Windows Console Host, or `conhost.exe`, is both the server application for all of the Windows Console APIs as well as the classic Windows user interface for working with command-line applications.
 
-Attackers often rely on custom shell implementations to avoid using built-in command interpreters like `cmd.exe` and
-`PowerShell.exe` and bypass application allowlisting and security features. Attackers commonly inject these implementations into
-legitimate system processes.
+Attackers often rely on custom shell implementations to avoid using built-in command interpreters like `cmd.exe` and `PowerShell.exe` and bypass application allowlisting and security features. Attackers commonly inject these implementations into legitimate system processes.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 - Retrieve the parent process executable and determine if it is malicious:
@@ -97,37 +90,29 @@ modifications, and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "conhost.exe"
-and process.parent.name : ("lsass.exe", "services.exe", "smss.exe",
-"winlogon.exe", "explorer.exe", "dllhost.exe", "rundll32.exe",
-"regsvr32.exe", "userinit.exe", "wininit.exe", "spoolsv.exe",
-"ctfmon.exe") and not (process.parent.name : "rundll32.exe" and
-process.parent.args : ("?:\\Windows\\Installer\\MSI*.tmp,zzzzInvokeMan
-agedCustomActionOutOfProc",
-"?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask",
-"?:\\WINDOWS\\system32\\davclnt.dll,DavSetCookie"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "conhost.exe" and
+  process.parent.name : ("lsass.exe", "services.exe", "smss.exe", "winlogon.exe", "explorer.exe", "dllhost.exe", "rundll32.exe",
+                         "regsvr32.exe", "userinit.exe", "wininit.exe", "spoolsv.exe", "ctfmon.exe") and
+  not (process.parent.name : "rundll32.exe" and
+       process.parent.args : ("?:\\Windows\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc",
+                              "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask",
+                              "?:\\WINDOWS\\system32\\davclnt.dll,DavSetCookie"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -139,51 +124,3 @@ agedCustomActionOutOfProc",
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[conhost-spawned-by-suspicious-parent-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "conhost.exe" and process.parent.name :
-("svchost.exe", "lsass.exe", "services.exe", "smss.exe",
-"winlogon.exe", "explorer.exe",
-"dllhost.exe", "rundll32.exe", "regsvr32.exe", "userinit.exe",
-"wininit.exe", "spoolsv.exe", "wermgr.exe",
-"csrss.exe", "ctfmon.exe")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:conhost.exe and process.parent.name:(svchost.exe or
-lsass.exe or services.exe or smss.exe or winlogon.exe or explorer.exe
-or dllhost.exe or rundll32.exe or regsvr32.exe or userinit.exe or
-wininit.exe or spoolsv.exe or wermgr.exe or csrss.exe or ctfmon.exe)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
index 2784d42a73..5f5e35e0c7 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
@@ -5,7 +5,7 @@ Identifies unusual processes connecting to domains using known free SSL certific
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,61 +15,59 @@ Identifies unusual processes connecting to domains using known free SSL certific
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
+*Tags*: 
 
-*Version*: 100 (<<connection-to-commonly-abused-free-ssl-certificate-providers-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-network where network.protocol == "dns" and /* Add new free SSL
-certificate provider domains here */ dns.question.name :
-("*letsencrypt.org", "*.sslforfree.com", "*.zerossl.com",
-"*.freessl.org") and /* Native Windows process paths that are
-unlikely to have network connections to domains secured using free SSL
-certificates */ process.executable :
-("C:\\Windows\\System32\\*.exe",
-"C:\\Windows\\System\\*.exe",
-"C:\\Windows\\SysWOW64\\*.exe",
-"C:\\Windows\\Microsoft.NET\\Framework*\\*.exe",
-"C:\\Windows\\explorer.exe",
-"C:\\Windows\\notepad.exe") and /* Insert noisy false positives
-here */ not process.name : ("svchost.exe", "MicrosoftEdge*.exe",
-"msedge.exe")
+[source, js]
 ----------------------------------
+network where host.os.type == "windows" and network.protocol == "dns" and
+  /* Add new free SSL certificate provider domains here */
+  dns.question.name : ("*letsencrypt.org", "*.sslforfree.com", "*.zerossl.com", "*.freessl.org") and
+
+  /* Native Windows process paths that are unlikely to have network connections to domains secured using free SSL certificates */
+  process.executable : ("C:\\Windows\\System32\\*.exe",
+                        "C:\\Windows\\System\\*.exe",
+	                  "C:\\Windows\\SysWOW64\\*.exe",
+		          "C:\\Windows\\Microsoft.NET\\Framework*\\*.exe",
+		          "C:\\Windows\\explorer.exe",
+		          "C:\\Windows\\notepad.exe") and
 
-==== Threat mapping
+  /* Insert noisy false positives here */
+  not process.name : ("svchost.exe", "MicrosoftEdge*.exe", "msedge.exe")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,40 +79,3 @@ here */ not process.name : ("svchost.exe", "MicrosoftEdge*.exe",
 ** Name: Encrypted Channel
 ** ID: T1573
 ** Reference URL: https://attack.mitre.org/techniques/T1573/
-
-[[connection-to-commonly-abused-free-ssl-certificate-providers-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and /* Add new free SSL
-certificate provider domains here */ dns.question.name :
-("*letsencrypt.org", "*.sslforfree.com", "*.zerossl.com",
-"*.freessl.org") and /* Native Windows process paths that are
-unlikely to have network connections to domains secured using free SSL
-certificates */ process.executable :
-("C:\\Windows\\System32\\*.exe",
-"C:\\Windows\\System\\*.exe",
-"C:\\Windows\\SysWOW64\\*.exe",
-"C:\\Windows\\Microsoft.NET\\Framework*\\*.exe",
-"C:\\Windows\\explorer.exe",
-"C:\\Windows\\notepad.exe") and /* Insert noisy false positives
-here */ not process.name : ("svchost.exe", "MicrosoftEdge*.exe",
-"msedge.exe")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index e58772d4f9..ba591172a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -13,78 +13,71 @@ Adversaries may implement command and control (C2) communications that use commo
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<connection-to-commonly-abused-web-services-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Connection to Commonly Abused Web Services
 
-Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised
-system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the
-likelihood that hosts within a network are already communicating with them prior to a compromise.
+Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
 
-This rule looks for processes outside known legitimate program locations communicating with a list of services that can
-be abused for exfiltration or command and control.
+This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Verify whether the digital signature exists in the executable.
 - Identify the operation type (upload, download, tunneling, etc.).
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy
-false positives can be added as exceptions.
+- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.
 
 ### Response and remediation
 
@@ -94,55 +87,88 @@ false positives can be added as exceptions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-network where network.protocol == "dns" and process.name != null
-and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and /* Add
-new WebSvc domains here */ dns.question.name : (
-"raw.githubusercontent.*", "*.pastebin.*",
-"*drive.google.*", "*docs.live.*",
-"*api.dropboxapi.*", "*dropboxusercontent.*",
-"*onedrive.*", "*4shared.*", "*.file.io",
-"*filebin.net", "*slack-files.com", "*ghostbin.*",
-"*ngrok.*", "*portmap.*", "*serveo.net",
-"*localtunnel.me", "*pagekite.me", "*localxpose.io",
-"*notabug.org", "rawcdn.githack.*",
-"paste.nrecom.net", "zerobin.net", "controlc.com",
-"requestbin.net", "cdn.discordapp.com",
-"discordapp.com", "discord.com", "script.google.com",
-"script.googleusercontent.com" ) and /* Insert noisy false
-positives here */ not process.executable : (
-"?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\WWAHost.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe", "?:\\Users\\*\\AppData\\Loc
-al\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
-"?:\\Windows\\system32\\mobsync.exe",
-"?:\\Windows\\SysWOW64\\mobsync.exe",
-"?:\\Users\\*\\AppData\\Local\\Discord\\app-*\\Discord.exe" )
+[source, js]
 ----------------------------------
+network where host.os.type == "windows" and network.protocol == "dns" and
+    process.name != null and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+    /* Add new WebSvc domains here */
+    dns.question.name :
+    (
+        "raw.githubusercontent.*",
+        "*.pastebin.*",
+        "*drive.google.*",
+        "*docs.live.*",
+        "*api.dropboxapi.*",
+        "*dropboxusercontent.*",
+        "*onedrive.*",
+        "*4shared.*",
+        "*.file.io",
+        "*filebin.net",
+        "*slack-files.com",
+        "*ghostbin.*",
+        "*ngrok.*",
+        "*portmap.*",
+        "*serveo.net",
+        "*localtunnel.me",
+        "*pagekite.me",
+        "*localxpose.io",
+        "*notabug.org",
+        "rawcdn.githack.*",
+        "paste.nrecom.net",
+        "zerobin.net",
+        "controlc.com",
+        "requestbin.net",
+        "cdn.discordapp.com",
+        "discordapp.com",
+        "discord.com",
+        "script.google.com",
+        "script.googleusercontent.com"
+    ) and
+    /* Insert noisy false positives here */
+    not (
+      process.executable : (
+        "?:\\Program Files\\*.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Windows\\System32\\WWAHost.exe",
+        "?:\\Windows\\System32\\smartscreen.exe",
+        "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+        "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+        "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
+        "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
+        "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
+        "?:\\Windows\\system32\\mobsync.exe",
+        "?:\\Windows\\SysWOW64\\mobsync.exe"
+      ) or
+
+      /* Discord App */
+      (process.name : "Discord.exe" and (process.code_signature.subject_name : "Discord Inc." and
+       process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
+      ) or
+
+      /* MS Sharepoint */
+      (process.name : "Microsoft.SharePoint.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
+       process.code_signature.trusted == true) and dns.question.name : "onedrive.live.com"
+      ) or
+
+      /* Firefox */
+      (process.name : "firefox.exe" and (process.code_signature.subject_name : "Mozilla Corporation" and
+       process.code_signature.trusted == true)
+      )
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -154,8 +180,6 @@ al\\Google\\Chrome\\Application\\chrome.exe",
 ** Name: Web Service
 ** ID: T1102
 ** Reference URL: https://attack.mitre.org/techniques/T1102/
-
-
 * Tactic:
 ** Name: Exfiltration
 ** ID: TA0010
@@ -164,183 +188,11 @@ al\\Google\\Chrome\\Application\\chrome.exe",
 ** Name: Exfiltration Over Web Service
 ** ID: T1567
 ** Reference URL: https://attack.mitre.org/techniques/T1567/
-
-[[connection-to-commonly-abused-web-services-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and process.name != null
-and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and /* Add
-new WebSvc domains here */ dns.question.name : (
-"raw.githubusercontent.*", "*.pastebin.*",
-"*drive.google.*", "*docs.live.*",
-"*api.dropboxapi.*", "*dropboxusercontent.*",
-"*onedrive.*", "*4shared.*", "*.file.io",
-"*filebin.net", "*slack-files.com", "*ghostbin.*",
-"*ngrok.*", "*portmap.*", "*serveo.net",
-"*localtunnel.me", "*pagekite.me", "*localxpose.io",
-"*notabug.org", "rawcdn.githack.*",
-"paste.nrecom.net", "zerobin.net", "controlc.com",
-"requestbin.net", "cdn.discordapp.com",
-"discordapp.com", "discord.com" ) and /* Insert noisy
-false positives here */ not process.executable : (
-"?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\WWAHost.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe", "?:\\Users\\*\\AppData\\Loc
-al\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
-"?:\\Windows\\system32\\mobsync.exe",
-"?:\\Windows\\SysWOW64\\mobsync.exe",
-"?:\\Users\\*\\AppData\\Local\\Discord\\app-*\\Discord.exe" )
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and process.name != null
-and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and /* Add
-new WebSvc domains here */ dns.question.name : (
-"raw.githubusercontent.*", "*.pastebin.*",
-"*drive.google.*", "*docs.live.*",
-"*api.dropboxapi.*", "*dropboxusercontent.*",
-"*onedrive.*", "*4shared.*", "*.file.io",
-"*filebin.net", "*slack-files.com", "*ghostbin.*",
-"*ngrok.*", "*portmap.*", "*serveo.net",
-"*localtunnel.me", "*pagekite.me", "*localxpose.io",
-"*notabug.org", "rawcdn.githack.*",
-"paste.nrecom.net", "zerobin.net", "controlc.com",
-"requestbin.net", "cdn.discordapp.com",
-"discordapp.com", "discord.com" ) and /* Insert noisy
-false positives here */ not process.executable : (
-"?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\WWAHost.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe", "?:\\Users\\*\\AppData\\Loc
-al\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
-"?:\\Windows\\system32\\mobsync.exe",
-"?:\\Windows\\SysWOW64\\mobsync.exe",
-"?:\\Users\\*\\AppData\\Local\\Discord\\-*\\Discord.exe" )
-----------------------------------
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and process.name != null
-and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and /* Add
-new WebSvc domains here */ dns.question.name : (
-"raw.githubusercontent.*", "*.pastebin.*",
-"*drive.google.*", "*docs.live.*",
-"*api.dropboxapi.*", "*dropboxusercontent.*",
-"*onedrive.*", "*4shared.*", "*.file.io",
-"*filebin.net", "*slack-files.com", "*ghostbin.*",
-"*ngrok.*", "*portmap.*", "*serveo.net",
-"*localtunnel.me", "*pagekite.me", "*localxpose.io",
-"*notabug.org", "rawcdn.githack.*",
-"paste.nrecom.net", "zerobin.net", "controlc.com",
-"requestbin.net" ) and /* Insert noisy false positives here */
-not process.executable : ( "?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\WWAHost.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe", "?:\\Users\\*\\AppData\\Loc
-al\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
-"?:\\Windows\\system32\\mobsync.exe",
-"?:\\Windows\\SysWOW64\\mobsync.exe" )
-----------------------------------
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and /* Add new WebSvc
-domains here */ dns.question.name : (
-"*.githubusercontent.*", "*.pastebin.*",
-"*drive.google.*", "*docs.live.*",
-"*api.dropboxapi.*", "*dropboxusercontent.*",
-"*onedrive.*", "*4shared.*", "*.file.io",
-"*filebin.net", "*slack-files.com", "*ghostbin.*",
-"*ngrok.*", "*portmap.*", "*serveo.net",
-"*localtunnel.me", "*pagekite.me", "*localxpose.io",
-"*notabug.org" ) and /* Insert noisy false positives here */
-not process.name : ( "MicrosoftEdgeCP.exe",
-"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe",
-"msedge.exe", "opera.exe", "firefox.exe",
-"Dropbox.exe", "slack.exe", "svchost.exe",
-"thunderbird.exe", "outlook.exe", "OneDrive.exe" )
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and /* Add new
-WebSvc domains here */ wildcard(dns.question.name,
-"*.githubusercontent.*",
-"*.pastebin.*",
-"*drive.google.*",
-"*docs.live.*",
-"*api.dropboxapi.*",
-"*dropboxusercontent.*",
-"*onedrive.*", "*4shared.*",
-"*.file.io", "*filebin.net",
-"*slack-files.com",
-"*ghostbin.*", "*ngrok.*",
-"*portmap.*", "*serveo.net",
-"*localtunnel.me",
-"*pagekite.me",
-"*localxpose.io",
-"*notabug.org" ) and
-/* Insert noisy false positives here */ not process.name
-in ("MicrosoftEdgeCP.exe",
-"MicrosoftEdge.exe",
-"iexplore.exe", "chrome.exe",
-"msedge.exe", "opera.exe",
-"firefox.exe", "Dropbox.exe",
-"slack.exe", "svchost.exe",
-"thunderbird.exe", "outlook.exe",
-"OneDrive.exe")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Exfiltration to Code Repository
+** ID: T1567.001
+** Reference URL: https://attack.mitre.org/techniques/T1567/001/
+* Sub-technique:
+** Name: Exfiltration to Cloud Storage
+** ID: T1567.002
+** Reference URL: https://attack.mitre.org/techniques/T1567/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc
index 1c27e6bb1c..ed2c6e39b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc
@@ -5,7 +5,7 @@ Telnet provides a command line interface for communication with a remote device
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,57 +14,48 @@ Telnet provides a command line interface for communication with a remote device
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<connection-to-external-network-via-telnet-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Telnet can be used for both benign or malicious purposes. Telnet is included by default in some Linux distributions, so its presence is not inherently suspicious. The use of Telnet to manage devices remotely has declined in recent years in favor of more secure protocols such as SSH. Telnet usage by non-automated tools or frameworks may be suspicious.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name ==
-"telnet" and event.type == "start"] [network where process.name ==
-"telnet" and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32",
-"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
-"192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "linux" and process.name == "telnet" and event.type == "start"]
+  [network where host.os.type == "linux" and process.name == "telnet" and
+    not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+                                  "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
+                                  "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
+                                  "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+                                  "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+                                  "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,51 +67,3 @@ sequence by process.entity_id [process where process.name ==
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[connection-to-external-network-via-telnet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name ==
-"telnet" and event.type == "start"] [network where process.name ==
-"telnet" and not cidrmatch(destination.ip, "127.0.0.0/8",
-"10.0.0.0/8", "172.16.0.0/12",
-"192.168.0.0/16", "FE80::/10", "::1/128")]
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:(connection or start) and
-process.name:telnet and not destination.ip:(127.0.0.0/8 or 10.0.0.0/8
-or 172.16.0.0/12 or 192.168.0.0/16 or "FE80::/10" or "::1/128")
-----------------------------------
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:("connected-to" or "network_flow") and
-process.name:telnet and not destination.ip:(127.0.0.0/8 or 10.0.0.0/8
-or 172.16.0.0/12 or 192.168.0.0/16 or "FE80::/10" or "::1/128")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc
index a914137256..c63ea53aba 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc
@@ -5,7 +5,7 @@ Telnet provides a command line interface for communication with a remote device
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,57 +14,48 @@ Telnet provides a command line interface for communication with a remote device
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<connection-to-internal-network-via-telnet-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Telnet can be used for both benign or malicious purposes. Telnet is included by default in some Linux distributions, so its presence is not inherently suspicious. The use of Telnet to manage devices remotely has declined in recent years in favor of more secure protocols such as SSH. Telnet usage by non-automated tools or frameworks may be suspicious.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name ==
-"telnet" and event.type == "start"] [network where process.name ==
-"telnet" and cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32",
-"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
-"192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "linux" and process.name == "telnet" and event.type == "start"]
+  [network where host.os.type == "linux" and process.name == "telnet" and
+    cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+                              "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
+                              "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
+                              "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+                              "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+                              "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,51 +67,3 @@ sequence by process.entity_id [process where process.name ==
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[connection-to-internal-network-via-telnet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name ==
-"telnet" and event.type == "start"] [network where process.name ==
-"telnet" and cidrmatch(destination.ip, "10.0.0.0/8",
-"172.16.0.0/12", "192.168.0.0/16", "FE80::/10") and not
-cidrmatch(destination.ip, "127.0.0.0/8", "::1/128")]
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:(connection or start) and
-process.name:telnet and destination.ip:((10.0.0.0/8 or 172.16.0.0/12
-or 192.168.0.0/16 or "FE80::/10") and not (127.0.0.0/8 or "::1/128"))
-----------------------------------
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:("connected-to" or "network_flow") and
-process.name:telnet and destination.ip:((10.0.0.0/8 or 172.16.0.0/12
-or 192.168.0.0/16 or "FE80::/10") and not (127.0.0.0/8 or "::1/128"))
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/container-management-utility-run-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/container-management-utility-run-inside-a-container.asciidoc
new file mode 100644
index 0000000000..d0120a87c2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/container-management-utility-run-inside-a-container.asciidoc
@@ -0,0 +1,60 @@
+[[container-management-utility-run-inside-a-container]]
+=== Container Management Utility Run Inside A Container
+
+This rule detects when a container management binary is run from inside a container. These binaries are critical components of many containerized environments, and their presence and execution in unauthorized containers could indicate compromise or a misconfiguration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic Licence v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type== "start" 
+  and process.name: ("dockerd", "docker", "kubelet", "kube-proxy", "kubectl", "containerd", "runc", "systemd", "crictl")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Container Administration Command
+** ID: T1609
+** Reference URL: https://attack.mitre.org/techniques/T1609/
diff --git a/docs/detections/prebuilt-rules/rule-details/container-workload-protection.asciidoc b/docs/detections/prebuilt-rules/rule-details/container-workload-protection.asciidoc
new file mode 100644
index 0000000000..2f32896a5e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/container-workload-protection.asciidoc
@@ -0,0 +1,45 @@
+[[container-workload-protection]]
+=== Container Workload Protection
+
+Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-cloud_defend.alerts-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 10000
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.kind:alert and event.module:cloud_defend
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc b/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
index 63e16f1482..f894eda7d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
@@ -5,7 +5,7 @@ Identifies unusual instances of Control Panel with suspicious keywords or paths
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,60 +16,63 @@ Identifies unusual instances of Control Panel with suspicious keywords or paths
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.joesandbox.com/analysis/476188/1/html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<control-panel-process-with-unusual-arguments-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.executable :
-("?:\\Windows\\SysWOW64\\control.exe",
-"?:\\Windows\\System32\\control.exe") and process.command_line :
-("*.jpg*", "*.png*", "*.gif*",
-"*.bmp*", "*.jpeg*", "*.TIFF*",
-"*.inf*", "*.cpl:*/*", "*../../..*",
-"*/AppData/Local/*", "*:\\Users\\Public\\*",
-"*\\AppData\\Local\\*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
+ process.command_line :
+          ("*.jpg*",
+           "*.png*",
+           "*.gif*",
+           "*.bmp*",
+           "*.jpeg*",
+           "*.TIFF*",
+           "*.inf*",
+           "*.cpl:*/*",
+           "*../../..*",
+           "*/AppData/Local/*",
+           "*:\\Users\\Public\\*",
+           "*\\AppData\\Local\\*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,46 +84,7 @@ process where event.type == "start" and process.executable :
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[control-panel-process-with-unusual-arguments-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.executable : ("?:\\Windows\\SysWOW64\\control.exe",
-"?:\\Windows\\System32\\control.exe") and process.command_line :
-("*.jpg*", "*.png*", "*.gif*",
-"*.bmp*", "*.jpeg*", "*.TIFF*",
-"*.inf*", "*.cpl:*/*", "*../../..*",
-"*/AppData/Local/*", "*:\\Users\\Public\\*",
-"*\\AppData\\Local\\*")
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.executable : ("?:\\Windows\\SysWOW64\\control.exe",
-"?:\\Windows\\System32\\control.exe") and process.command_line :
-("*.jpg*", "*.png*", "*.gif*",
-"*.bmp*", "*.jpeg*", "*.TIFF*",
-"*.inf*", "*.dat*", "*.cpl:*/*",
-"*../../..*", "*/AppData/Local/*",
-"*:\\Users\\Public\\*", "*\\AppData\\Local\\*")
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Control Panel
+** ID: T1218.002
+** Reference URL: https://attack.mitre.org/techniques/T1218/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
index 2e755d1b49..f47115017f 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
@@ -5,65 +5,63 @@ Identifies the creation of a hidden local user account by appending the dollar s
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html
 * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<creation-of-a-hidden-local-user-account-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Creation of a Hidden Local User Account
 
-Attackers can create accounts ending with a `$` symbol to make the account hidden to user enumeration utilities and
-bypass detections that identify computer accounts by this pattern to apply filters.
+Attackers can create accounts ending with a `$` symbol to make the account hidden to user enumeration utilities and bypass detections that identify computer accounts by this pattern to apply filters.
 
 This rule uses registry events to identify the creation of local hidden accounts.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
 ### False positive analysis
@@ -77,21 +75,20 @@ prevalence, whether they are located in expected locations, and if they are sign
 - Delete the hidden account.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\",
+    "\\REGISTRY\\MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\"
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -103,25 +100,7 @@ registry where registry.path :
 ** Name: Create Account
 ** ID: T1136
 ** Reference URL: https://attack.mitre.org/techniques/T1136/
-
-[[creation-of-a-hidden-local-user-account-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
index b5d713561f..0c34a6bbf3 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -5,7 +5,7 @@ Users can mark specific files as hidden simply by putting a "." as the first cha
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,49 @@ Users can mark specific files as hidden simply by putting a "." as the first cha
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<creation-of-hidden-files-and-directories-via-commandline-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain tools may create hidden temporary files or directories upon installation or as part of their normal behavior. These events can be filtered by the process arguments, username, or process name values.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
-process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and not
-process.name in ("ls", "find", "grep")
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type in ("start", "process_started") and
+  process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
+  process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and
+  not process.name in ("ls", "find", "grep")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,58 +68,11 @@ process.name in ("ls", "find", "grep")
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[creation-of-hidden-files-and-directories-via-commandline-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Rule name changed from: Creation of Hidden Files and Directories
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
-process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and not
-process.name in ("ls", "find")
-----------------------------------
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 7 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process AND event.type:(start or process_started) AND
-process.working_directory:("/tmp" or "/var/tmp" or "/dev/shm") AND
-process.args:/\.[a-zA-Z0-9_\-][a-zA-Z0-9_\-\.]{1,254}/ AND NOT
-process.name:(ls or find)
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.11.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.1 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
index f156d3b8a3..5435304fb6 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a hidden launch agent or daemon. An adversary may est
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,58 +14,57 @@ Identifies the creation of a hidden launch agent or daemon. An adversary may est
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-* Defense Evasion
-
-*Version*: 100 (<<creation-of-hidden-launch-agent-or-daemon-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.path : (
-"/System/Library/LaunchAgents/.*.plist",
-"/Library/LaunchAgents/.*.plist",
-"/Users/*/Library/LaunchAgents/.*.plist",
-"/System/Library/LaunchDaemons/.*.plist",
-"/Library/LaunchDaemons/.*.plist" )
+[source, js]
 ----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and
+  file.path :
+  (
+    "/System/Library/LaunchAgents/.*.plist",
+    "/Library/LaunchAgents/.*.plist",
+    "/Users/*/Library/LaunchAgents/.*.plist",
+    "/System/Library/LaunchDaemons/.*.plist",
+    "/Library/LaunchDaemons/.*.plist"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +76,10 @@ file where event.type != "deletion" and file.path : (
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-
+* Sub-technique:
+** Name: Launch Agent
+** ID: T1543.001
+** Reference URL: https://attack.mitre.org/techniques/T1543/001/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -87,26 +88,7 @@ file where event.type != "deletion" and file.path : (
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-[[creation-of-hidden-launch-agent-or-daemon-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and file.path : (
-"/System/Library/LaunchAgents/.*.plist",
-"/Library/LaunchAgents/.*.plist",
-"/Users/*/Library/LaunchAgents/.*.plist",
-"/System/Library/LaunchDaemons/.*.plist",
-"/Library/LaunchDaemons/.*.plist" )
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
index 41683d9a57..9852c13be3 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of osascript to create a hidden login item. This may in
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,48 @@ Identifies the execution of osascript to create a hidden login item. This may in
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-* Execution
+*Tags*: 
 
-*Version*: 101 (<<creation-of-hidden-login-item-via-apple-script-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "osascript" and process.command_line :
-"osascript*login item*hidden:true*"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
+ process.command_line : "osascript*login item*hidden:true*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,8 +67,6 @@ process.name : "osascript" and process.command_line :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -80,8 +75,10 @@ process.name : "osascript" and process.command_line :
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
+* Sub-technique:
+** Name: AppleScript
+** ID: T1059.002
+** Reference URL: https://attack.mitre.org/techniques/T1059/002/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -90,19 +87,3 @@ process.name : "osascript" and process.command_line :
 ** Name: Plist File Modification
 ** ID: T1647
 ** Reference URL: https://attack.mitre.org/techniques/T1647/
-
-[[creation-of-hidden-login-item-via-apple-script-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
index 74fe91d664..765b3d7409 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
@@ -5,58 +5,57 @@ Identifies the creation of a hidden shared object (.so) file. Users can mark spe
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<creation-of-hidden-shared-object-file-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.action : "creation" and file.extension == "so" and
-file.name : ".*.so"
+[source, js]
 ----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and file.extension == "so" and file.name : ".*.so"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,16 +67,7 @@ file.name : ".*.so"
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-[[creation-of-hidden-shared-object-file-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.action : "creation" and file.extension == "so" and
-file.name : ".*.so"
-----------------------------------
-
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
index ab1e55ef8a..1c291dd3f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
@@ -5,62 +5,61 @@ Detects the creation or modification of a new Group Policy based scheduled task
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 101 (<<creation-or-modification-of-a-new-gpo-scheduled-task-or-service-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.path : ("?:\\Windows\\S
-YSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\Sche
-duledTasks.xml", "?:\\Windows\\SYSVOL\\domain\\Policies
-\\*\\MACHINE\\Preferences\\Services\\Services.xml") and not
-process.name : "dfsrs.exe"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.path : ("?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml",
+               "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Services\\Services.xml") and
+  not process.name : "dfsrs.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,49 +71,7 @@ process.name : "dfsrs.exe"
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[creation-or-modification-of-a-new-gpo-scheduled-task-or-service-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and file.path : ("?:\\Windows\\S
-YSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\Sche
-duledTasks.xml", "?:\\Windows\\SYSVOL\\domain\\Policies
-\\*\\MACHINE\\Preferences\\Preferences\\Services\\Services.xml") and
-not process.name : "dfsrs.exe"
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.16.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and file.path:(C\:\\Wi
-ndows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTas
-ks\\ScheduledTasks.xml or C\:\\Windows\\SYSVOL\\domain\\Policies\\*\\M
-ACHINE\\Preferences\\Preferences\\Services\\Services.xml) and not
-process.name:dfsrs.exe
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
index 6a7e638df7..e9dbaf4629 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,57 +16,52 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/
 * https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 101 (<<creation-or-modification-of-domain-backup-dpapi-private-key-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 Domain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.name :
-("ntds_capi_*.pfx", "ntds_capi_*.pvk")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and file.name : ("ntds_capi_*.pfx", "ntds_capi_*.pvk")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,43 +73,11 @@ file where event.type != "deletion" and file.name :
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-[[creation-or-modification-of-domain-backup-dpapi-private-key-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.16.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.name:(ntds_capi_*.pfx or ntds_capi_*.pvk)
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Private Keys
+** ID: T1552.004
+** Reference URL: https://attack.mitre.org/techniques/T1552/004/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
index fd7ac0af44..c02e9779b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of a local trusted root certificate in W
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,67 +16,55 @@ Identifies the creation or modification of a local trusted root certificate in W
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
 * https://www.ired.team/offensive-security/persistence/t1130-install-root-certificate
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<creation-or-modification-of-root-certificate-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain applications may install root certificates for the purpose of inspecting SSL traffic.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Creation or Modification of Root Certificate
 
-Root certificates are the primary level of certifications that tell a browser that the communication is trusted and
-legitimate. This verification is based upon the identification of a certification authority. Windows
-adds several trusted root certificates so browsers can use them to communicate with websites.
+Root certificates are the primary level of certifications that tell a browser that the communication is trusted and legitimate. This verification is based upon the identification of a certification authority. Windows adds several trusted root certificates so browsers can use them to communicate with websites.
 
 [Check out this post](https://www.thewindowsclub.com/what-are-root-certificates-windows) for more details on root certificates and the involved cryptography.
 
-This rule identifies the creation or modification of a root certificate by monitoring registry modifications. The
-installation of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid
-signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.
+This rule identifies the creation or modification of a root certificate by monitoring registry modifications. The installation of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate abnormal behaviors observed by the subject process such as network connections, other registry or file
-modifications, and any spawned child processes.
+- Investigate abnormal behaviors observed by the subject process such as network connections, other registry or file modifications, and any spawned child processes.
 - If one of the processes is suspicious, retrieve it and determine if it is malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -89,8 +77,7 @@ modifications, and any spawned child processes.
 
 ### False positive analysis
 
-- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting
-SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
+- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
 ### Response and remediation
 
@@ -100,51 +87,44 @@ SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessa
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove the malicious certificate from the root certificate store.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path : ( "HKLM\\Software\\Microsoft\\SystemCertific
-ates\\Root\\Certificates\\*\\Blob", "HKLM\\Software\\Microsoft\\
-SystemCertificates\\AuthRoot\\Certificates\\*\\Blob", "HKLM\\Sof
-tware\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\
-\Blob", "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates
-\\AuthRoot\\Certificates\\*\\Blob", "\\REGISTRY\\MACHINE\\Softwa
-re\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
-"\\REGISTRY\\MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoo
-t\\Certificates\\*\\Blob", "\\REGISTRY\\MACHINE\\Software\\Polic
-ies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
-"\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\SystemCertificate
-s\\AuthRoot\\Certificates\\*\\Blob" ) and not process.executable
-: ("?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\*.exe",
-"?:\\Windows\\SysWOW64\\*.exe",
-"?:\\Windows\\Sysmon64.exe", "?:\\Windows\\Sysmon.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe",
-"?:\\Windows\\WinSxS\\*.exe",
-"?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  registry.path :
+    (
+      "HKLM\\Software\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "HKLM\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob",
+      "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob"
+    ) and
+  not process.executable :
+              ("?:\\Program Files\\*.exe",
+               "?:\\Program Files (x86)\\*.exe",
+               "?:\\Windows\\System32\\*.exe",
+               "?:\\Windows\\SysWOW64\\*.exe",
+               "?:\\Windows\\Sysmon64.exe",
+               "?:\\Windows\\Sysmon.exe",
+               "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+               "?:\\Windows\\WinSxS\\*.exe",
+               "?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -156,50 +136,7 @@ Defender\\Platform\\*\\MsMpEng.exe",
 ** Name: Subvert Trust Controls
 ** ID: T1553
 ** Reference URL: https://attack.mitre.org/techniques/T1553/
-
-[[creation-or-modification-of-root-certificate-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path : ( "HKLM\\Software\\Microsoft\\SystemCertific
-ates\\Root\\Certificates\\*\\Blob", "HKLM\\Software\\Microsoft\\
-SystemCertificates\\AuthRoot\\Certificates\\*\\Blob", "HKLM\\Sof
-tware\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\
-\Blob", "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates
-\\AuthRoot\\Certificates\\*\\Blob" ) and not process.executable
-: ("?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\*.exe",
-"?:\\Windows\\SysWOW64\\*.exe",
-"?:\\Windows\\Sysmon64.exe", "?:\\Windows\\Sysmon.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe",
-"?:\\Windows\\WinSxS\\*.exe",
-"?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path : ( "HKLM\\Software\\Microsoft\\SystemCertific
-ates\\Root\\Certificates\\*\\Blob", "HKLM\\Software\\Microsoft\\
-SystemCertificates\\AuthRoot\\Certificates\\*\\Blob", "HKLM\\Sof
-tware\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\
-\Blob", "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates
-\\AuthRoot\\Certificates\\*\\Blob" )
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Install Root Certificate
+** ID: T1553.004
+** Reference URL: https://attack.mitre.org/techniques/T1553/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
index 71120b0377..1ddf26f3fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to export a registry hive which may contain credentials usin
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,41 +16,39 @@ Identifies attempts to export a registry hive which may contain credentials usin
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<credential-acquisition-via-registry-hive-dumping-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -58,29 +56,24 @@ Identifies attempts to export a registry hive which may contain credentials usin
 
 Dumping registry hives is a common way to access credential information as some hives store credential material.
 
-For example, the SAM hive stores locally cached credentials (SAM Secrets), and the SECURITY hive stores domain cached
-credentials (LSA secrets).
+For example, the SAM hive stores locally cached credentials (SAM Secrets), and the SECURITY hive stores domain cached credentials (LSA secrets).
 
 Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
 
-This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, which potentially indicates the
-compromise of the credentials stored in the host.
+This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, which potentially indicates the compromise of the credentials stored in the host.
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate if the credential material was exfiltrated or processed locally by other tools.
-- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target
-host.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
 
 ### False positive analysis
 
-- Administrators can export registry hives for backup purposes using command line tools like `reg.exe`. Check whether
-the user is legitamitely performing this kind of activity.
+- Administrators can export registry hives for backup purposes using command line tools like `reg.exe`. Check whether the user is legitamitely performing this kind of activity.
 
 ### Related rules
 
@@ -90,29 +83,24 @@ the user is legitamitely performing this kind of activity.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Reimage the host operating system and restore compromised files to clean versions.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.pe.original_file_name
-== "reg.exe" and process.args : ("save", "export") and process.args
-: ("hklm\\sam", "hklm\\security")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.pe.original_file_name == "reg.exe" and
+ process.args : ("save", "export") and
+ process.args : ("hklm\\sam", "hklm\\security")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -124,58 +112,11 @@ process where event.type == "start" and process.pe.original_file_name
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[credential-acquisition-via-registry-hive-dumping-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name == "reg.exe" and process.args :
-("save", "export") and process.args : ("hklm\\sam", "hklm\\security")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name == "reg.exe" and process.args :
-("save", "export") and process.args : ("hklm\\sam", "hklm\\security")
-and not process.parent.executable : "C:\\Program
-Files*\\Rapid7\\Insight
-Agent\\components\\insight_agent\\*\\ir_agent.exe"
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name == "reg.exe" and process.args :
-("save", "export") and process.args : ("hklm\\sam", "hklm\\security")
-and not process.parent.executable : "C:\\Program
-Files*\\Rapid7\\Insight
-Agent\\components\\insight_agent\\*\\ir_agent.exe"
-----------------------------------
-
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Sub-technique:
+** Name: LSA Secrets
+** ID: T1003.004
+** Reference URL: https://attack.mitre.org/techniques/T1003/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-dumping-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-dumping-detected-elastic-endgame.asciidoc
index 3a44057c82..b7bb7829f8 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-dumping-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-dumping-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,40 +13,37 @@ Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in t
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<credential-dumping-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and (event.action:cred_theft_event or
-endgame.event_subtype_full:cred_theft_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -58,34 +55,7 @@ endgame.event_subtype_full:cred_theft_event)
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[credential-dumping-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Credential Dumping - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Credential Dumping - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Credential Dumping - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:cred_theft_event and endgame.metadata.type:detection
-----------------------------------
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-dumping-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-dumping-prevented-elastic-endgame.asciidoc
index 817e7dcbe0..258789d201 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-dumping-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-dumping-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented Credential Dumping. Click the Elastic Endgame icon in
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,40 +13,37 @@ Elastic Endgame prevented Credential Dumping. Click the Elastic Endgame icon in
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<credential-dumping-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and (event.action:cred_theft_event or
-endgame.event_subtype_full:cred_theft_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -58,34 +55,7 @@ endgame.event_subtype_full:cred_theft_event)
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[credential-dumping-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Credential Dumping - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Credential Dumping - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Credential Dumping - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:cred_theft_event and endgame.metadata.type:prevention
-----------------------------------
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-manipulation-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-manipulation-detected-elastic-endgame.asciidoc
index 7ecd795420..b4a356b674 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-manipulation-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-manipulation-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected Credential Manipulation. Click the Elastic Endgame icon
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,37 @@ Elastic Endgame detected Credential Manipulation. Click the Elastic Endgame icon
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<credential-manipulation-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and
-(event.action:token_manipulation_event or
-endgame.event_subtype_full:token_manipulation_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,35 +55,3 @@ endgame.event_subtype_full:token_manipulation_event)
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[credential-manipulation-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Credential Manipulation - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Credential Manipulation - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Credential Manipulation - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:token_manipulation_event and
-endgame.metadata.type:detection
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-manipulation-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-manipulation-prevented-elastic-endgame.asciidoc
index 62a8cdfb71..601e6dd9b1 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-manipulation-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-manipulation-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame ico
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,37 @@ Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame ico
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<credential-manipulation-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and
-(event.action:token_manipulation_event or
-endgame.event_subtype_full:token_manipulation_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_manipulation_event or endgame.event_subtype_full:token_manipulation_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,35 +55,3 @@ endgame.event_subtype_full:token_manipulation_event)
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[credential-manipulation-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Credential Manipulation - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Credential Manipulation - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Credential Manipulation - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:token_manipulation_event and
-endgame.metadata.type:prevention
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc
new file mode 100644
index 0000000000..a767a6eb22
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc
@@ -0,0 +1,95 @@
+[[cron-job-created-or-changed-by-previously-unknown-process]]
+=== Cron Job Created or Changed by Previously Unknown Process
+
+Linux cron jobs are scheduled tasks that can be leveraged by malicious actors for persistence, privilege escalation and command execution. By creating or modifying cron job configurations, attackers can execute malicious commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type : "linux" and event.action : ("change" or "file_modify_event" or "creation" or "file_create_event") and 
+file.path : (/etc/cron.allow or /etc/cron.deny or /etc/cron.d/* or /etc/cron.hourly/* or /etc/cron.daily/* or 
+/etc/cron.weekly/* or /etc/cron.monthly/* or /etc/crontab or /var/spool/cron/* or /usr/sbin/cron or /usr/sbin/anacron) 
+and not (process.name : ("dpkg" or "dockerd" or "rpm" or "snapd") or file.extension : "swp")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc
index 22e3332c9d..3b5e3a23a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc
@@ -5,7 +5,7 @@ Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error l
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-cyberarkpas.audit*
@@ -14,43 +14,36 @@ Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error l
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASREF/Vault%20Audit%20Action%20Codes.htm?tocpath=Administration%7CReferences%7C_____3
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* cyberarkpas
-* SecOps
-* Log Auditing
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 101 (<<cyberark-privileged-access-security-error-history, version history>>)
+* Data Source: CyberArk PAS
+* Use Case: Log Auditing
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-To tune this rule, add exceptions to exclude any event.code which should not trigger this rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -58,16 +51,14 @@ This is a promotion rule for CyberArk error events, which are alertable events p
 Consult vendor documentation on interpreting specific events.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:cyberarkpas.audit and event.type:error
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,22 +70,7 @@ event.dataset:cyberarkpas.audit and event.type:error
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
 ** Reference URL: https://attack.mitre.org/tactics/TA0001/
-
-[[cyberark-privileged-access-security-error-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc
index 81045a918d..77ab8d1406 100644
--- a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc
@@ -5,7 +5,7 @@ Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-err
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-cyberarkpas.audit*
@@ -14,43 +14,36 @@ Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-err
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASREF/Vault%20Audit%20Action%20Codes.htm?tocpath=Administration%7CReferences%7C_____3#RecommendedActionCodesforMonitoring
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* cyberarkpas
-* SecOps
-* Log Auditing
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 101 (<<cyberark-privileged-access-security-recommended-monitor-history, version history>>)
+* Data Source: CyberArk PAS
+* Use Case: Log Auditing
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-To tune this rule, add exceptions to exclude any event.code which should not trigger this rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -58,19 +51,17 @@ This is a promotion rule for CyberArk events, which the vendor recommends should
 Consult vendor documentation on interpreting specific events.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:cyberarkpas.audit and event.code:(4 or 22 or 24 or 31
-or 38 or 57 or 60 or 130 or 295 or 300 or 302 or 308 or
-319 or 344 or 346 or 359 or 361 or 378 or 380 or 411) and not
-event.type:error
+[source, js]
 ----------------------------------
+event.dataset:cyberarkpas.audit and
+  event.code:(4 or 22 or 24 or 31 or 38 or 57 or 60 or 130 or 295 or 300 or 302 or
+              308 or 319 or 344 or 346 or 359 or 361 or 378 or 380 or 411) and
+  not event.type:error
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,22 +73,7 @@ event.type:error
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
 ** Reference URL: https://attack.mitre.org/tactics/TA0001/
-
-[[cyberark-privileged-access-security-recommended-monitor-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
index c5494cbb1b..c5d3b511b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
@@ -5,24 +5,22 @@ This rule detects the use of the default Cobalt Strike Team Server TLS certifica
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: critical
 
 *Risk score*: 99
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://attack.mitre.org/software/S0154/
 * https://www.cobaltstrike.com/help-setup-collaboration
@@ -31,49 +29,42 @@ This rule detects the use of the default Cobalt Strike Team Server TLS certifica
 * https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-zeek.html
 * https://www.elastic.co/security-labs/collecting-cobalt-strike-beacons-with-the-elastic-stack
 
-*Tags*:
+*Tags*: 
 
-* Command and Control
-* Post-Execution
-* Threat Detection
-* Elastic
-* Network
-* Host
-
-*Version*: 101 (<<default-cobalt-strike-team-server-certificate-history, version history>>)
+* Tactic: Command and Control
+* Threat: Cobalt Strike
+* Use Case: Threat Detection
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Threat intel
 
 While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, so alerts should be investigated rapidly.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and
-(tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or
-tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or tls
-.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD1
-6D3CF9D94D390C)
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.tls and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or
+  tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or
+  tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,40 +76,7 @@ tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or tls
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[default-cobalt-strike-team-server-certificate-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and
-(tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or
-tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or tls.s
-erver.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D
-3CF9D94D390C)
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
index 3ce62f318e..fd13f8f9e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,133 +16,93 @@ Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<delete-volume-usn-journal-with-fsutil-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Delete Volume USN Journal with Fsutil
 
+The Update Sequence Number (USN) Journal is a feature in the NTFS file system used by Microsoft Windows operating systems to keep track of changes made to files and directories on a disk volume. The journal records metadata for changes such as file creation, deletion, modification, and permission changes. It is used by the operating system for various purposes, including backup and recovery, file indexing, and file replication.
 
-==== Rule query
+This artifact can provide valuable information in forensic analysis, such as programs executed (prefetch file operations), file modification events in suspicious directories, deleted files, etc. Attackers may delete this artifact in an attempt to cover their tracks, and this rule identifies the usage of the `fsutil.exe` utility to accomplish it.
 
+Consider using the Elastic Defend integration instead of USN Journal, as the Elastic Defend integration provides more visibility and context in the file operations it records.
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "fsutil.exe"
-or process.pe.original_file_name == "fsutil.exe") and process.args :
-"deletejournal" and process.args : "usn"
-----------------------------------
+#### Possible investigation steps
 
-==== Threat mapping
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Review file operation logs from Elastic Defend for suspicious activity the attacker tried to hide.
 
-*Framework*: MITRE ATT&CK^TM^
+### False positive analysis
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Indicator Removal on Host
-** ID: T1070
-** Reference URL: https://attack.mitre.org/techniques/T1070/
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-[[delete-volume-usn-journal-with-fsutil-history]]
-==== Rule version history
+### Response and remediation
 
-Version 102 (8.6.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "fsutil.exe" or process.pe.original_file_name ==
-"fsutil.exe") and process.args : "deletejournal" and process.args :
-"usn"
 ----------------------------------
 
-Version 12 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "fsutil.exe" or process.pe.original_file_name ==
-"fsutil.exe") and process.args : "deletejournal" and process.args :
-"usn"
-----------------------------------
+==== Rule query
 
-Version 10 (8.2.0 release)::
-* Formatting only
 
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:fsutil.exe and process.args:(deletejournal and usn)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "fsutil.exe" or process.pe.original_file_name == "fsutil.exe") and
+  process.args : "deletejournal" and process.args : "usn"
 
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:fsutil.exe and process.args:(deletejournal and usn)
 ----------------------------------
 
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"fsutil.exe" and process.args:("usn" and "deletejournal")
-----------------------------------
+*Framework*: MITRE ATT&CK^TM^
 
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc b/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
index 7225c736d2..8a5a79681a 100644
--- a/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
@@ -5,60 +5,59 @@ Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and o
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<deleting-backup-catalogs-with-wbadmin-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Deleting Backup Catalogs with Wbadmin
 
-Windows Server Backup stores the details about your backups (what volumes are backed up and where the backups are
-located) in a file called a backup catalog, which ransomware victims can use to recover corrupted backup files.
-Deleting these files is a common step in threat actor playbooks.
+Windows Server Backup stores the details about your backups (what volumes are backed up and where the backups are located) in a file called a backup catalog, which ransomware victims can use to recover corrupted backup files. Deleting these files is a common step in threat actor playbooks.
 
 This rule identifies the deletion of the backup catalog using the `wbadmin.exe` utility.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -80,30 +79,24 @@ for prevalence, whether they are located in expected locations, and if they are
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look
-for ransomware preparation and execution activities.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
 - If any backups were affected:
   - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"wbadmin.exe" or process.pe.original_file_name == "WBADMIN.EXE") and
-process.args : "catalog" and process.args : "delete"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "wbadmin.exe" or process.pe.original_file_name == "WBADMIN.EXE") and
+  process.args : "catalog" and process.args : "delete"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -115,75 +108,3 @@ process.args : "catalog" and process.args : "delete"
 ** Name: Inhibit System Recovery
 ** ID: T1490
 ** Reference URL: https://attack.mitre.org/techniques/T1490/
-
-[[deleting-backup-catalogs-with-wbadmin-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "wbadmin.exe" or process.pe.original_file_name ==
-"WBADMIN.EXE") and process.args : "catalog" and process.args :
-"delete"
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:wbadmin.exe and process.args:(catalog and delete)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:wbadmin.exe and process.args:(catalog and delete)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"wbadmin.exe" and process.args:("delete" and "catalog")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
index 7346f25c71..55604cbfd1 100644
--- a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
@@ -15,78 +15,70 @@ Identifies unexpected processes making network connections over port 445. Window
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<direct-outbound-smb-connection-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Direct Outbound SMB Connection
 
-This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically
-implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these
-network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate
-port scanners, exploits, and tools used to move laterally on the environment.
+This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Contact the account owner and confirm whether they are aware of this activity.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
 
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination
-of user and command line conditions.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Response and remediation
 
@@ -96,46 +88,37 @@ of user and command line conditions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and host.os.name == "Windows" and process.pid != 4 and not
-(process.executable :
-"D:\\EnterpriseCare\\tools\\jre.1\\bin\\java.exe" and process.args :
-"com.emeraldcube.prism.launcher.Invoker") and not
-(process.executable : "C:\\Docusnap 11\\Tools\\nmap\\nmap.exe" and
-process.args : "smb-os-discovery.nse") and not process.executable :
-("?:\\Program Files\\SentinelOne\\Sentinel Agent
-*\\Ranger\\SentinelRanger.exe", "?:\\Program
-Files\\Ivanti\\Security Controls\\ST.EngineHost.exe",
-"?:\\Program Files (x86)\\Fortinet\\FSAE\\collectoragent.exe",
-"?:\\Program Files (x86)\\Nmap\\nmap.exe", "?:\\Program
-Files\\Azure Advanced Threat Protection
-Sensor\\*\\Microsoft.Tri.Sensor.exe", "?:\\Program
-Files\\CloudMatters\\auvik\\AuvikService-release-*\\AuvikService.exe",
-"?:\\Program Files\\uptime software\\uptime\\UptimeDataCollector.exe",
-"?:\\Program Files\\CloudMatters\\auvik\\AuvikAgentService.exe",
-"?:\\Program Files\\Rumble\\rumble-agent-*.exe")] [network where
-destination.port == 445 and process.pid != 4 and not
-cidrmatch(destination.ip, "127.0.0.1", "::1")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.pid != 4 and
+   not (process.executable : "D:\\EnterpriseCare\\tools\\jre.1\\bin\\java.exe" and process.args : "com.emeraldcube.prism.launcher.Invoker") and
+   not (process.executable : "C:\\Docusnap 11\\Tools\\nmap\\nmap.exe" and process.args : "smb-os-discovery.nse") and
+   not process.executable :
+              ("?:\\Program Files\\SentinelOne\\Sentinel Agent *\\Ranger\\SentinelRanger.exe",
+               "?:\\Program Files\\Ivanti\\Security Controls\\ST.EngineHost.exe",
+               "?:\\Program Files (x86)\\Fortinet\\FSAE\\collectoragent.exe",
+               "?:\\Program Files (x86)\\Nmap\\nmap.exe",
+               "?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
+               "?:\\Program Files\\CloudMatters\\auvik\\AuvikService-release-*\\AuvikService.exe",
+               "?:\\Program Files\\uptime software\\uptime\\UptimeDataCollector.exe",
+               "?:\\Program Files\\CloudMatters\\auvik\\AuvikAgentService.exe",
+               "?:\\Program Files\\Rumble\\rumble-agent-*.exe")]
+  [network where host.os.type == "windows" and destination.port == 445 and process.pid != 4 and
+     not cidrmatch(destination.ip, "127.0.0.1", "::1")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -147,63 +130,7 @@ cidrmatch(destination.ip, "127.0.0.1", "::1")]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[direct-outbound-smb-connection-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and process.pid != 4] [network where destination.port == 445 and
-process.pid != 4 and not cidrmatch(destination.ip, "127.0.0.1",
-"::1")]
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.16.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-destination.port:445 and not process.pid:4 and not
-destination.ip:(127.0.0.1 or "::1")
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Network connection detected (rule: NetworkConnect)" and
-destination.port:445 and not process.pid:4 and not
-destination.ip:(127.0.0.1 or "::1")
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Network connection detected (rule: NetworkConnect)" and
-destination.port:445 and not process.pid:4 and not
-destination.ip:("127.0.0.1" or "::1")
-----------------------------------
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
index 1550121a06..791d7e84b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,55 +16,53 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman
 * https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<disable-windows-event-and-security-logs-using-built-in-tools-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Ivan Ninichuck, Austin Songer
+* Elastic
+* Ivan Ninichuck
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Disable Windows Event and Security Logs Using Built-in Tools
 
-Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries
-can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
 
 This rule looks for the usage of different utilities to disable the EventLog service or specific event logs.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -80,35 +78,30 @@ for prevalence, whether they are located in expected locations, and if they are
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Re-enable affected logging components, services, and security monitoring.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ((process.name:"logman.exe"
-or process.pe.original_file_name == "Logman.exe") and
-process.args : "EventLog-*" and process.args : ("stop", "delete")) or
-((process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe")
-or process.pe.original_file_name in ("pwsh.exe",
-"powershell.exe", "powershell_ise.exe")) and process.args :
-"Set-Service" and process.args: "EventLog" and process.args :
-"Disabled") or ((process.name:"auditpol.exe" or
-process.pe.original_file_name == "AUDITPOL.EXE") and process.args :
-"/success:disable")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  ((process.name:"logman.exe" or process.pe.original_file_name == "Logman.exe") and
+      process.args : "EventLog-*" and process.args : ("stop", "delete")) or
 
-==== Threat mapping
+  ((process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or process.pe.original_file_name in
+      ("pwsh.exe", "powershell.exe", "powershell_ise.exe")) and
+	process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled")  or
+
+  ((process.name:"auditpol.exe" or process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable")
+)
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -117,56 +110,18 @@ process.pe.original_file_name == "AUDITPOL.EXE") and process.args :
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[disable-windows-event-and-security-logs-using-built-in-tools-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name:"logman.exe" or process.pe.original_file_name ==
-"Logman.exe") and process.args : "EventLog-*" and process.args :
-("stop", "delete")) or ((process.name : ("pwsh.exe",
-"powershell.exe", "powershell_ise.exe") or
-process.pe.original_file_name in ("pwsh.exe", "powershell.exe",
-"powershell_ise.exe")) and process.args : "Set-Service" and
-process.args: "EventLog" and process.args : "Disabled") or
-((process.name:"auditpol.exe" or process.pe.original_file_name ==
-"AUDITPOL.EXE") and process.args : "/success:disable")
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name:"logman.exe" or process.pe.original_file_name ==
-"Logman.exe") and process.args : "EventLog-*" and process.args :
-("stop", "delete")) or ((process.name : ("pwsh.exe",
-"powershell.exe", "powershell_ise.exe") or
-process.pe.original_file_name in ("pwsh.exe", "powershell.exe",
-"powershell_ise.exe")) and process.args : "Set-Service" and
-process.args: "EventLog" and process.args : "Disabled") or
-((process.name:"auditpol.exe" or process.pe.original_file_name ==
-"AUDITPOL.EXE") and process.args : "/success:disable")
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
index 4370f15e79..83f412b002 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the netsh.exe to disable or weaken the local firewall. Attacke
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,43 +16,42 @@ Identifies use of the netsh.exe to disable or weaken the local firewall. Attacke
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<disable-windows-firewall-rules-via-netsh-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Disable Windows Firewall Rules via Netsh
 
-The Windows Defender Firewall is a native component which provides host-based, two-way network traffic filtering for a
-device, and blocks unauthorized network traffic flowing into or out of the local device.
+The Windows Defender Firewall is a native component which provides host-based, two-way network traffic filtering for a device, and blocks unauthorized network traffic flowing into or out of the local device.
 
 Attackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.
 
@@ -62,14 +61,12 @@ This rule identifies patterns related to disabling the Windows firewall or its r
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user to check if they are aware of the operation.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing
-troubleshooting.
+- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
 - In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
 
 ### Response and remediation
@@ -78,23 +75,22 @@ troubleshooting.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "netsh.exe"
-and ( (process.args : "disable" and process.args : "firewall"
-and process.args : "set") or (process.args : "advfirewall" and
-process.args : "off" and process.args : "state") )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "netsh.exe" and
+  (
+    (process.args : "disable" and process.args : "firewall" and process.args : "set") or
+    (process.args : "advfirewall" and process.args : "off" and process.args : "state")
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -106,78 +102,7 @@ process.args : "off" and process.args : "state") )
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[disable-windows-firewall-rules-via-netsh-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "netsh.exe" and (process.args : "disable" and
-process.args : "firewall" and process.args : "set") or (process.args
-: "advfirewall" and process.args : "off" and process.args : "state")
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:netsh.exe and process.args:(disable and firewall and set)
-or process.args:(advfirewall and off and state)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:netsh.exe and process.args:(disable and firewall and set)
-or process.args:(advfirewall and off and state)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"netsh.exe" and process.args:("firewall" and "set" and
-"disable") or process.args:("advfirewall" and "state" and "off")
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
index 154f30f42f..de31a923f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
@@ -5,74 +5,68 @@ User Account Control (UAC) can help mitigate the impact of malware on Windows ho
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.greyhathacker.net/?p=796
 * https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings
 * https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<disabling-user-account-control-via-registry-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Disabling User Account Control via Registry Modification
 
-Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels)
-to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.
-UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the
-local administrators group and enter an administrator password when prompted.
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
 For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
 
-Attackers may disable UAC to execute code directly in high integrity. This rule identifies registry value changes to
-bypass the UAC protection.
+Attackers may disable UAC to execute code directly in high integrity. This rule identifies registry value changes to bypass the UAC protection.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behaviors in the alert timeframe.
-- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any spawned child processes.
 - Analyze non-system processes executed with high integrity after UAC was disabled for unknown or suspicious processes.
 - Retrieve the suspicious processes' executables and determine if they are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
@@ -96,35 +90,33 @@ modifications, and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - Restore UAC settings to the desired state.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type == "change" and registry.path : (
-"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\
-\EnableLUA", "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion
-\\Policies\\System\\ConsentPromptBehaviorAdmin", "HKLM\\SOFTWARE
-\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecure
-Desktop" ) and registry.data.strings : ("0", "0x00000000")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+  registry.path :
+    (
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
+    ) and
+  registry.data.strings : ("0", "0x00000000")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,8 +128,10 @@ Desktop" ) and registry.data.strings : ("0", "0x00000000")
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -146,35 +140,7 @@ Desktop" ) and registry.data.strings : ("0", "0x00000000")
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[disabling-user-account-control-via-registry-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type == "change" and registry.path : (
-"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\
-\EnableLUA", "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion
-\\Policies\\System\\ConsentPromptBehaviorAdmin", "HKLM\\SOFTWARE
-\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecure
-Desktop" ) and registry.data.strings : "0"
-----------------------------------
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
index d35c038211..8b91ee4531 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the Set-MpPreference PowerShell command to disable or weaken c
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,71 +16,59 @@ Identifies use of the Set-MpPreference PowerShell command to disable or weaken c
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<disabling-windows-defender-security-settings-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Planned Windows Defender configuration changes.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Disabling Windows Defender Security Settings via PowerShell
 
-Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple
-environments. Disabling it is a common step in threat actor playbooks.
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
 
 This rule monitors the execution of commands that can tamper the Windows Defender antivirus features.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Examine the command line to determine which action was executed. Based on that, examine exceptions, antivirus state,
-sample submission, etc.
+- Examine the command line to determine which action was executed. Based on that, examine exceptions, antivirus state, sample submission, etc.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity,
-the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting),
-and no other suspicious activity has been observed.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
 
 ### Related rules
 
@@ -91,32 +79,24 @@ and no other suspicious activity has been observed.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Based on the command line, take actions to restore the appropriate Windows Defender antivirus configurations.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-process.pe.original_file_name in ("powershell.exe", "pwsh.dll",
-"powershell_ise.exe")) and process.args : "Set-MpPreference" and
-process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")) and
+ process.args : "Set-MpPreference" and process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -128,33 +108,7 @@ process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[disabling-windows-defender-security-settings-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-("powershell.exe", "pwsh.exe") or process.pe.original_file_name ==
-"PowerShell.EXE") and process.args : "Set-MpPreference" and
-process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
index 3b56f9b384..ab3e247c54 100644
--- a/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
@@ -5,7 +5,7 @@ Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,61 +16,56 @@ Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
 * https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Version*: 101 (<<dns-over-https-enabled-via-registry-history, version history>>)
+*Version*: 104
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-(registry.path :
-"*\\SOFTWARE\\Policies\\Microsoft\\Edge\\BuiltInDnsClientEnabled" and
-registry.data.strings : "1") or (registry.path :
-"*\\SOFTWARE\\Google\\Chrome\\DnsOverHttpsMode" and
-registry.data.strings : "secure") or (registry.path :
-"*\\SOFTWARE\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS" and
-registry.data.strings : "1")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  (registry.path : "*\\SOFTWARE\\Policies\\Microsoft\\Edge\\BuiltInDnsClientEnabled" and
+  registry.data.strings : "1") or
+  (registry.path : "*\\SOFTWARE\\Google\\Chrome\\DnsOverHttpsMode" and
+  registry.data.strings : "secure") or
+  (registry.path : "*\\SOFTWARE\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS" and
+  registry.data.strings : "1")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,22 +77,3 @@ registry.data.strings : "1")
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[dns-over-https-enabled-via-registry-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/dns-tunneling.asciidoc b/docs/detections/prebuilt-rules/rule-details/dns-tunneling.asciidoc
index 162fadce2e..2f32b6dc45 100644
--- a/docs/detections/prebuilt-rules/rule-details/dns-tunneling.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dns-tunneling.asciidoc
@@ -5,47 +5,37 @@ A machine learning job detected unusually large numbers of DNS queries for a sin
 
 *Rule type*: machine_learning
 
-*Machine learning job*: packetbeat_dns_tunneling
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Network
-* Threat Detection
-* ML
-* Command and Control
+*Tags*: 
 
-*Version*: 100 (<<dns-tunneling-history, version history>>)
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,22 +47,3 @@ DNS domains that use large numbers of child domains, such as software or content
 ** Name: Protocol Tunneling
 ** ID: T1572
 ** Reference URL: https://attack.mitre.org/techniques/T1572/
-
-[[dns-tunneling-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc b/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc
index cb4c1fa359..55687c359d 100644
--- a/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc
@@ -5,7 +5,7 @@ Detects when a domain is added to the list of trusted Google Workspace domains.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,80 @@ Detects when a domain is added to the list of trusted Google Workspace domains.
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/6160020?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 101 (<<domain-added-to-google-workspace-trusted-domains-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted domains may be added by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Domain Added to Google Workspace Trusted Domains
+
+Organizations use trusted domains in Google Workspace to give external users access to resources.
+
+A threat actor with administrative privileges may be able to add a malicious domain to the trusted domain list. Based on the configuration, potentially sensitive resources may be exposed or accessible by an unintended third-party.
+
+This rule detects when a third-party domain is added to the list of trusted domains in Google Workspace.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- After identifying the user, verify if the user should have administrative privileges to add external domains.
+- Check the `google_workspace.admin.domain.name` field to find the newly added domain.
+- Use reputational services, such as VirusTotal, for the trusted domain's third-party intelligence reputation.
+- Filter your data. Create a filter where `event.dataset` is `google_workspace.drive` and `google_workspace.drive.file.owner.email` is being compared to `user.email`.
+    - If mismatches are identified, this could indicate access from an external Google Workspace domain.
+
+### False positive analysis
+
+- Verify that the user account should have administrative privileges that allow them to edit trusted domains in Google Workspace.
+- Talk to the user to evaluate why they added the third-party domain and if the domain has confidentiality risks.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,17 +98,14 @@ Trusted domains may be added by system administrators. Verify that the configura
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:ADD_TRUSTED_DOMAINS
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:ADD_TRUSTED_DOMAINS
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,44 +117,7 @@ event.category:iam and event.action:ADD_TRUSTED_DOMAINS
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[domain-added-to-google-workspace-trusted-domains-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:ADD_TRUSTED_DOMAINS
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/downloaded-shortcut-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/downloaded-shortcut-files.asciidoc
new file mode 100644
index 0000000000..9f2039eafe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/downloaded-shortcut-files.asciidoc
@@ -0,0 +1,88 @@
+[[downloaded-shortcut-files]]
+=== Downloaded Shortcut Files
+
+Identifies .lnk shortcut file downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* leaving in development pending `file.Ext.windows.zone_identifier` landing in ECS then endpoint */
+
+sequence by process.entity_id with maxspan=2s
+                                           /* file.extension added to endpoint fields for 7.10 */
+  [file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk"]
+                                           /* not sure yet how the update will capture ADS */
+  [file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk:Zone.Identifier" and
+     /* non-ECS field - may disqualify conversion */
+     file.Ext.windows.zone_identifier > 1]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/downloaded-url-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/downloaded-url-files.asciidoc
new file mode 100644
index 0000000000..05f2c58794
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/downloaded-url-files.asciidoc
@@ -0,0 +1,83 @@
+[[downloaded-url-files]]
+=== Downloaded URL Files
+
+Identifies .url shortcut files downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* leaving in development pending `file.Ext.windows.zone_identifier` landing in ECS then endpoint */
+
+sequence by process.entity_id with maxspan=2s
+  [file where host.os.type == "windows" and event.type == "creation" and file.extension == "url" and
+     not process.name == "explorer.exe"]
+  [file where host.os.type == "windows" and event.type == "creation" and file.extension == "url:Zone.Identifier" and
+      /* non-ECS field - may disqualify conversion */
+     file.Ext.windows.zone_identifier > 1 and not process.name == "explorer.exe"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
index 7c0b3495a6..5d7d94fcde 100644
--- a/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of macOS built-in commands used to dump user account ha
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ Identifies the execution of macOS built-in commands used to dump user account ha
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored
 * https://www.unix.com/man-page/osx/8/mkpassdb/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<dumping-account-hashes-via-built-in-commands-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and
-process.name:(defaults or mkpassdb) and process.args:(ShadowHashData
-or "-dump")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+ process.name:(defaults or mkpassdb) and process.args:(ShadowHashData or "-dump")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,13 +61,3 @@ or "-dump")
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[dumping-account-hashes-via-built-in-commands-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
index 84cbfd9b01..4b41329e9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
@@ -5,7 +5,7 @@ Adversaries may dump the content of the keychain storage data from a system to a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,53 +14,48 @@ Adversaries may dump the content of the keychain storage data from a system to a
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://ss64.com/osx/security.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<dumping-of-keychain-content-via-security-command-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : "dump-keychain" and process.args : "-d"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.args : "dump-keychain" and process.args : "-d"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,16 +67,7 @@ process.args : "dump-keychain" and process.args : "-d"
 ** Name: Credentials from Password Stores
 ** ID: T1555
 ** Reference URL: https://attack.mitre.org/techniques/T1555/
-
-[[dumping-of-keychain-content-via-security-command-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc b/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc
index e9d86c5004..8f414b477c 100644
--- a/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc
@@ -5,56 +5,52 @@ Detects the copying of the Linux dynamic loader binary and subsequent file creat
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* logs-*
+* logs-endpoint.events.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-* Orbit
-
-*Version*: 100 (<<dynamic-linker-copy-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Threat: Orbit
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [process where
-event.type == "start" and process.name : ("cp", "rsync") and
-process.args : ("/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",
-"/etc/ld.so.preload")] [file where event.action == "creation" and
-file.extension == "so"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=1m
+[process where host.os.type == "linux" and event.type == "start" and process.name : ("cp", "rsync") and
+   process.args : ("/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/etc/ld.so.preload")]
+[file where host.os.type == "linux" and event.action == "creation" and file.extension == "so"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,10 +62,7 @@ file.extension == "so"]
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[dynamic-linker-copy-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/eggshell-backdoor-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/eggshell-backdoor-execution.asciidoc
index 002d226c3e..6bc8d1e082 100644
--- a/docs/detections/prebuilt-rules/rule-details/eggshell-backdoor-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/eggshell-backdoor-execution.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of and EggShell Backdoor. EggShell is a known post expl
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,45 +14,41 @@ Identifies the execution of and EggShell Backdoor. EggShell is a known post expl
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/neoneggplant/EggShell
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Execution
-
-*Version*: 100 (<<eggshell-backdoor-execution-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:espl and process.args:eyJkZWJ1ZyI6*
+[source, js]
 ----------------------------------
+event.category:process and event.type:(process_started or start) and process.name:espl and process.args:eyJkZWJ1ZyI6*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,13 +60,7 @@ process.name:espl and process.args:eyJkZWJ1ZyI6*
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[eggshell-backdoor-execution-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Python
+** ID: T1059.006
+** Reference URL: https://attack.mitre.org/techniques/T1059/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc b/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc
index 57e2b9e1ae..ec6d7ad3f3 100644
--- a/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc
@@ -5,69 +5,75 @@ Identifies the Elastic endpoint agent has stopped and is no longer running on th
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* logs-*
+* logs-endpoint.events.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Windows
-* macOS
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<elastic-agent-service-terminated-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: Windows
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where /* net, sc or wmic stopping or deleting Elastic Agent on
-Windows */ (event.type == "start" and process.name : ("net.exe",
-"sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","Pro
-cessHacker.exe") and process.args : ("stopservice","uninstall",
-"stop", "disabled","Stop-Process","terminate","suspend") and
-process.args : ("elasticendpoint", "Elastic Agent","elastic-
-agent","elastic-endpoint")) or /* service or systemctl used to stop
-Elastic Agent on Linux */ (event.type == "end" and (process.name :
-("systemctl", "service") and process.args : "elastic-agent" and
-process.args : "stop") or /* Unload Elastic Agent extension on
-MacOS */ (process.name : "kextunload" and process.args :
-"com.apple.iokit.EndpointSecurity" and event.action : "end"))
+[source, js]
 ----------------------------------
+process where
+/* net, sc or wmic stopping or deleting Elastic Agent on Windows */
+(event.type == "start" and
+  process.name : ("net.exe", "sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","ProcessHacker.exe") and
+  process.args : ("stopservice","uninstall", "stop", "disabled","Stop-Process","terminate","suspend") and
+  process.args : ("elasticendpoint", "Elastic Agent","elastic-agent","elastic-endpoint"))
+or
+/* service or systemctl used to stop Elastic Agent on Linux */
+(event.type == "end" and
+  (process.name : ("systemctl", "service") and
+    process.args : "elastic-agent" and
+    process.args : "stop")
+  or
+  /* pkill , killall used to stop Elastic Agent on Linux */
+  ( event.type == "end" and process.name : ("pkill", "killall") and process.args: "elastic-agent")
+  or
+  /* Unload Elastic Agent extension on MacOS */
+  (process.name : "kextunload" and
+    process.args : "com.apple.iokit.EndpointSecurity" and
+    event.action : "end"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,45 +85,7 @@ MacOS */ (process.name : "kextunload" and process.args :
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[elastic-agent-service-terminated-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where /* net, sc or wmic stopping or deleting Elastic Agent on
-Windows */ (event.type == "start" and process.name : ("net.exe",
-"sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","Pro
-cessHacker.exe") and process.args : ("stopservice","uninstall",
-"stop", "disabled","Stop-Process","terminate","suspend") and
-process.args : ("elasticendpoint", "Elastic Agent","elastic-
-agent","elastic-endpoint")) or /* service or systemctl used to stop
-Elastic Agent on Linux */ (event.type == "end" and (process.name :
-("systemctl", "service") and process.args : "elastic-agent" and
-process.args : "stop") or /* Unload Elastic Agent extension on
-MacOS */ (process.name : "kextunload" and process.args :
-"com.apple.iokit.EndpointSecurity" and event.action : "end"))
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where /* net, sc or wmic stopping or deleting Elastic Agent on
-Windows */ (event.type == "start" and process.name : ("net.exe",
-"sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","Pro
-cessHacker.exe") and process.args : ("stopservice","uninstall",
-"stop", "disabled","Stop-Process","terminate","suspend") and
-process.args : ("elasticendpoint", "Elastic Agent","elastic-
-agent","elastic-endpoint")) or /* service or systemctl used to stop
-Elastic Agent on Linux */ (event.type == "end" and (process.name :
-("systemctl","service") and process.args : ("elastic-agent",
-"stop")) or /* Unload Elastic Agent extension on MacOS */
-(process.name : "kextunload" and process.args :
-"com.apple.iokit.EndpointSecurity" and event.action : "end"))
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
index ca60317ebe..efb51de353 100644
--- a/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of the Event Monitor Daemon (emond) rule
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,50 @@ Identifies the creation or modification of the Event Monitor Daemon (emond) rule
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.xorrior.com/emond-persistence/
 * https://www.sentinelone.com/blog/how-malware-persists-on-macos/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<emond-rules-creation-or-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.path :
-("/private/etc/emond.d/rules/*.plist", "/etc/emon.d/rules/*.plist",
-"/private/var/db/emondClients/*")
+[source, js]
 ----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and
+ file.path : ("/private/etc/emond.d/rules/*.plist", "/etc/emon.d/rules/*.plist", "/private/var/db/emondClients/*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,25 +69,7 @@ file where event.type != "deletion" and file.path :
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[emond-rules-creation-or-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and file.path :
-("/private/etc/emond.d/rules/*.plist", "/etc/emon.d/rules/*.plist")
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Emond
+** ID: T1546.014
+** Reference URL: https://attack.mitre.org/techniques/T1546/014/
diff --git a/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
index a3495d4534..15e981ea71 100644
--- a/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the netsh.exe program to enable host discovery via the network
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,48 @@ Identifies use of the netsh.exe program to enable host discovery via the network
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<enable-host-network-discovery-via-netsh-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Host Windows Firewall planned system administration changes.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Enable Host Network Discovery via Netsh
 
-The Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a
-device and blocks unauthorized network traffic flowing into or out of the local device.
+The Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
 
-Attackers can enable Network Discovery on the Windows firewall to find other systems present in the same network. Systems
-with this setting enabled will communicate with other systems using broadcast messages, which can be used to identify
-targets for lateral movement. This rule looks for the setup of this setting using the netsh utility.
+Attackers can enable Network Discovery on the Windows firewall to find other systems present in the same network. Systems with this setting enabled will communicate with other systems using broadcast messages, which can be used to identify targets for lateral movement. This rule looks for the setup of this setting using the netsh utility.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -73,8 +65,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity
-and there are justifications for this configuration.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.
 
 ### Response and remediation
 
@@ -82,27 +73,22 @@ and there are justifications for this configuration.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Disable Network Discovery:
     - Using netsh: `netsh advfirewall firewall set rule group="Network Discovery" new enable=No`
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "netsh.exe" and
-process.args : ("firewall", "advfirewall") and process.args :
-"group=Network Discovery" and process.args : "enable=Yes"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+process.name : "netsh.exe" and
+process.args : ("firewall", "advfirewall") and process.args : "group=Network Discovery" and process.args : "enable=Yes"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -114,25 +100,7 @@ process.args : ("firewall", "advfirewall") and process.args :
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[enable-host-network-discovery-via-netsh-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc
index 83d8c7b04c..ddb509a46d 100644
--- a/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc
@@ -5,7 +5,7 @@ Identifies registry write modifications to hide an encoded portable executable.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * endgame-*
@@ -14,41 +14,41 @@ Identifies registry write modifications to hide an encoded portable executable.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<encoded-executable-stored-in-the-registry-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where /* update here with encoding combinations */
-registry.data.strings : "TVqQAAMAAAAEAAAA*"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+/* update here with encoding combinations */
+ registry.data.strings : "TVqQAAMAAAAEAAAA*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,31 +57,10 @@ registry.data.strings : "TVqQAAMAAAAEAAAA*"
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
+* Technique:
 ** Name: Deobfuscate/Decode Files or Information
 ** ID: T1140
 ** Reference URL: https://attack.mitre.org/techniques/T1140/
-
-[[encoded-executable-stored-in-the-registry-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
index 2c6c852aa3..f4ca70fbb4 100644
--- a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
@@ -5,7 +5,7 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,102 +16,92 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Collection
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<encrypting-files-with-winrar-or-7z-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Encrypting Files with WinRar or 7z
 
-Attackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the
-collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is
-being exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.
+Attackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.
 
 These steps are usually done in preparation for exfiltration, meaning the attack may be in its final stages.
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Retrieve the encrypted file.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check if the password used in the encryption was included in the command line.
 - Decrypt the `.rar`/`.zip` and check if the information is sensitive.
-- If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the
-file names included in the encrypted file.
+- If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the file names included in the encrypted file.
 - Investigate if the file was transferred to an attacker-controlled server.
 
 ### False positive analysis
 
-- Backup software can use these utilities. Check the `process.parent.executable` and
-`process.parent.command_line` fields to determine what triggered the encryption.
+- Backup software can use these utilities. Check the `process.parent.executable` and `process.parent.command_line` fields to determine what triggered the encryption.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Prioritize cases that involve personally identifiable information (PII) or other classified data.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ((process.name:"rar.exe" or
-process.code_signature.subject_name == "win.rar GmbH" or
-process.pe.original_file_name == "Command line RAR") and
-process.args == "a" and process.args : ("-hp*", "-p*", "-dw", "-tb",
-"-ta", "/hp*", "/p*", "/dw", "/tb", "/ta")) or
-(process.pe.original_file_name in ("7z.exe", "7za.exe") and
-process.args == "a" and process.args : ("-p*", "-sdel")) /*
-uncomment if noisy for backup software related FPs */ /* not
-process.parent.executable : ("C:\\Program Files\\*.exe", "C:\\Program
-Files (x86)\\*.exe") */
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  ((process.name:"rar.exe" or process.code_signature.subject_name == "win.rar GmbH" or
+      process.pe.original_file_name == "Command line RAR") and
+    process.args == "a" and process.args : ("-hp*", "-p*", "-dw", "-tb", "-ta", "/hp*", "/p*", "/dw", "/tb", "/ta"))
+
+  or
+  (process.pe.original_file_name in ("7z.exe", "7za.exe") and
+     process.args == "a" and process.args : ("-p*", "-sdel"))
+
+  /* uncomment if noisy for backup software related FPs */
+  /* not process.parent.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") */
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -123,45 +113,7 @@ Files (x86)\\*.exe") */
 ** Name: Archive Collected Data
 ** ID: T1560
 ** Reference URL: https://attack.mitre.org/techniques/T1560/
-
-[[encrypting-files-with-winrar-or-7z-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name:"rar.exe" or process.code_signature.subject_name ==
-"win.rar GmbH" or process.pe.original_file_name == "Command line
-RAR") and process.args == "a" and process.args : ("-hp*", "-p*",
-"-dw", "-tb", "-ta", "/hp*", "/p*", "/dw", "/tb", "/ta")) or
-(process.pe.original_file_name in ("7z.exe", "7za.exe") and
-process.args == "a" and process.args : ("-p*", "-sdel")) /*
-uncomment if noisy for backup software related FPs */ /* not
-process.parent.executable : ("C:\\Program Files\\*.exe", "C:\\Program
-Files (x86)\\*.exe") */
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Archive via Utility
+** ID: T1560.001
+** Reference URL: https://attack.mitre.org/techniques/T1560/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/endpoint-security.asciidoc b/docs/detections/prebuilt-rules/rule-details/endpoint-security.asciidoc
index 2738bb404a..1b95d49969 100644
--- a/docs/detections/prebuilt-rules/rule-details/endpoint-security.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/endpoint-security.asciidoc
@@ -5,7 +5,7 @@ Generates a detection alert each time an Elastic Endpoint Security alert is rece
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.alerts-*
 
@@ -13,47 +13,32 @@ Generates a detection alert each time an Elastic Endpoint Security alert is rece
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Endpoint Security
+*Tags*: 
 
-*Version*: 100 (<<endpoint-security-history, version history>>)
+* Data Source: Elastic Defend
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.kind:alert and event.module:(endpoint and not endgame)
-----------------------------------
-
 
-[[endpoint-security-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Rule name changed from: Elastic Endpoint Security
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
new file mode 100644
index 0000000000..dc03a3fc7e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
@@ -0,0 +1,110 @@
+[[enumerating-domain-trusts-via-dsquery-exe]]
+=== Enumerating Domain Trusts via DSQUERY.EXE
+
+Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
+* https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Enumerating Domain Trusts via DSQUERY.EXE
+
+Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
+
+This rule identifies the usage of the `dsquery.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+### Related rules
+
+- Enumerating Domain Trusts via NLTEST.EXE - 84da2554-e12a-11ec-b896-f661ea17fbcd
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    (process.name : "dsquery.exe" or process.pe.original_file_name: "dsquery.exe") and 
+    process.args : "*objectClass=trustedDomain*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
new file mode 100644
index 0000000000..8adf3522e3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
@@ -0,0 +1,112 @@
+[[enumerating-domain-trusts-via-nltest-exe]]
+=== Enumerating Domain Trusts via NLTEST.EXE
+
+Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
+* https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Enumerating Domain Trusts via NLTEST.EXE
+
+Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
+
+This rule identifies the usage of the `nltest.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+### Related rules
+
+- Enumerating Domain Trusts via DSQUERY.EXE - 06a7a03c-c735-47a6-a313-51c354aef6c3
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    process.name : "nltest.exe" and process.args : (
+        "/DCLIST:*", "/DCNAME:*", "/DSGET*",
+        "/LSAQUERYFTI:*", "/PARENTDOMAIN",
+        "/DOMAIN_TRUSTS", "/BDC_QUERY:*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
index c4519342df..ac8ad2e38a 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
@@ -5,7 +5,7 @@ Identifies native Windows host and network enumeration commands spawned by the W
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,73 @@ Identifies native Windows host and network enumeration commands spawned by the W
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<enumeration-command-spawned-via-wmiprvse-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name: (
-"arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe",
-"hostname.exe", "ipconfig.exe", "nbtstat.exe", "net.exe",
-"net1.exe", "netsh.exe", "netstat.exe", "nltest.exe",
-"ping.exe", "qprocess.exe", "quser.exe", "qwinsta.exe",
-"reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe",
-"tracert.exe", "whoami.exe" ) and
-process.parent.name:"wmiprvse.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name:
+  (
+    "arp.exe",
+    "dsquery.exe",
+    "dsget.exe",
+    "gpresult.exe",
+    "hostname.exe",
+    "ipconfig.exe",
+    "nbtstat.exe",
+    "net.exe",
+    "net1.exe",
+    "netsh.exe",
+    "netstat.exe",
+    "nltest.exe",
+    "ping.exe",
+    "qprocess.exe",
+    "quser.exe",
+    "qwinsta.exe",
+    "reg.exe",
+    "sc.exe",
+    "systeminfo.exe",
+    "tasklist.exe",
+    "tracert.exe",
+    "whoami.exe"
+  ) and
+  process.parent.name:"wmiprvse.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +94,6 @@ process.parent.name:"wmiprvse.exe"
 ** Name: Windows Management Instrumentation
 ** ID: T1047
 ** Reference URL: https://attack.mitre.org/techniques/T1047/
-
-
 * Tactic:
 ** Name: Discovery
 ** ID: TA0007
@@ -87,34 +102,23 @@ process.parent.name:"wmiprvse.exe"
 ** Name: Remote System Discovery
 ** ID: T1018
 ** Reference URL: https://attack.mitre.org/techniques/T1018/
-
-[[enumeration-command-spawned-via-wmiprvse-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name: ( "arp.exe", "dsquery.exe", "dsget.exe",
-"gpresult.exe", "hostname.exe", "ipconfig.exe",
-"nbtstat.exe", "net.exe", "net1.exe", "netsh.exe",
-"netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe",
-"quser.exe", "qwinsta.exe", "reg.exe", "sc.exe",
-"systeminfo.exe", "tasklist.exe", "tracert.exe",
-"whoami.exe" ) and process.parent.name:"wmiprvse.exe"
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
+* Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
+* Sub-technique:
+** Name: Internet Connection Discovery
+** ID: T1016.001
+** Reference URL: https://attack.mitre.org/techniques/T1016/001/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
index 6c458e7723..0e44aa2bd3 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
@@ -5,7 +5,7 @@ Identifies instances of lower privilege accounts enumerating Administrator accou
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,62 +16,55 @@ Identifies instances of lower privilege accounts enumerating Administrator accou
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<enumeration-of-administrator-accounts-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Enumeration of Administrator Accounts
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `net` and `wmic` utilities to enumerate administrator-related users or groups
-in the domain and local machine scope. Attackers can use this information to plan their next steps of the attack, such
-as mapping targets for credential compromise and other post-exploitation activities.
+This rule looks for the execution of the `net` and `wmic` utilities to enumerate administrator-related users or groups in the domain and local machine scope. Attackers can use this information to plan their next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Related rules
 
@@ -81,34 +74,33 @@ suspicious activity related to the user or host, such alerts can be dismissed.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (((process.name : "net.exe"
-or process.pe.original_file_name == "net.exe") or ((process.name :
-"net1.exe" or process.pe.original_file_name == "net1.exe") and
-not process.parent.name : "net.exe")) and process.args : ("group",
-"user", "localgroup") and process.args : ("admin", "Domain Admins",
-"Remote Desktop Users", "Enterprise Admins", "Organization
-Management") and not process.args : "/add") or
-((process.name : "wmic.exe" or process.pe.original_file_name ==
-"wmic.exe") and process.args : ("group", "useraccount"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or
+    ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and
+        not process.parent.name : "net.exe")) and
+   process.args : ("group", "user", "localgroup") and
+   process.args : ("*admin*", "Domain Admins", "Remote Desktop Users", "Enterprise Admins", "Organization Management") and
+   not process.args : "/add")
 
-==== Threat mapping
+   or
+
+  ((process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and
+     process.args : ("group", "useraccount"))
+)
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -120,45 +112,23 @@ Management") and not process.args : "/add") or
 ** Name: Permission Groups Discovery
 ** ID: T1069
 ** Reference URL: https://attack.mitre.org/techniques/T1069/
-
-[[enumeration-of-administrator-accounts-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(((process.name : "net.exe" or process.pe.original_file_name ==
-"net.exe") or ((process.name : "net1.exe" or
-process.pe.original_file_name == "net1.exe") and not
-process.parent.name : "net.exe")) and process.args : ("group",
-"user", "localgroup") and process.args : ("admin", "Domain Admins",
-"Remote Desktop Users", "Enterprise Admins", "Organization
-Management") and not process.args : "/add") or
-((process.name : "wmic.exe" or process.pe.original_file_name ==
-"wmic.exe") and process.args : ("group", "useraccount"))
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Sub-technique:
+** Name: Domain Groups
+** ID: T1069.002
+** Reference URL: https://attack.mitre.org/techniques/T1069/002/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc
new file mode 100644
index 0000000000..d7cb5a49e8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc
@@ -0,0 +1,82 @@
+[[enumeration-of-kernel-modules-via-proc]]
+=== Enumeration of Kernel Modules via Proc
+
+Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /proc/ -p r -k audit_proc
+```
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action == "opened-file" and 
+file.path == "/proc/modules" and not process.parent.pid == 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc
index 0c761e887e..6112fedaa3 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc
@@ -3,56 +3,52 @@
 
 Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module.
 
-*Rule type*: query
+*Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Discovery
+*Tags*: 
 
-*Version*: 100 (<<enumeration-of-kernel-modules-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Security tools and device drivers may run these programs in order to enumerate kernel modules. Use of these programs by ordinary users is uncommon. These can be exempted by process name or username.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:(kmod and list and sudo or sudo and (depmod or lsmod or
-modinfo))
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and 
+((process.name == "kmod" and process.args == "list") or (process.name == "modinfo" and process.parent.user.id != "0") or 
+(process.name == "depmod" and process.args in ("--all", "-a") and process.parent.user.id != "0") 
+or process.name == "lsmod") and not process.parent.name : ("vboxmanage", "virtualbox", "prime-offload", "vboxdrv.sh") and not 
+process.group_leader.name : "qualys-cloud-agent"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,34 +60,3 @@ modinfo))
 ** Name: System Information Discovery
 ** ID: T1082
 ** Reference URL: https://attack.mitre.org/techniques/T1082/
-
-[[enumeration-of-kernel-modules-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and process.args:(kmod and list and sudo or sudo
-and (depmod or lsmod or modinfo))
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index 989961f6b4..25c14b6002 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -9,100 +9,87 @@ Identifies instances of an unusual process enumerating built-in Windows privileg
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<enumeration-of-privileged-local-groups-membership-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 108
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Enumeration of Privileged Local Groups Membership
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known
-legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack,
-such as mapping targets for credential compromise and other post-exploitation activities.
+This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
 - Identify the process, host and user involved on the event.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination
-of user and command line conditions.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 The 'Audit Security Group Management' audit policy must be configured (Success).
 Steps to implement the logging policy with with Advanced Audit Configuration:
@@ -123,55 +110,59 @@ Microsoft introduced the [event used](https://docs.microsoft.com/en-us/windows/s
 If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-iam where event.action == "user-member-enumerated" and /* excluding
-machine account */ not winlog.event_data.SubjectUserName: ("*$",
-"LOCAL SERVICE", "NETWORK SERVICE") and /* noisy and usual legit
-processes excluded */ not winlog.event_data.CallerProcessName:
-("-", "?:\\Windows\\System32\\VSSVC.exe",
-"?:\\Windows\\System32\\SearchIndexer.exe",
-"?:\\Windows\\System32\\CompatTelRunner.exe",
-"?:\\Windows\\System32\\oobe\\msoobe.exe",
-"?:\\Windows\\System32\\net1.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\Netplwiz.exe",
-"?:\\Windows\\System32\\msiexec.exe",
-"?:\\Windows\\SysWOW64\\msiexec.exe",
-"?:\\Windows\\System32\\CloudExperienceHostBroker.exe",
-"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
-"?:\\Windows\\System32\\SrTasks.exe",
-"?:\\Windows\\System32\\lsass.exe",
-"?:\\Windows\\System32\\diskshadow.exe",
-"?:\\Windows\\System32\\dfsrs.exe", "?:\\Program
-Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\WindowsAzure\\*\\WaAppAgent.exe",
-"?:\\Windows\\System32\\vssadmin.exe",
-"?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
-"?:\\Windows\\System32\\dllhost.exe",
-"?:\\Windows\\System32\\mmc.exe",
-"?:\\Windows\\System32\\SettingSyncHost.exe",
-"?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
-"?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
-"?:\\Windows\\Temp\\rubrik_vmware???\\snaptool.exe",
-"?:\\Windows\\System32\\inetsrv\\w3wp.exe",
-"?:\\$WINDOWS.~BT\\Sources\\*.exe",
-"?:\\Windows\\System32\\wsmprovhost.exe",
-"?:\\Windows\\System32\\spool\\drivers\\x64\\3\\x3jobt3?.exe",
-"?:\\Windows\\System32\\mstsc.exe",
-"?:\\Windows\\System32\\esentutl.exe",
-"?:\\Windows\\System32\\RecoveryDrive.exe",
-"?:\\Windows\\System32\\SystemPropertiesComputerName.exe") and /*
-privileged local groups */
-(group.name:("admin*","RemoteDesktopUsers") or
-winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555"))
+[source, js]
 ----------------------------------
+iam where event.action == "user-member-enumerated" and
+
+  /* excluding machine account */
+  not winlog.event_data.SubjectUserName: ("*$", "LOCAL SERVICE", "NETWORK SERVICE") and
+
+  /* noisy and usual legit processes excluded */
+  not winlog.event_data.CallerProcessName:
+               ("-",
+                "?:\\Windows\\System32\\VSSVC.exe",
+                "?:\\Windows\\System32\\SearchIndexer.exe",
+                "?:\\Windows\\System32\\CompatTelRunner.exe",
+                "?:\\Windows\\System32\\oobe\\msoobe.exe",
+                "?:\\Windows\\System32\\net1.exe",
+                "?:\\Windows\\System32\\svchost.exe",
+                "?:\\Windows\\System32\\Netplwiz.exe",
+                "?:\\Windows\\System32\\msiexec.exe",
+                "?:\\Windows\\SysWOW64\\msiexec.exe",
+                "?:\\Windows\\System32\\CloudExperienceHostBroker.exe",
+                "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+                "?:\\Windows\\System32\\SrTasks.exe",
+                "?:\\Windows\\System32\\lsass.exe",
+                "?:\\Windows\\System32\\diskshadow.exe",
+                "?:\\Windows\\System32\\dfsrs.exe",
+                "?:\\Program Files\\*.exe",
+                "?:\\Program Files (x86)\\*.exe",
+                "?:\\WindowsAzure\\*\\WaAppAgent.exe",
+                "?:\\Windows\\System32\\vssadmin.exe",
+                "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
+                "?:\\Windows\\System32\\dllhost.exe",
+                "?:\\Windows\\System32\\mmc.exe",
+                "?:\\Windows\\System32\\SettingSyncHost.exe",
+                "?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
+                "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
+                "?:\\Windows\\Temp\\rubrik_vmware???\\snaptool.exe",
+                "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+                "?:\\$WINDOWS.~BT\\Sources\\*.exe",
+                "?:\\Windows\\System32\\wsmprovhost.exe",
+                "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\x3jobt3?.exe",
+                "?:\\Windows\\System32\\mstsc.exe",
+                "?:\\Windows\\System32\\esentutl.exe",
+                "?:\\Windows\\System32\\RecoveryDrive.exe",
+                "?:\\Windows\\System32\\SystemPropertiesComputerName.exe") and
+
+  /* privileged local groups */
+  (group.name:("*admin*","RemoteDesktopUsers") or
+   winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -183,50 +174,7 @@ winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555"))
 ** Name: Permission Groups Discovery
 ** ID: T1069
 ** Reference URL: https://attack.mitre.org/techniques/T1069/
-
-[[enumeration-of-privileged-local-groups-membership-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-iam where event.action == "user-member-enumerated" and /* noisy and
-usual legit processes excluded */ not
-winlog.event_data.CallerProcessName:
-("?:\\Windows\\System32\\VSSVC.exe",
-"?:\\Windows\\System32\\SearchIndexer.exe",
-"?:\\Windows\\System32\\CompatTelRunner.exe",
-"?:\\Windows\\System32\\oobe\\msoobe.exe",
-"?:\\Windows\\System32\\net1.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\Netplwiz.exe",
-"?:\\Windows\\System32\\msiexec.exe",
-"?:\\Windows\\System32\\CloudExperienceHostBroker.exe",
-"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
-"?:\\Windows\\System32\\SrTasks.exe",
-"?:\\Windows\\System32\\lsass.exe",
-"?:\\Windows\\System32\\diskshadow.exe",
-"?:\\Windows\\System32\\dfsrs.exe", "?:\\Program
-Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
-/* privileged local groups */
-(group.name:("admin*","RemoteDesktopUsers") or
-winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555"))
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
index 41dcb37ca1..4be1d2020a 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of macOS built-in commands related to account or group
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,65 +14,64 @@ Identifies the execution of macOS built-in commands related to account or group
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Discovery
+*Tags*: 
 
-*Version*: 100 (<<enumeration-of-users-or-groups-via-built-in-commands-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-process.name : ("ldapsearch", "dsmemberutil") or (process.name :
-"dscl" and process.args : ("read", "-read", "list", "-list",
-"ls", "search", "-search") and process.args : ("/Active
-Directory/*", "/Users*", "/Groups*")) ) and not
-process.parent.executable :
-("/Applications/NoMAD.app/Contents/MacOS/NoMAD",
-"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence",
-"/Applications/Sourcetree.app/Contents/MacOS/Sourcetree",
-"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.
-app/Contents/MacOS/JamfDaemon", "/Applications/Jamf
-Connect.app/Contents/MacOS/Jamf Connect",
-"/usr/local/jamf/bin/jamf", "/Library/Application
-Support/AirWatch/hubd", "/opt/jc/bin/jumpcloud-agent",
-"/Applications/ESET Endpoint
-Antivirus.app/Contents/MacOS/esets_daemon", "/Applications/ESET
-Endpoint Security.app/Contents/MacOS/esets_daemon", "/Library/Pri
-vilegedHelperTools/com.fortinet.forticlient.uninstall_helper" )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  (
+    process.name : ("ldapsearch", "dsmemberutil") or
+    (process.name : "dscl" and
+      process.args : ("read", "-read", "list", "-list", "ls", "search", "-search") and
+      process.args : ("/Active Directory/*", "/Users*", "/Groups*"))
+	) and
+  not process.parent.executable : ("/Applications/NoMAD.app/Contents/MacOS/NoMAD",
+     "/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence",
+     "/Applications/Sourcetree.app/Contents/MacOS/Sourcetree",
+     "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
+     "/Applications/Jamf Connect.app/Contents/MacOS/Jamf Connect",
+     "/usr/local/jamf/bin/jamf",
+     "/Library/Application Support/AirWatch/hubd",
+     "/opt/jc/bin/jumpcloud-agent",
+     "/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon",
+     "/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon",
+     "/Library/PrivilegedHelperTools/com.fortinet.forticlient.uninstall_helper"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,62 +83,15 @@ vilegedHelperTools/com.fortinet.forticlient.uninstall_helper" )
 ** Name: Permission Groups Discovery
 ** ID: T1069
 ** Reference URL: https://attack.mitre.org/techniques/T1069/
-
-[[enumeration-of-users-or-groups-via-built-in-commands-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and not
-process.parent.executable :
-("/Applications/NoMAD.app/Contents/MacOS/NoMAD",
-"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence",
-"/Applications/Sourcetree.app/Contents/MacOS/Sourcetree",
-"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.
-app/Contents/MacOS/JamfDaemon", "/Applications/Jamf
-Connect.app/Contents/MacOS/Jamf Connect",
-"/usr/local/jamf/bin/jamf" ) and process.name : ("ldapsearch",
-"dsmemberutil") or (process.name : "dscl" and process.args :
-("read", "-read", "list", "-list", "ls", "search", "-search") and
-process.args : ("/Active Directory/*", "/Users*", "/Groups*"))
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and not
-process.parent.executable :
-("/Applications/NoMAD.app/Contents/MacOS/NoMAD",
-"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence",
-"/Applications/Sourcetree.app/Contents/MacOS/Sourcetree",
-"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.
-app/Contents/MacOS/JamfDaemon", "/usr/local/jamf/bin/jamf" )
-and process.name : ("ldapsearch", "dsmemberutil") or
-(process.name : "dscl" and process.args : ("read", "-read",
-"list", "-list", "ls", "search", "-search") and process.args :
-("/Active Directory/*", "/Users*", "/Groups*"))
-----------------------------------
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and not
-process.parent.executable :
-("/Applications/NoMAD.app/Contents/MacOS/NoMAD",
-"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence") and
-process.name : ("ldapsearch", "dsmemberutil") or (process.name :
-"dscl" and process.args : ("read", "-read", "list", "-list",
-"ls", "search", "-search") and process.args : ("/Active
-Directory/*", "/Users*", "/Groups*"))
-----------------------------------
-
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc
new file mode 100644
index 0000000000..4222c70e77
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc
@@ -0,0 +1,61 @@
+[[esxi-discovery-via-find]]
+=== ESXI Discovery via Find
+
+Identifies instances where the 'find' command is started on a Linux system with arguments targeting specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the find command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM-related files and configurations on the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and process.name : "find" and
+process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
diff --git a/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc
new file mode 100644
index 0000000000..d60f37af47
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc
@@ -0,0 +1,62 @@
+[[esxi-discovery-via-grep]]
+=== ESXI Discovery via Grep
+
+Identifies instances where a process named 'grep', 'egrep', or 'pgrep' is started on a Linux system with arguments related to virtual machine (VM) files, such as "vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", or "vmem". These file extensions are associated with VM-related file formats, and their presence in grep command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM files on the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.name : ("grep", "egrep", "pgrep") and
+process.args : ("vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", "vmem")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
diff --git a/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc
new file mode 100644
index 0000000000..bd634855ea
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc
@@ -0,0 +1,65 @@
+[[esxi-timestomping-using-touch-command]]
+=== ESXI Timestomping using Touch Command
+
+Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.name : "touch" and process.args : "-r" and process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Timestomp
+** ID: T1070.006
+** Reference URL: https://attack.mitre.org/techniques/T1070/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
new file mode 100644
index 0000000000..f71cac9cf8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
@@ -0,0 +1,121 @@
+[[exchange-mailbox-export-via-powershell]]
+=== Exchange Mailbox Export via PowerShell
+
+Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Exchange Mailbox Export via PowerShell
+
+The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the export operation:
+  - Identify the user account that performed the action and whether it should perform this kind of action.
+  - Contact the account owner and confirm whether they are aware of this activity.
+  - Check if this operation was approved and performed according to the organization's change management policy.
+  - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
+  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
+- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
+- If the operation was completed successfully:
+  - Check if the file is on the path specified in the command.
+  - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
+
+### False positive analysis
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : "New-MailboxExportRequest" and
+  not (file.path : (*Microsoft* and *Exchange* and *RemotePowerShell* or *AppData* and *Local*) and
+  file.name:(*.psd1 or *.psm1))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc b/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
index 2475ab343e..c16f3ba389 100644
--- a/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
@@ -5,7 +5,7 @@ Masquerading can allow an adversary to evade defenses and better blend in with t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,51 @@ Masquerading can allow an adversary to evade defenses and better blend in with t
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<executable-file-creation-with-multiple-extensions-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "creation" and file.extension : "exe" and
-file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pp
-tx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe""" and not
-(process.executable : ("?:\\Windows\\System32\\msiexec.exe",
-"C:\\Users\\*\\QGIS_SCCM\\Files\\QGIS-OSGeo4W-*-Setup-x86_64.exe") and
-file.path : "?:\\Program Files\\QGIS *\\apps\\grass\\*.exe") and not
-process.executable : ("/bin/sh", "/usr/sbin/MailScanner",
-"/usr/bin/perl")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and file.extension : "exe" and
+  file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe""" and
+  not (process.executable : ("?:\\Windows\\System32\\msiexec.exe", "C:\\Users\\*\\QGIS_SCCM\\Files\\QGIS-OSGeo4W-*-Setup-x86_64.exe") and
+       file.path : "?:\\Program Files\\QGIS *\\apps\\grass\\*.exe") and
+  not process.executable : ("/bin/sh", "/usr/sbin/MailScanner", "/usr/bin/perl")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +72,10 @@ process.executable : ("/bin/sh", "/usr/sbin/MailScanner",
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-
+* Sub-technique:
+** Name: Double File Extension
+** ID: T1036.007
+** Reference URL: https://attack.mitre.org/techniques/T1036/007/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -87,44 +84,7 @@ process.executable : ("/bin/sh", "/usr/sbin/MailScanner",
 ** Name: User Execution
 ** ID: T1204
 ** Reference URL: https://attack.mitre.org/techniques/T1204/
-
-[[executable-file-creation-with-multiple-extensions-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "creation" and file.extension : "exe" and
-file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pp
-tx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe"""
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Formatting only
-
-Version 2 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "creation" and file.extension:"exe" and
-file.name: ( "*.vbs.exe", "*.vbe.exe", "*.bat.exe",
-"*.js.exe", "*.cmd.exe", "*.wsh.exe", "*.ps1.exe",
-"*.pdf.exe", "*.docx.exe", "*.doc.exe", "*.xlsx.exe",
-"*.xls.exe", "*.pptx.exe", "*.ppt.exe", "*.txt.exe",
-"*.rtf.exe", "*.gif.exe", "*.jpg.exe", "*.png.exe",
-"*.bmp.exe", "*.hta.exe", "*.txt.exe", "*.img.exe",
-"*.iso.exe" )
-----------------------------------
-
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index 19d36bc54a..e5e63d271b 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -16,75 +16,74 @@ Identifies process execution from suspicious default Windows directories. This m
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<execution-from-unusual-directory-command-line-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Execution from Unusual Directory - Command Line
 
-This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to
-hide malware and make the execution less suspicious.
+This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine the command line to determine which commands or scripts were executed.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the script using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination
-of parent process executable and command line conditions.
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of parent process executable and command line conditions.
+
+### Related rules
+
+- Process Execution from an Unusual Directory - ebfe1448-7fac-4d59-acea-181bd89b1f7f
 
 ### Response and remediation
 
@@ -94,105 +93,125 @@ of parent process executable and command line conditions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-
-
-This is related to the `Process Execution from an Unusual Directory rule`.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name :
-("wscript.exe", "cscript.exe",
-"rundll32.exe", "regsvr32.exe",
-"cmstp.exe", "RegAsm.exe",
-"installutil.exe", "mshta.exe",
-"RegSvcs.exe", "powershell.exe",
-"pwsh.exe", "cmd.exe") and /* add suspicious
-execution paths here */ process.args : ("C:\\PerfLogs\\*",
-"C:\\Users\\Public\\*", "C:\\Windows\\Tasks\\*",
-"C:\\Intel\\*", "C:\\AMD\\Temp\\*",
-"C:\\Windows\\AppReadiness\\*",
-"C:\\Windows\\ServiceState\\*",
-"C:\\Windows\\security\\*",
-"C:\\Windows\\IdentityCRL\\*",
-"C:\\Windows\\Branding\\*", "C:\\Windows\\csc\\*",
-"C:\\Windows\\DigitalLocker\\*", "C:\\Windows\\en-
-US\\*", "C:\\Windows\\wlansvc\\*",
-"C:\\Windows\\Prefetch\\*", "C:\\Windows\\Fonts\\*",
-"C:\\Windows\\diagnostics\\*",
-"C:\\Windows\\TAPI\\*", "C:\\Windows\\INF\\*",
-"C:\\Windows\\System32\\Speech\\*",
-"C:\\windows\\tracing\\*", "c:\\windows\\IME\\*",
-"c:\\Windows\\Performance\\*",
-"c:\\windows\\intel\\*", "c:\\windows\\ms\\*",
-"C:\\Windows\\dot3svc\\*",
-"C:\\Windows\\panther\\*",
-"C:\\Windows\\RemotePackages\\*",
-"C:\\Windows\\OCR\\*", "C:\\Windows\\appcompat\\*",
-"C:\\Windows\\apppatch\\*",
-"C:\\Windows\\addins\\*", "C:\\Windows\\Setup\\*",
-"C:\\Windows\\Help\\*", "C:\\Windows\\SKB\\*",
-"C:\\Windows\\Vss\\*", "C:\\Windows\\servicing\\*",
-"C:\\Windows\\CbsTemp\\*", "C:\\Windows\\Logs\\*",
-"C:\\Windows\\WaaS\\*", "C:\\Windows\\twain_32\\*",
-"C:\\Windows\\ShellExperiences\\*",
-"C:\\Windows\\ShellComponents\\*",
-"C:\\Windows\\PLA\\*", "C:\\Windows\\Migration\\*",
-"C:\\Windows\\debug\\*", "C:\\Windows\\Cursors\\*",
-"C:\\Windows\\Containers\\*",
-"C:\\Windows\\Boot\\*", "C:\\Windows\\bcastdvr\\*",
-"C:\\Windows\\TextInput\\*",
-"C:\\Windows\\security\\*",
-"C:\\Windows\\schemas\\*",
-"C:\\Windows\\SchCache\\*",
-"C:\\Windows\\Resources\\*",
-"C:\\Windows\\rescache\\*",
-"C:\\Windows\\Provisioning\\*",
-"C:\\Windows\\PrintDialog\\*",
-"C:\\Windows\\PolicyDefinitions\\*",
-"C:\\Windows\\media\\*",
-"C:\\Windows\\Globalization\\*",
-"C:\\Windows\\L2Schemas\\*",
-"C:\\Windows\\LiveKernelReports\\*",
-"C:\\Windows\\ModemLogs\\*",
-"C:\\Windows\\ImmersiveControlPanel\\*",
-"C:\\$Recycle.Bin\\*") and /* noisy FP patterns */ not
-process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\File
-Repository\\*\\igfxCUIService*.exe",
-"C:\\Windows\\System32\\spacedeskService.exe",
-"C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and not
-(process.name : "rundll32.exe" and process.args :
-("uxtheme.dll,#64", "PRINTUI.DLL,PrintUIEntry",
-"?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialo
-g",
-"?:\\WINDOWS\\system32\\Speech\\SpeechUX\\sapi.cpl",
-"?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL")) and not
-(process.name : "cscript.exe" and process.args :
-"?:\\WINDOWS\\system32\\calluxxprovider.vbs") and not (process.name
-: "cmd.exe" and process.args : "?:\\WINDOWS\\system32\\powercfg.exe"
-and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and not
-(process.name : "regsvr32.exe" and process.args :
-"?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll") and not
-(process.name : "cmd.exe" and process.parent.executable :
-("?:\\Windows\\System32\\oobe\\windeploy.exe",
-"?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
-"?:\\Windows\\System32\\igfxCUIService.exe",
-"?:\\Windows\\Temp\\IE*.tmp\\IE*-support\\ienrcore.exe"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wscript.exe",
+                  "cscript.exe",
+                  "rundll32.exe",
+                  "regsvr32.exe",
+                  "cmstp.exe",
+                  "RegAsm.exe",
+                  "installutil.exe",
+                  "mshta.exe",
+                  "RegSvcs.exe",
+                  "powershell.exe",
+                  "pwsh.exe",
+                  "cmd.exe") and
+
+  /* add suspicious execution paths here */
+  process.args : ("C:\\PerfLogs\\*",
+                  "C:\\Users\\Public\\*",
+                  "C:\\Windows\\Tasks\\*",
+                  "C:\\Intel\\*",
+                  "C:\\AMD\\Temp\\*",
+                  "C:\\Windows\\AppReadiness\\*",
+                  "C:\\Windows\\ServiceState\\*",
+                  "C:\\Windows\\security\\*",
+                  "C:\\Windows\\IdentityCRL\\*",
+                  "C:\\Windows\\Branding\\*",
+                  "C:\\Windows\\csc\\*",
+                  "C:\\Windows\\DigitalLocker\\*",
+                  "C:\\Windows\\en-US\\*",
+                  "C:\\Windows\\wlansvc\\*",
+                  "C:\\Windows\\Prefetch\\*",
+                  "C:\\Windows\\Fonts\\*",
+                  "C:\\Windows\\diagnostics\\*",
+                  "C:\\Windows\\TAPI\\*",
+                  "C:\\Windows\\INF\\*",
+                  "C:\\Windows\\System32\\Speech\\*",
+                  "C:\\windows\\tracing\\*",
+                  "c:\\windows\\IME\\*",
+                  "c:\\Windows\\Performance\\*",
+                  "c:\\windows\\intel\\*",
+                  "c:\\windows\\ms\\*",
+                  "C:\\Windows\\dot3svc\\*",
+                  "C:\\Windows\\panther\\*",
+                  "C:\\Windows\\RemotePackages\\*",
+                  "C:\\Windows\\OCR\\*",
+                  "C:\\Windows\\appcompat\\*",
+                  "C:\\Windows\\apppatch\\*",
+                  "C:\\Windows\\addins\\*",
+                  "C:\\Windows\\Setup\\*",
+                  "C:\\Windows\\Help\\*",
+                  "C:\\Windows\\SKB\\*",
+                  "C:\\Windows\\Vss\\*",
+                  "C:\\Windows\\servicing\\*",
+                  "C:\\Windows\\CbsTemp\\*",
+                  "C:\\Windows\\Logs\\*",
+                  "C:\\Windows\\WaaS\\*",
+                  "C:\\Windows\\twain_32\\*",
+                  "C:\\Windows\\ShellExperiences\\*",
+                  "C:\\Windows\\ShellComponents\\*",
+                  "C:\\Windows\\PLA\\*",
+                  "C:\\Windows\\Migration\\*",
+                  "C:\\Windows\\debug\\*",
+                  "C:\\Windows\\Cursors\\*",
+                  "C:\\Windows\\Containers\\*",
+                  "C:\\Windows\\Boot\\*",
+                  "C:\\Windows\\bcastdvr\\*",
+                  "C:\\Windows\\TextInput\\*",
+                  "C:\\Windows\\security\\*",
+                  "C:\\Windows\\schemas\\*",
+                  "C:\\Windows\\SchCache\\*",
+                  "C:\\Windows\\Resources\\*",
+                  "C:\\Windows\\rescache\\*",
+                  "C:\\Windows\\Provisioning\\*",
+                  "C:\\Windows\\PrintDialog\\*",
+                  "C:\\Windows\\PolicyDefinitions\\*",
+                  "C:\\Windows\\media\\*",
+                  "C:\\Windows\\Globalization\\*",
+                  "C:\\Windows\\L2Schemas\\*",
+                  "C:\\Windows\\LiveKernelReports\\*",
+                  "C:\\Windows\\ModemLogs\\*",
+                  "C:\\Windows\\ImmersiveControlPanel\\*",
+                  "C:\\$Recycle.Bin\\*") and
+
+  /* noisy FP patterns */
+
+  not process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe",
+                                   "C:\\Windows\\System32\\spacedeskService.exe",
+                                   "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and
+  not (process.name : "rundll32.exe" and
+       process.args : ("uxtheme.dll,#64",
+                       "PRINTUI.DLL,PrintUIEntry",
+                       "?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialog",
+                       "?:\\WINDOWS\\system32\\Speech\\SpeechUX\\sapi.cpl",
+                       "?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL")) and
+
+  not (process.name : "cscript.exe" and process.args : "?:\\WINDOWS\\system32\\calluxxprovider.vbs") and
+
+  not (process.name : "cmd.exe" and process.args : "?:\\WINDOWS\\system32\\powercfg.exe" and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and
+
+  not (process.name : "regsvr32.exe" and process.args : "?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll") and
+
+  not (process.name : "cmd.exe" and
+       process.parent.executable : ("?:\\Windows\\System32\\oobe\\windeploy.exe",
+                                    "?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
+                                    "?:\\Windows\\System32\\igfxCUIService.exe",
+                                    "?:\\Windows\\Temp\\IE*.tmp\\IE*-support\\ienrcore.exe"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -204,8 +223,10 @@ and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and not
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -214,250 +235,7 @@ and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and not
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[execution-from-unusual-directory-command-line-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name : ("wscript.exe", "cscript.exe",
-"rundll32.exe", "regsvr32.exe",
-"cmstp.exe", "RegAsm.exe",
-"installutil.exe", "mshta.exe",
-"RegSvcs.exe", "powershell.exe",
-"pwsh.exe", "cmd.exe") and /* add suspicious
-execution paths here */ process.args : ("C:\\PerfLogs\\*",
-"C:\\Users\\Public\\*", "C:\\Windows\\Tasks\\*",
-"C:\\Intel\\*", "C:\\AMD\\Temp\\*",
-"C:\\Windows\\AppReadiness\\*",
-"C:\\Windows\\ServiceState\\*",
-"C:\\Windows\\security\\*",
-"C:\\Windows\\IdentityCRL\\*",
-"C:\\Windows\\Branding\\*", "C:\\Windows\\csc\\*",
-"C:\\Windows\\DigitalLocker\\*", "C:\\Windows\\en-
-US\\*", "C:\\Windows\\wlansvc\\*",
-"C:\\Windows\\Prefetch\\*", "C:\\Windows\\Fonts\\*",
-"C:\\Windows\\diagnostics\\*",
-"C:\\Windows\\TAPI\\*", "C:\\Windows\\INF\\*",
-"C:\\Windows\\System32\\Speech\\*",
-"C:\\windows\\tracing\\*", "c:\\windows\\IME\\*",
-"c:\\Windows\\Performance\\*",
-"c:\\windows\\intel\\*", "c:\\windows\\ms\\*",
-"C:\\Windows\\dot3svc\\*",
-"C:\\Windows\\panther\\*",
-"C:\\Windows\\RemotePackages\\*",
-"C:\\Windows\\OCR\\*", "C:\\Windows\\appcompat\\*",
-"C:\\Windows\\apppatch\\*",
-"C:\\Windows\\addins\\*", "C:\\Windows\\Setup\\*",
-"C:\\Windows\\Help\\*", "C:\\Windows\\SKB\\*",
-"C:\\Windows\\Vss\\*", "C:\\Windows\\servicing\\*",
-"C:\\Windows\\CbsTemp\\*", "C:\\Windows\\Logs\\*",
-"C:\\Windows\\WaaS\\*", "C:\\Windows\\twain_32\\*",
-"C:\\Windows\\ShellExperiences\\*",
-"C:\\Windows\\ShellComponents\\*",
-"C:\\Windows\\PLA\\*", "C:\\Windows\\Migration\\*",
-"C:\\Windows\\debug\\*", "C:\\Windows\\Cursors\\*",
-"C:\\Windows\\Containers\\*",
-"C:\\Windows\\Boot\\*", "C:\\Windows\\bcastdvr\\*",
-"C:\\Windows\\TextInput\\*",
-"C:\\Windows\\security\\*",
-"C:\\Windows\\schemas\\*",
-"C:\\Windows\\SchCache\\*",
-"C:\\Windows\\Resources\\*",
-"C:\\Windows\\rescache\\*",
-"C:\\Windows\\Provisioning\\*",
-"C:\\Windows\\PrintDialog\\*",
-"C:\\Windows\\PolicyDefinitions\\*",
-"C:\\Windows\\media\\*",
-"C:\\Windows\\Globalization\\*",
-"C:\\Windows\\L2Schemas\\*",
-"C:\\Windows\\LiveKernelReports\\*",
-"C:\\Windows\\ModemLogs\\*",
-"C:\\Windows\\ImmersiveControlPanel\\*",
-"C:\\$Recycle.Bin\\*") and /* noisy FP patterns */ not
-process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\File
-Repository\\*\\igfxCUIService*.exe",
-"C:\\Windows\\System32\\spacedeskService.exe",
-"C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and not
-(process.name : "rundll32.exe" and process.args :
-("uxtheme.dll,#64", "PRINTUI.DLL,PrintUIEntry",
-"?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialo
-g",
-"?:\\WINDOWS\\system32\\Speech\\SpeechUX\\sapi.cpl",
-"?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL")) and not
-(process.name : "cscript.exe" and process.args :
-"?:\\WINDOWS\\system32\\calluxxprovider.vbs") and not (process.name
-: "cmd.exe" and process.args : "?:\\WINDOWS\\system32\\powercfg.exe"
-and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and not
-(process.name : "regsvr32.exe" and process.args :
-"?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll") and not
-(process.name : "cmd.exe" and process.parent.executable :
-("?:\\Windows\\System32\\oobe\\windeploy.exe",
-"?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
-"?:\\Windows\\System32\\igfxCUIService.exe",
-"?:\\Windows\\Temp\\IE*.tmp\\IE*-support\\ienrcore.exe"))
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name : ("wscript.exe", "cscript.exe",
-"rundll32.exe", "regsvr32.exe",
-"cmstp.exe", "RegAsm.exe",
-"installutil.exe", "mshta.exe",
-"RegSvcs.exe", "powershell.exe",
-"pwsh.exe", "cmd.exe") and /*
-add suspicious execution paths here */ process.args :
-("C:\\PerfLogs\\*", "C:\\Users\\Public\\*",
-"C:\\Users\\Default\\*", "C:\\Windows\\Tasks\\*",
-"C:\\Intel\\*", "C:\\AMD\\Temp\\*",
-"C:\\Windows\\AppReadiness\\*",
-"C:\\Windows\\ServiceState\\*",
-"C:\\Windows\\security\\*",
-"C:\\Windows\\IdentityCRL\\*",
-"C:\\Windows\\Branding\\*", "C:\\Windows\\csc\\*",
-"C:\\Windows\\DigitalLocker\\*", "C:\\Windows\\en-
-US\\*", "C:\\Windows\\wlansvc\\*",
-"C:\\Windows\\Prefetch\\*", "C:\\Windows\\Fonts\\*",
-"C:\\Windows\\diagnostics\\*",
-"C:\\Windows\\TAPI\\*", "C:\\Windows\\INF\\*",
-"C:\\Windows\\System32\\Speech\\*",
-"C:\\windows\\tracing\\*", "c:\\windows\\IME\\*",
-"c:\\Windows\\Performance\\*",
-"c:\\windows\\intel\\*", "c:\\windows\\ms\\*",
-"C:\\Windows\\dot3svc\\*",
-"C:\\Windows\\ServiceProfiles\\*",
-"C:\\Windows\\panther\\*",
-"C:\\Windows\\RemotePackages\\*",
-"C:\\Windows\\OCR\\*", "C:\\Windows\\appcompat\\*",
-"C:\\Windows\\apppatch\\*",
-"C:\\Windows\\addins\\*", "C:\\Windows\\Setup\\*",
-"C:\\Windows\\Help\\*", "C:\\Windows\\SKB\\*",
-"C:\\Windows\\Vss\\*", "C:\\Windows\\Web\\*",
-"C:\\Windows\\servicing\\*",
-"C:\\Windows\\CbsTemp\\*", "C:\\Windows\\Logs\\*",
-"C:\\Windows\\WaaS\\*", "C:\\Windows\\twain_32\\*",
-"C:\\Windows\\ShellExperiences\\*",
-"C:\\Windows\\ShellComponents\\*",
-"C:\\Windows\\PLA\\*", "C:\\Windows\\Migration\\*",
-"C:\\Windows\\debug\\*", "C:\\Windows\\Cursors\\*",
-"C:\\Windows\\Containers\\*",
-"C:\\Windows\\Boot\\*", "C:\\Windows\\bcastdvr\\*",
-"C:\\Windows\\assembly\\*",
-"C:\\Windows\\TextInput\\*",
-"C:\\Windows\\security\\*",
-"C:\\Windows\\schemas\\*",
-"C:\\Windows\\SchCache\\*",
-"C:\\Windows\\Resources\\*",
-"C:\\Windows\\rescache\\*",
-"C:\\Windows\\Provisioning\\*",
-"C:\\Windows\\PrintDialog\\*",
-"C:\\Windows\\PolicyDefinitions\\*",
-"C:\\Windows\\media\\*",
-"C:\\Windows\\Globalization\\*",
-"C:\\Windows\\L2Schemas\\*",
-"C:\\Windows\\LiveKernelReports\\*",
-"C:\\Windows\\ModemLogs\\*",
-"C:\\Windows\\ImmersiveControlPanel\\*",
-"C:\\$Recycle.Bin\\*") and not process.parent.executable : ("C:\\WIN
-DOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe",
-"C:\\Windows\\System32\\spacedeskService.exe",
-"C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and not
-(process.name : "rundll32.exe" and process.args : ("uxtheme.dll,#64",
-"PRINTUI.DLL,PrintUIEntry"))
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name : ("wscript.exe","cscript.exe","rundll32.exe","regsvr32.e
-xe","cmstp.exe","RegAsm.exe","installutil.exe","mshta.exe","RegSvcs.ex
-e", "powershell.exe", "pwsh.exe", "cmd.exe") and /* add suspicious
-execution paths here */ process.args : ("C:\\PerfLogs\\*","C:\\Users\\
-Public\\*","C:\\Users\\Default\\*","C:\\Windows\\Tasks\\*","C:\\Intel\
-\*", "C:\\AMD\\Temp\\*", "C:\\Windows\\AppReadiness\\*", "C:\\Window
-s\\ServiceState\\*","C:\\Windows\\security\\*","C:\\Windows\\IdentityC
-RL\\*","C:\\Windows\\Branding\\*","C:\\Windows\\csc\\*",
-"C:\\Windows\\DigitalLocker\\*","C:\\Windows\\en-US\\*","C:\\Windows\\
-wlansvc\\*","C:\\Windows\\Prefetch\\*","C:\\Windows\\Fonts\\*", "C:\\
-Windows\\diagnostics\\*","C:\\Windows\\TAPI\\*","C:\\Windows\\INF\\*",
-"C:\\Windows\\System32\\Speech\\*","C:\\windows\\tracing\\*", "c:\\wi
-ndows\\IME\\*","c:\\Windows\\Performance\\*","c:\\windows\\intel\\*","
-c:\\windows\\ms\\*","C:\\Windows\\dot3svc\\*","C:\\Windows\\ServicePro
-files\\*", "C:\\Windows\\panther\\*","C:\\Windows\\RemotePackages\\*"
-,"C:\\Windows\\OCR\\*","C:\\Windows\\appcompat\\*","C:\\Windows\\apppa
-tch\\*","C:\\Windows\\addins\\*", "C:\\Windows\\Setup\\*","C:\\Window
-s\\Help\\*","C:\\Windows\\SKB\\*","C:\\Windows\\Vss\\*","C:\\Windows\\
-Web\\*","C:\\Windows\\servicing\\*","C:\\Windows\\CbsTemp\\*", "C:\\W
-indows\\Logs\\*","C:\\Windows\\WaaS\\*","C:\\Windows\\twain_32\\*","C:
-\\Windows\\ShellExperiences\\*","C:\\Windows\\ShellComponents\\*","C:\
-\Windows\\PLA\\*", "C:\\Windows\\Migration\\*","C:\\Windows\\debug\\*
-","C:\\Windows\\Cursors\\*","C:\\Windows\\Containers\\*","C:\\Windows\
-\Boot\\*","C:\\Windows\\bcastdvr\\*", "C:\\Windows\\assembly\\*","C:\
-\Windows\\TextInput\\*","C:\\Windows\\security\\*","C:\\Windows\\schem
-as\\*","C:\\Windows\\SchCache\\*","C:\\Windows\\Resources\\*", "C:\\W
-indows\\rescache\\*","C:\\Windows\\Provisioning\\*","C:\\Windows\\Prin
-tDialog\\*","C:\\Windows\\PolicyDefinitions\\*","C:\\Windows\\media\\*
-", "C:\\Windows\\Globalization\\*","C:\\Windows\\L2Schemas\\*","C:\\W
-indows\\LiveKernelReports\\*","C:\\Windows\\ModemLogs\\*","C:\\Windows
-\\ImmersiveControlPanel\\*", "C:\\$Recycle.Bin\\*")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name : ("wscript.exe","cscript.exe","rundll32.exe","regsvr32.e
-xe","cmstp.exe","RegAsm.exe","installutil.exe","mshta.exe","RegSvcs.ex
-e") and /* add suspicious execution paths here */ process.args : ("C:
-\\PerfLogs\\*","C:\\Users\\Public\\*","C:\\Users\\Default\\*","C:\\Win
-dows\\Tasks\\*","C:\\Intel\\*", "C:\\AMD\\Temp\\*",
-"C:\\Windows\\AppReadiness\\*", "C:\\Windows\\ServiceState\\*","C:\\Wi
-ndows\\security\\*","C:\\Windows\\IdentityCRL\\*","C:\\Windows\\Brandi
-ng\\*","C:\\Windows\\csc\\*",
-"C:\\Windows\\DigitalLocker\\*","C:\\Windows\\en-US\\*","C:\\Windows\\
-wlansvc\\*","C:\\Windows\\Prefetch\\*","C:\\Windows\\Fonts\\*", "C:\\
-Windows\\diagnostics\\*","C:\\Windows\\TAPI\\*","C:\\Windows\\INF\\*",
-"C:\\Windows\\System32\\Speech\\*","C:\\windows\\tracing\\*", "c:\\wi
-ndows\\IME\\*","c:\\Windows\\Performance\\*","c:\\windows\\intel\\*","
-c:\\windows\\ms\\*","C:\\Windows\\dot3svc\\*","C:\\Windows\\ServicePro
-files\\*", "C:\\Windows\\panther\\*","C:\\Windows\\RemotePackages\\*"
-,"C:\\Windows\\OCR\\*","C:\\Windows\\appcompat\\*","C:\\Windows\\apppa
-tch\\*","C:\\Windows\\addins\\*", "C:\\Windows\\Setup\\*","C:\\Window
-s\\Help\\*","C:\\Windows\\SKB\\*","C:\\Windows\\Vss\\*","C:\\Windows\\
-Web\\*","C:\\Windows\\servicing\\*","C:\\Windows\\CbsTemp\\*", "C:\\W
-indows\\Logs\\*","C:\\Windows\\WaaS\\*","C:\\Windows\\twain_32\\*","C:
-\\Windows\\ShellExperiences\\*","C:\\Windows\\ShellComponents\\*","C:\
-\Windows\\PLA\\*", "C:\\Windows\\Migration\\*","C:\\Windows\\debug\\*
-","C:\\Windows\\Cursors\\*","C:\\Windows\\Containers\\*","C:\\Windows\
-\Boot\\*","C:\\Windows\\bcastdvr\\*", "C:\\Windows\\assembly\\*","C:\
-\Windows\\TextInput\\*","C:\\Windows\\security\\*","C:\\Windows\\schem
-as\\*","C:\\Windows\\SchCache\\*","C:\\Windows\\Resources\\*", "C:\\W
-indows\\rescache\\*","C:\\Windows\\Provisioning\\*","C:\\Windows\\Prin
-tDialog\\*","C:\\Windows\\PolicyDefinitions\\*","C:\\Windows\\media\\*
-", "C:\\Windows\\Globalization\\*","C:\\Windows\\L2Schemas\\*","C:\\W
-indows\\LiveKernelReports\\*","C:\\Windows\\ModemLogs\\*","C:\\Windows
-\\ImmersiveControlPanel\\*")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
index 20a93ae17b..cc198c66e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
@@ -5,7 +5,7 @@ Windows Component Object Model (COM) is an inter-process communication (IPC) com
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,58 +16,57 @@ Windows Component Object Model (COM) is an inter-process communication (IPC) com
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
 * http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
-
-*Version*: 102 (<<execution-of-com-object-via-xwizard-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.pe.original_file_name
-: "xwizard.exe" and ( (process.args : "RunWizard" and process.args
-: "{*}") or (process.executable != null and not
-process.executable : ("C:\\Windows\\SysWOW64\\xwizard.exe",
-"C:\\Windows\\System32\\xwizard.exe") ) )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.pe.original_file_name : "xwizard.exe" and
+ (
+   (process.args : "RunWizard" and process.args : "{*}") or
+   (process.executable != null and
+     not process.executable : ("C:\\Windows\\SysWOW64\\xwizard.exe", "C:\\Windows\\System32\\xwizard.exe")
+   )
+ )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,29 +78,7 @@ process.executable : ("C:\\Windows\\SysWOW64\\xwizard.exe",
 ** Name: Inter-Process Communication
 ** ID: T1559
 ** Reference URL: https://attack.mitre.org/techniques/T1559/
-
-[[execution-of-com-object-via-xwizard-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name : "xwizard.exe" and ( (process.args
-: "RunWizard" and process.args : "{*}") or (process.executable !=
-null and not process.executable :
-("C:\\Windows\\SysWOW64\\xwizard.exe",
-"C:\\Windows\\System32\\xwizard.exe") ) )
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc
index 0e5056dcff..6050316159 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc
@@ -5,7 +5,7 @@ Identifies an executable created by a Microsoft Office application and subsequen
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,57 +16,50 @@ Identifies an executable created by a Microsoft Office application and subsequen
 
 *Risk score*: 73
 
-*Runs every*: 60 minutes
+*Runs every*: 60m
 
 *Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<execution-of-file-written-or-modified-by-microsoft-office-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Execution of File Written or Modified by Microsoft Office
 
-Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer.
-You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create
-presentations and posters. As it is some of the most-used software across companies, MS Office is frequently
-targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
 
-This rule searches for executable files written by MS Office applications executed in sequence. This is most likely the result
-of the execution of malicious documents or exploitation for initial access or privilege escalation. This rule can also detect
-suspicious processes masquerading as the MS Office applications.
+This rule searches for executable files written by MS Office applications executed in sequence. This is most likely the result of the execution of malicious documents or exploitation for initial access or privilege escalation. This rule can also detect suspicious processes masquerading as the MS Office applications.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include,
-but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
 - Determine if the collected files are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -85,46 +78,43 @@ but are not limited to, the Downloads and Document folders and the folder config
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
   - If the malicious file was delivered via phishing:
     - Block the email sender from sending future emails.
     - Block the malicious web pages.
     - Remove emails from the sender from mailboxes.
     - Consider improvements to the security awareness program.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=2h [file where event.type != "deletion" and
-file.extension : "exe" and (process.name : "WINWORD.EXE" or
-process.name : "EXCEL.EXE" or process.name : "OUTLOOK.EXE" or
-process.name : "POWERPNT.EXE" or process.name : "eqnedt32.exe"
-or process.name : "fltldr.exe" or process.name :
-"MSPUB.EXE" or process.name : "MSACCESS.EXE") ] by host.id,
-file.path [process where event.type == "start"] by host.id,
-process.executable
+[source, js]
 ----------------------------------
+sequence with maxspan=2h
+  [file where host.os.type == "windows" and event.type != "deletion" and file.extension : "exe" and
+     (process.name : "WINWORD.EXE" or
+      process.name : "EXCEL.EXE" or
+      process.name : "OUTLOOK.EXE" or
+      process.name : "POWERPNT.EXE" or
+      process.name : "eqnedt32.exe" or
+      process.name : "fltldr.exe" or
+      process.name : "MSPUB.EXE" or
+      process.name : "MSACCESS.EXE")
+  ] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -132,8 +122,6 @@ process.executable
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -142,43 +130,11 @@ process.executable
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[execution-of-file-written-or-modified-by-microsoft-office-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=2h [file where event.type != "deletion" and
-file.extension : "exe" and (process.name : "WINWORD.EXE" or
-process.name : "EXCEL.EXE" or process.name : "OUTLOOK.EXE" or
-process.name : "POWERPNT.EXE" or process.name : "eqnedt32.exe"
-or process.name : "fltldr.exe" or process.name :
-"MSPUB.EXE" or process.name : "MSACCESS.EXE") ] by host.id,
-file.path [process where event.type in ("start", "process_started")]
-by host.id, process.executable
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc
index 89643cf1c0..99a3eaef51 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc
@@ -5,7 +5,7 @@ Identifies a suspicious file that was written by a PDF reader application and su
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,56 +16,50 @@ Identifies a suspicious file that was written by a PDF reader application and su
 
 *Risk score*: 73
 
-*Runs every*: 60 minutes
+*Runs every*: 60m
 
 *Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<execution-of-file-written-or-modified-by-pdf-reader-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Execution of File Written or Modified by PDF Reader
 
-PDF is a common file type used in corporate environments and most machines have software to
-handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of
-software for initial access or privilege escalation.
+PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
 
-This rule searches for executable files written by PDF reader software and executed in sequence. This is most likely the
-result of exploitation for privilege escalation or initial access. This rule can also detect suspicious processes masquerading as
-PDF readers.
+This rule searches for executable files written by PDF reader software and executed in sequence. This is most likely the result of exploitation for privilege escalation or initial access. This rule can also detect suspicious processes masquerading as PDF readers.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Retrieve the PDF documents received and opened by the user that could cause this behavior. Common locations include,
-but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Retrieve the PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
 - Determine if the collected files are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -84,48 +78,45 @@ but are not limited to, the Downloads and Document folders and the folder config
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
   - If the malicious file was delivered via phishing:
     - Block the email sender from sending future emails.
     - Block the malicious web pages.
     - Remove emails from the sender from mailboxes.
     - Consider improvements to the security awareness program.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=2h [file where event.type != "deletion" and
-file.extension : "exe" and (process.name : "AcroRd32.exe" or
-process.name : "rdrcef.exe" or process.name :
-"FoxitPhantomPDF.exe" or process.name : "FoxitReader.exe") and
-not (file.name : "FoxitPhantomPDF.exe" or file.name :
-"FoxitPhantomPDFUpdater.exe" or file.name :
-"FoxitReader.exe" or file.name : "FoxitReaderUpdater.exe" or
-file.name : "AcroRd32.exe" or file.name : "rdrcef.exe") ]
-by host.id, file.path [process where event.type == "start"] by
-host.id, process.executable
+[source, js]
 ----------------------------------
+sequence with maxspan=2h
+  [file where host.os.type == "windows" and event.type != "deletion" and file.extension : "exe" and
+     (process.name : "AcroRd32.exe" or
+      process.name : "rdrcef.exe" or
+      process.name : "FoxitPhantomPDF.exe" or
+      process.name : "FoxitReader.exe") and
+     not (file.name : "FoxitPhantomPDF.exe" or
+          file.name : "FoxitPhantomPDFUpdater.exe" or
+          file.name : "FoxitReader.exe" or
+          file.name : "FoxitReaderUpdater.exe" or
+          file.name : "AcroRd32.exe" or
+          file.name : "rdrcef.exe")
+  ] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,8 +124,6 @@ host.id, process.executable
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -143,42 +132,11 @@ host.id, process.executable
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[execution-of-file-written-or-modified-by-pdf-reader-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=2h [file where event.type != "deletion" and
-file.extension : "exe" and (process.name : "AcroRd32.exe" or
-process.name : "rdrcef.exe" or process.name :
-"FoxitPhantomPDF.exe" or process.name : "FoxitReader.exe") and
-not (file.name : "FoxitPhantomPDF.exe" or file.name :
-"FoxitPhantomPDFUpdater.exe" or file.name :
-"FoxitReader.exe" or file.name : "FoxitReaderUpdater.exe" or
-file.name : "AcroRd32.exe" or file.name : "rdrcef.exe") ]
-by host.id, file.path [process where event.type in ("start",
-"process_started")] by host.id, process.executable
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc
index 683bdd8e26..fd216e7ade 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc
@@ -5,63 +5,67 @@ Identifies execution of suspicious persistent programs (scripts, rundll32, etc.)
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 101 (<<execution-of-persistent-suspicious-program-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* userinit followed by explorer followed by early child process of
-explorer (unlikely to be launched interactively) within 1m */ sequence
-by host.id, user.name with maxspan=1m [process where event.type ==
-"start" and process.name : "userinit.exe" and process.parent.name :
-"winlogon.exe"] [process where event.type == "start" and
-process.name : "explorer.exe"] [process where event.type == "start"
-and process.parent.name : "explorer.exe" and /* add suspicious
-programs here */ process.pe.original_file_name in ("cscript.exe",
-"wscript.exe", "PowerShell.EXE",
-"MSHTA.EXE", "RUNDLL32.EXE",
-"REGSVR32.EXE", "RegAsm.exe",
-"MSBuild.exe", "InstallUtil.exe")
-and /* add potential suspicious paths here */ process.args :
-("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Windows\\Temp\\*",
-"C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*", "C:\\Intel\\*") ]
+[source, js]
 ----------------------------------
+/* userinit followed by explorer followed by early child process of explorer (unlikely to be launched interactively) within 1m */
+sequence by host.id, user.name with maxspan=1m
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "userinit.exe" and process.parent.name : "winlogon.exe"]
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "explorer.exe"]
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "explorer.exe" and
+   /* add suspicious programs here */
+   process.pe.original_file_name in ("cscript.exe",
+                                     "wscript.exe",
+                                     "PowerShell.EXE",
+                                     "MSHTA.EXE",
+                                     "RUNDLL32.EXE",
+                                     "REGSVR32.EXE",
+                                     "RegAsm.exe",
+                                     "MSBuild.exe",
+                                     "InstallUtil.exe") and
+    /* add potential suspicious paths here */
+    process.args : ("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Windows\\Temp\\*", "C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*", "C:\\Intel\\*")
+   ]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,36 +77,7 @@ and /* add potential suspicious paths here */ process.args :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[execution-of-persistent-suspicious-program-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* userinit followed by explorer followed by early child process of
-explorer (unlikely to be launched interactively) within 1m */ sequence
-by host.id, user.name with maxspan=1m [process where event.type in
-("start", "process_started") and process.name : "userinit.exe" and
-process.parent.name : "winlogon.exe"] [process where event.type in
-("start", "process_started") and process.name : "explorer.exe"]
-[process where event.type in ("start", "process_started") and
-process.parent.name : "explorer.exe" and /* add suspicious programs
-here */ process.pe.original_file_name in ("cscript.exe",
-"wscript.exe", "PowerShell.EXE",
-"MSHTA.EXE", "RUNDLL32.EXE",
-"REGSVR32.EXE", "RegAsm.exe",
-"MSBuild.exe", "InstallUtil.exe")
-and /* add potential suspicious paths here */ process.args :
-("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Windows\\Temp\\*",
-"C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*", "C:\\Intel\\*") ]
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
new file mode 100644
index 0000000000..7533eafbbe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
@@ -0,0 +1,72 @@
+[[execution-via-electron-child-process-node-js-module]]
+=== Execution via Electron Child Process Node.js Module
+
+Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.matthewslipper.com/2019/09/22/everything-you-wanted-electron-child-process.html
+* https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks/
+* https://nodejs.org/api/child_process.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and process.args:("-e" and const*require*child_process*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
index 94140e651c..1248140ccd 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation, change, or deletion of a DLL module within a Windows Sx
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,51 @@ Identifies the creation, change, or deletion of a DLL module within a Windows Sx
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
-
-*Version*: 101 (<<execution-via-local-sxs-shared-module-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 The SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where file.extension : "dll" and file.path :
-"C:\\*\\*.exe.local\\*.dll"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and file.extension : "dll" and file.path : "C:\\*\\*.exe.local\\*.dll"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,28 +72,3 @@ file where file.extension : "dll" and file.path :
 ** Name: Shared Modules
 ** ID: T1129
 ** Reference URL: https://attack.mitre.org/techniques/T1129/
-
-[[execution-via-local-sxs-shared-module-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
new file mode 100644
index 0000000000..df357c85a6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
@@ -0,0 +1,107 @@
+[[execution-via-mssql-xp-cmdshell-stored-procedure]]
+=== Execution via MSSQL xp_cmdshell Stored Procedure
+
+Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Execution via MSSQL xp_cmdshell Stored Procedure
+
+Microsoft SQL Server (MSSQL) has procedures meant to extend its functionality, the Extended Stored Procedures. These procedures are external functions written in C/C++; some provide interfaces for external programs. This is the case for xp_cmdshell, which spawns a Windows command shell and passes in a string for execution. Attackers can use this to execute commands on the system running the SQL server, commonly to escalate their privileges and establish persistence.
+
+The xp_cmdshell procedure is disabled by default, but when used, it has the same security context as the MSSQL Server service account, which is often privileged.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the command line to determine if the command executed is potentially harmful or malicious.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+
+### False positive analysis
+
+- This mechanism can be used legitimately, but it brings inherent risk. The security team must monitor any activity of it. If recurrent tasks are being executed using this mechanism, consider adding exceptions — preferably with a full command line.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Ensure that SQL servers are not directly exposed to the internet. If there is a business justification for such, use an allowlist to allow only connections from known legitimate sources.
+- Disable the xp_cmdshell stored procedure.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "cmd.exe" and process.parent.name : "sqlservr.exe" and
+  not process.args : ("\\\\*", "diskfree", "rmdir", "mkdir", "dir", "del", "rename", "bcp", "*XMLNAMESPACES*",
+                      "?:\\MSSQL\\Backup\\Jobs\\sql_agent_backup_job.ps1", "K:\\MSSQL\\Backup\\msdb", "K:\\MSSQL\\Backup\\Logins")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
index 419a7ae144..de52cc055b 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
@@ -5,63 +5,60 @@ Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint ts
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 101 (<<execution-via-tsclient-mountpoint-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.executable :
-"\\Device\\Mup\\tsclient\\*.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.executable : "\\Device\\Mup\\tsclient\\*.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,28 +70,3 @@ process where event.type == "start" and process.executable :
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[execution-via-tsclient-mountpoint-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.executable : "\\Device\\Mup\\tsclient\\*.exe"
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc
new file mode 100644
index 0000000000..b7307a473d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc
@@ -0,0 +1,77 @@
+[[execution-via-windows-subsystem-for-linux]]
+=== Execution via Windows Subsystem for Linux
+
+Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows/wsl/wsl-config
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type : "start" and
+ process.parent.executable : 
+    ("?:\\Windows\\System32\\wsl.exe", 
+     "?:\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl.exe", 
+     "?:\\Windows\\System32\\wslhost.exe", 
+     "?:\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wslhost.exe") and 
+  not process.executable : 
+           ("?:\\Windows\\System32\\conhost.exe", 
+            "?:\\Windows\\System32\\lxss\\wslhost.exe", 
+            "?:\\Windows\\Sys*\\wslconfig.exe", 
+            "?:\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl*.exe", 
+            "?:\\Windows\\System32\\WerFault.exe", 
+            "?:\\Program Files\\*", 
+            "?:\\Program Files (x86)\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
index 870815289a..3114a815f8 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
@@ -5,7 +5,7 @@ Identifies execution of the security_authtrampoline process via a scripting inte
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,49 +14,44 @@ Identifies execution of the security_authtrampoline process via a scripting inte
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf
 * https://www.manpagez.com/man/8/security_authtrampoline/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Execution
-* Privilege Escalation
-
-*Version*: 100 (<<execution-with-explicit-credentials-via-scripting-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:"security_authtrampoline" and
-process.parent.name:(osascript or com.apple.automator.runner or sh or
-bash or dash or zsh or python* or Python or perl* or php* or ruby or
-pwsh)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:"security_authtrampoline" and
+ process.parent.name:(osascript or com.apple.automator.runner or sh or bash or dash or zsh or python* or Python or perl* or php* or ruby or pwsh)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,8 +63,14 @@ pwsh)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Elevated Execution with Prompt
+** ID: T1548.004
+** Reference URL: https://attack.mitre.org/techniques/T1548/004/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -78,35 +79,3 @@ pwsh)
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[execution-with-explicit-credentials-via-scripting-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:"security_authtrampoline" and
-process.parent.name:(osascript or com.apple.automator.runner or sh or
-bash or dash or zsh or python* or perl* or php* or ruby or pwsh)
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Rule name changed from: Execution with Explicit Credentials via Apple Scripting
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name == "osascript"]
-by process.pid [process where event.type in ("start",
-"process_started") and process.name == "security_authtrampoline"] by
-process.ppid
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc
new file mode 100644
index 0000000000..61f79de55d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc
@@ -0,0 +1,62 @@
+[[expired-or-revoked-driver-loaded]]
+=== Expired or Revoked Driver Loaded
+
+Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+driver where host.os.type == "windows" and process.pid == 4 and
+  dll.code_signature.status : ("errorExpired", "errorRevoked")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/rule-details/exploit-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/exploit-detected-elastic-endgame.asciidoc
index ef33486297..4d2244997a 100644
--- a/docs/detections/prebuilt-rules/rule-details/exploit-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exploit-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,38 @@ Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Execution
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<exploit-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and (event.action:exploit_event or
-endgame.event_subtype_full:exploit_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -55,8 +52,6 @@ endgame.event_subtype_full:exploit_event)
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -65,34 +60,3 @@ endgame.event_subtype_full:exploit_event)
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[exploit-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Exploit - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Exploit - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Exploit - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:exploit_event and endgame.metadata.type:detection
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/exploit-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/exploit-prevented-elastic-endgame.asciidoc
index 6c392bf2dd..8714f47362 100644
--- a/docs/detections/prebuilt-rules/rule-details/exploit-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exploit-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the even
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,38 @@ Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the even
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Execution
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<exploit-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and (event.action:exploit_event or
-endgame.event_subtype_full:exploit_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -55,8 +52,6 @@ endgame.event_subtype_full:exploit_event)
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -65,34 +60,3 @@ endgame.event_subtype_full:exploit_event)
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[exploit-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Exploit - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Exploit - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Exploit - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:exploit_event and endgame.metadata.type:prevention
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
index e52e458d68..8fc628a71f 100644
--- a/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,78 +16,68 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
 * https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Collection
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<exporting-exchange-mailbox-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate exchange system administration activity.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Exporting Exchange Mailbox via PowerShell
 
-The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive
-to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.
 
-Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive
-and strategic data.
+The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+
+Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the export operation:
   - Identify the user account that performed the action and whether it should perform this kind of action.
   - Contact the account owner and confirm whether they are aware of this activity.
   - Check if this operation was approved and performed according to the organization's change management policy.
   - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
-  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that
-  assigned the "Mailbox Import Export" privilege for abnormal activity.
-- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on
-a per-mailbox basis and can be part of a mass export.
+  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
+- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
 - If the operation was completed successfully:
   - Check if the file is on the path specified in the command.
   - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity
-and it is done with proper approval.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
 
 ### Response and remediation
 
@@ -95,30 +85,23 @@ and it is done with proper approval.
 - If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
 - Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
 - Prioritize cases that involve personally identifiable information (PII) or other classified data.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle
-is being followed.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name:
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") and process.args
-: "New-MailboxExportRequest*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and 
+  process.command_line : ("*MailboxExportRequest*", "*-Mailbox*-ContentFilter*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -130,48 +113,11 @@ process where event.type == "start" and process.name:
 ** Name: Data from Local System
 ** ID: T1005
 ** Reference URL: https://attack.mitre.org/techniques/T1005/
-
-[[exporting-exchange-mailbox-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
-process.args : "New-MailboxExportRequest*"
-----------------------------------
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name: ("powershell.exe", "pwsh.exe") and process.args : "New-
-MailboxExportRequest*"
-----------------------------------
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/external-alerts.asciidoc b/docs/detections/prebuilt-rules/rule-details/external-alerts.asciidoc
index bb695c7dfe..f8f8286cd1 100644
--- a/docs/detections/prebuilt-rules/rule-details/external-alerts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/external-alerts.asciidoc
@@ -5,7 +5,7 @@ Generates a detection alert for each external alert written to the configured in
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * apm-*-transaction*
 * traces-apm*
@@ -19,60 +19,35 @@ Generates a detection alert for each external alert written to the configured in
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Network
-* Windows
-* APM
-* macOS
-* Linux
+*Tags*: 
 
-*Version*: 100 (<<external-alerts-history, version history>>)
+* OS: Windows
+* Data Source: APM
+* OS: macOS
+* OS: Linux
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:alert and not event.module:(endgame or endpoint)
-----------------------------------
-
-
-[[external-alerts-history]]
-==== Rule version history
 
-Version 100 (8.5.0 release)::
-* Formatting only
+==== Rule query
 
-Version 5 (8.4.0 release)::
-* Formatting only
 
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.kind:alert and not event.module:(endgame or endpoint)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
+event.kind:alert and not event.module:(endgame or endpoint or cloud_defend)
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc
index c00d908929..bdd139d9af 100644
--- a/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc
@@ -5,7 +5,7 @@ Identifies domains commonly used by adversaries for post-exploitation IP lookups
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,123 +13,119 @@ Identifies domains commonly used by adversaries for post-exploitation IP lookups
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://community.jisc.ac.uk/blogs/csirt/article/trickbot-analysis-and-mitigation
 * https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-
-*Version*: 102 (<<external-ip-lookup-from-non-browser-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If the domains listed in this rule are used as part of an authorized workflow, this rule will be triggered by those events. Validate that this is expected activity and tune the rule to fit your environment variables.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating External IP Lookup from Non-Browser Process
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for connections to known IP lookup services through non-browser processes or non-installed programs.
-Using only the IP address of the compromised system, attackers can obtain valuable information such as the system's
-geographic location, the company that owns the IP, whether the system is cloud-hosted, and more.
+This rule looks for connections to known IP lookup services through non-browser processes or non-installed programs. Using only the IP address of the compromised system, attackers can obtain valuable information such as the system's geographic location, the company that owns the IP, whether the system is cloud-hosted, and more.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination
-of user and command line conditions.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Use the data collected through the analysis to investigate other machines affected in the environment.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-network where network.protocol == "dns" and process.name != null
-and user.id not in ("S-1-5-19", "S-1-5-20") and event.action ==
-"lookup_requested" and /* Add new external IP lookup services here
-*/ dns.question.name : ( "*api.ipify.org",
-"*freegeoip.app", "*checkip.amazonaws.com",
-"*checkip.dyndns.org", "*freegeoip.app",
-"*icanhazip.com", "*ifconfig.*", "*ipecho.net",
-"*ipgeoapi.com", "*ipinfo.io", "*ip.anysrc.net",
-"*myexternalip.com", "*myipaddress.com",
-"*showipaddress.com", "*whatismyipaddress.com",
-"*wtfismyip.com", "*ipapi.co", "*ip-lookup.net",
-"*ipstack.com" ) and /* Insert noisy false positives here */
-not process.executable : ( "?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\WWAHost.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe", "?:\\Users\\*\\AppData\\Loc
-al\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"
-)
+[source, js]
 ----------------------------------
+network where host.os.type == "windows" and network.protocol == "dns" and
+    process.name != null and user.id not in ("S-1-5-19", "S-1-5-20") and
+    event.action == "lookup_requested" and
+    /* Add new external IP lookup services here */
+    dns.question.name :
+    (
+        "*api.ipify.org",
+        "*freegeoip.app",
+        "*checkip.amazonaws.com",
+        "*checkip.dyndns.org",
+        "*freegeoip.app",
+        "*icanhazip.com",
+        "*ifconfig.*",
+        "*ipecho.net",
+        "*ipgeoapi.com",
+        "*ipinfo.io",
+        "*ip.anysrc.net",
+        "*myexternalip.com",
+        "*myipaddress.com",
+        "*showipaddress.com",
+        "*whatismyipaddress.com",
+        "*wtfismyip.com",
+        "*ipapi.co",
+        "*ip-lookup.net",
+        "*ipstack.com"
+    ) and
+    /* Insert noisy false positives here */
+    not process.executable :
+    (
+      "?:\\Program Files\\*.exe",
+      "?:\\Program Files (x86)\\*.exe",
+      "?:\\Windows\\System32\\WWAHost.exe",
+      "?:\\Windows\\System32\\smartscreen.exe",
+      "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+      "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+      "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+      "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
+      "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
+      "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -138,78 +134,14 @@ al\\Google\\Chrome\\Application\\chrome.exe",
 ** ID: TA0007
 ** Reference URL: https://attack.mitre.org/tactics/TA0007/
 * Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
+* Sub-technique:
+** Name: Internet Connection Discovery
+** ID: T1016.001
+** Reference URL: https://attack.mitre.org/techniques/T1016/001/
+* Technique:
 ** Name: System Location Discovery
 ** ID: T1614
 ** Reference URL: https://attack.mitre.org/techniques/T1614/
-
-[[external-ip-lookup-from-non-browser-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Rule name changed from: External IP Lookup fron Non-Browser Process
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where network.protocol == "dns" and process.name != null
-and user.id not in ("S-1-5-19", "S-1-5-20") and event.action ==
-"lookup_requested" and /* Add new external IP lookup services here
-*/ dns.question.name : ( "*api.ipify.org",
-"*freegeoip.app", "*checkip.amazonaws.com",
-"*checkip.dyndns.org", "*freegeoip.app",
-"*icanhazip.com", "*ifconfig.*", "*ipecho.net",
-"*ipgeoapi.com", "*ipinfo.io", "*ip.anysrc.net",
-"*myexternalip.com", "*myipaddress.com",
-"*showipaddress.com", "*whatismyipaddress.com",
-"*wtfismyip.com" ) and /* Insert noisy false positives here */
-not process.executable : ( "?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\WWAHost.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
-"?:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe", "?:\\Users\\*\\AppData\\Loc
-al\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"
-)
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Rule name changed from: Public IP Reconnaissance Activity
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network AND event.type:connection AND
-server.domain:(ipecho.net OR ipinfo.io OR ifconfig.co OR ifconfig.me
-OR icanhazip.com OR myexternalip.com OR api.ipify.org OR
-bot.whatismyipaddress.com OR ip.anysrc.net OR wtfismyip.com) AND NOT
-http.response.status_code:302 AND status:OK AND NOT
-_exists_:http.request.referrer
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc
new file mode 100644
index 0000000000..2c39b4437b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc
@@ -0,0 +1,127 @@
+[[external-user-added-to-google-workspace-group]]
+=== External User Added to Google Workspace Group
+
+Detects an external Google Workspace user account being added to an existing group. Adversaries may add external user accounts as a means to intercept shared files or emails with that specific group.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-google_workspace*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 10m
+
+*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://support.google.com/a/answer/33329
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating External User Added to Google Workspace Group
+
+Google Workspace groups allow organizations to assign specific users to a group that can share resources. Application specific roles can be manually set for each group, but if not inherit permissions from the top-level organizational unit.
+
+Threat actors may use phishing techniques and container-bound scripts to add external Google accounts to an organization's groups with editorial privileges. As a result, the user account is unable to manually access the organization's resources, settings and files, but will receive anything shared to the group. As a result, confidential information could be leaked or perhaps documents shared with editorial privileges be weaponized for further intrusion.
+
+This rule identifies when an external user account is added to an organization's groups where the domain name of the target does not match the Google Workspace domain.
+
+#### Possible investigation steps
+- Identify user account(s) associated by reviewing `user.name` or `user.email` in the alert
+  - The `user.target.email` field contains the user added to the groups
+  - The `group.name` field contains the group the target user was added to
+- Identify specific application settings given to the group which may indicate motive for the external user joining a particular group
+- With the user identified, verify administrative privileges are scoped properly to add external users to the group
+  - Unauthorized actions may indicate the `user.email` account has been compromised or leveraged to add an external user
+- To identify other users in this group, search for `event.action: "ADD_GROUP_MEMBER"`
+  - It is important to understand if external users with `@gmail.com` are expected to be added to this group based on historical references
+- Review Gmail logs where emails were sent to and from the `group.name` value
+  - This may indicate potential internal spearphishing
+
+### False positive analysis
+- With the user account whom added the new user, verify this action was intentional
+- Verify that the target whom was added to the group is expected to have access to the organization's resources and data
+- If other members have been added to groups that are external, this may indicate historically that this action is expected
+
+### Response and remediation
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Reactivate multi-factor authentication for the user.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security defaults [provided by Google](https://cloud.google.com/security-command-center/docs/how-to-investigate-threats).
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
+### Important Information Regarding Google Workspace Event Lag Times
+- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
+- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
+- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
+- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
+- See the following references for further information:
+  - https://support.google.com/a/answer/7061566
+  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+iam where event.dataset == "google_workspace.admin" and event.action == "ADD_GROUP_MEMBER" and
+  not endsWith(user.target.email, user.target.group.domain)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/file-creation-time-changed.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-creation-time-changed.asciidoc
new file mode 100644
index 0000000000..7b1c81970c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/file-creation-time-changed.asciidoc
@@ -0,0 +1,80 @@
+[[file-creation-time-changed]]
+=== File Creation Time Changed
+
+Identifies modification of a file creation time. Adversaries may modify file time attributes to blend malicious content with existing files. Timestomping is a technique that modifies the timestamps of a file often to mimic files that are in trusted directories.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.code : "2" and
+
+ /* Requires Sysmon EventID 2 - File creation time change */
+ event.action : "File creation time changed*" and 
+ 
+ not process.executable : 
+          ("?:\\Program Files\\*", 
+           "?:\\Program Files (x86)\\*", 
+           "?:\\Windows\\system32\\msiexec.exe", 
+           "?:\\Windows\\syswow64\\msiexec.exe", 
+           "?:\\Windows\\system32\\svchost.exe", 
+           "?:\\WINDOWS\\system32\\backgroundTaskHost.exe",
+           "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", 
+           "?:\\Users\\*\\AppData\\Local\\slack\\app-*\\slack.exe", 
+           "?:\\Users\\*\\AppData\\Local\\GitHubDesktop\\app-*\\GitHubDesktop.exe",
+           "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe", 
+           "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe") and 
+ not file.extension : ("tmp", "~tmp", "xml") and not user.name : ("SYSTEM", "Local Service", "Network Service")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Timestomp
+** ID: T1070.006
+** Reference URL: https://attack.mitre.org/techniques/T1070/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc
index acee2e3117..5535448545 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc
@@ -5,50 +5,50 @@ Malware or other files dropped or created on a system by an adversary may leave
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<file-deletion-via-shred-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:shred and process.args:("-u" or "--remove" or "-z" or "
---zero")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:shred and
+  process.args:("-u" or "--remove" or "-z" or "--zero")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,40 +57,10 @@ process.name:shred and process.args:("-u" or "--remove" or "-z" or "
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[file-deletion-via-shred-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(executed or process_started) and process.name:shred and
-process.args:("-u" or "--remove" or "-z" or "--zero")
-----------------------------------
-
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/file-made-executable-via-chmod-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-made-executable-via-chmod-inside-a-container.asciidoc
new file mode 100644
index 0000000000..68d7a323db
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/file-made-executable-via-chmod-inside-a-container.asciidoc
@@ -0,0 +1,76 @@
+[[file-made-executable-via-chmod-inside-a-container]]
+=== File Made Executable via Chmod Inside A Container
+
+This rule detects when chmod is used to add the execute permission to a file inside a container. Modifying file permissions to make a file executable could indicate malicious activity, as an attacker may attempt to run unauthorized or malicious code inside the container.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where container.id: "*" and event.type in ("change", "creation") and
+
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
+(process.name : "chmod" or process.args : "chmod") and 
+process.args : ("*x*", "777", "755", "754", "700") and not process.args: "-x"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: File and Directory Permissions Modification
+** ID: T1222
+** Reference URL: https://attack.mitre.org/techniques/T1222/
+* Sub-technique:
+** Name: Linux and Mac File and Directory Permissions Modification
+** ID: T1222.002
+** Reference URL: https://attack.mitre.org/techniques/T1222/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
index 42621f0486..d25dcd1723 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
@@ -5,59 +5,59 @@ Detects a file being made immutable using the chattr binary. Making a file immut
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<file-made-immutable-by-chattr-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and user.name == "root" and
-process.executable : "/usr/bin/chattr" and process.args : ("-*i*",
-"+*i*") and not process.parent.executable: "/lib/systemd/systemd"
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and user.name == "root" and
+  process.executable : "/usr/bin/chattr" and process.args : ("-*i*", "+*i*") and
+  not process.parent.executable: ("/lib/systemd/systemd", "/usr/local/uems_agent/bin/*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,10 +69,7 @@ process.executable : "/usr/bin/chattr" and process.args : ("-*i*",
 ** Name: File and Directory Permissions Modification
 ** ID: T1222
 ** Reference URL: https://attack.mitre.org/techniques/T1222/
-
-[[file-made-immutable-by-chattr-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Linux and Mac File and Directory Permissions Modification
+** ID: T1222.002
+** Reference URL: https://attack.mitre.org/techniques/T1222/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc
index d2d6f2b3b6..bf7c0a6506 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc
@@ -3,9 +3,9 @@
 
 Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution.
 
-*Rule type*: query
+*Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ Identifies file permission modifications in common writable directories by a non
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<file-permission-modification-in-writable-directory-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain programs or applications may modify files or change ownership in writable directories. These can be exempted by username.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(chmod or chown or chattr or chgrp) and
-process.working_directory:(/tmp or /var/tmp or /dev/shm) and not
-user.name:root
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start"and
+  process.name in ("chmod", "chown", "chattr", "chgrp") and
+  process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
+  not process.parent.name in ("update-motd-updates-available") and
+  not user.name == "root"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,35 +61,3 @@ user.name:root
 ** Name: File and Directory Permissions Modification
 ** ID: T1222
 ** Reference URL: https://attack.mitre.org/techniques/T1222/
-
-[[file-permission-modification-in-writable-directory-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and process.name:(chmod or chown or chattr or
-chgrp) and process.working_directory:(/tmp or /var/tmp or /dev/shm)
-and not user.name:root
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc
index f8782631f1..8277a98ae5 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc
@@ -5,7 +5,7 @@ A netcat process is engaging in network activity on a Linux host. Netcat is ofte
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,13 +14,13 @@ A netcat process is engaging in network activity on a Linux host. Netcat is ofte
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
 * https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf
@@ -29,51 +29,39 @@ A netcat process is engaging in network activity on a Linux host. Netcat is ofte
 * https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/
 * https://levelup.gitconnected.com/ethical-hacking-part-15-netcat-nc-and-netcat-f6a8f7df43fd
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* Investigation Guide
-
-*Version*: 102 (<<file-transfer-or-listener-established-via-netcat-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Netcat Network Activity
 
-Netcat is a dual-use command line tool that can be used for various purposes, such as port scanning, file transfers, and
-connection tests. Attackers can abuse its functionality for malicious purposes such creating bind shells or reverse
-shells to gain access to the target system.
+Netcat is a dual-use command line tool that can be used for various purposes, such as port scanning, file transfers, and connection tests. Attackers can abuse its functionality for malicious purposes such creating bind shells or reverse shells to gain access to the target system.
 
-A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects
-the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are
-vulnerable since the connection is outgoing.
+A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing.
 
-A bind shell is a type of backdoor that attackers set up on the target host and binds to a specific port to listen for
-an incoming connection from the attacker.
+A bind shell is a type of backdoor that attackers set up on the target host and binds to a specific port to listen for an incoming connection from the attacker.
 
-This rule identifies potential reverse shell or bind shell activity using Netcat by checking for the execution of Netcat
-followed by a network connection.
+This rule identifies potential reverse shell or bind shell activity using Netcat by checking for the execution of Netcat followed by a network connection.
 
 #### Possible investigation steps
 
@@ -81,60 +69,51 @@ followed by a network connection.
 - Extract and examine the target domain or IP address.
   - Check if the domain is newly registered or unexpected.
   - Check the reputation of the domain or IP address.
-  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the
-  domain or IP address.
+  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the domain or IP address.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
-spawned child processes.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 
 ### False positive analysis
 
-- Netcat is a dual-use tool that can be used for benign or malicious activity. It is included in some Linux
-distributions, so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may
-originate from scripts, automation tools, and frameworks.
+- Netcat is a dual-use tool that can be used for benign or malicious activity. It is included in some Linux distributions, so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Block the identified indicators of compromise (IoCs).
 - Take actions to terminate processes and connections used by the attacker.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name:("nc","nca
-t","netcat","netcat.openbsd","netcat.traditional") and ( /*
-bind shell to echo for command execution */
-(process.args:("-l","-p") and process.args:("-c","echo","$*"))
-/* bind shell to specific port */ or
-process.args:("-l","-p","-lp") /* reverse shell to command-
-line interpreter used for command execution */ or
-(process.args:("-e") and process.args:("/bin/bash","/bin/sh"))
-/* file transfer via stdout */ or process.args:(">","<")
-/* file transfer via pipe */ or (process.args:("|") and
-process.args:("nc","ncat")) )] [network where (process.name ==
-"nc" or process.name == "ncat" or process.name == "netcat" or
-process.name == "netcat.openbsd" or process.name ==
-"netcat.traditional")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "linux" and event.type == "start" and
+      process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") and (
+          /* bind shell to echo for command execution */
+          (process.args:("-l","-p") and process.args:("-c","echo","$*"))
+          /* bind shell to specific port */
+          or process.args:("-l","-p","-lp")
+          /* reverse shell to command-line interpreter used for command execution */
+          or (process.args:("-e") and process.args:("/bin/bash","/bin/sh"))
+          /* file transfer via stdout */
+          or process.args:(">","<")
+          /* file transfer via pipe */
+          or (process.args:("|") and process.args:("nc","ncat"))
+      )]
+  [network where host.os.type == "linux" and (process.name == "nc" or process.name == "ncat" or process.name == "netcat" or
+                  process.name == "netcat.openbsd" or process.name == "netcat.traditional")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -146,65 +125,7 @@ process.name == "netcat.openbsd" or process.name ==
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[file-transfer-or-listener-established-via-netcat-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Rule name changed from: Netcat Network Activity
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where (process.name == "nc"
-or process.name == "ncat" or process.name == "netcat" or
-process.name == "netcat.openbsd" or process.name ==
-"netcat.traditional") and event.type == "start"] [network where
-(process.name == "nc" or process.name == "ncat" or process.name ==
-"netcat" or process.name == "netcat.openbsd" or
-process.name == "netcat.traditional")]
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:(access or connection or start)
-and process.name:(nc or ncat or netcat or netcat.openbsd or
-netcat.traditional)
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:(nc or ncat or netcat or netcat.openbsd or
-netcat.traditional) and event.action:(bound-socket or connected-to or
-socket_opened)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name: (nc or ncat or netcat or netcat.openbsd or
-netcat.traditional) and event.action: (connected-to or bound-socket or
-socket_opened)
-----------------------------------
-
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
index 3296f441ec..16a0b8965f 100644
--- a/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
@@ -5,7 +5,7 @@ Finder Sync plugins enable users to extend Finder’s functionality by modifying
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,57 +14,54 @@ Finder Sync plugins enable users to extend Finder’s functionality by modifying
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<finder-sync-plugin-registered-and-enabled-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted Finder Sync Plugins
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "pluginkit" and process.args : "-e" and process.args
-: "use" and process.args : "-i" and not process.args : (
-"com.google.GoogleDrive.FinderSyncAPIExtension",
-"com.google.drivefs.findersync", "com.boxcryptor.osx.Rednif",
-"com.adobe.accmac.ACCFinderSync",
-"com.microsoft.OneDrive.FinderSync", "com.insynchq.Insync.Insync-
-Finder-Integration", "com.box.desktop.findersyncext" ) and not
-process.parent.executable : ( "/Library/Application Support/IDrive
-forMac/IDriveHelperTools/FinderPluginApp.app/Contents/MacOS/FinderPlug
-inApp" )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "pluginkit" and
+  process.args : "-e" and process.args : "use" and process.args : "-i" and
+  not process.args :
+  (
+    "com.google.GoogleDrive.FinderSyncAPIExtension",
+    "com.google.drivefs.findersync",
+    "com.boxcryptor.osx.Rednif",
+    "com.adobe.accmac.ACCFinderSync",
+    "com.microsoft.OneDrive.FinderSync",
+    "com.insynchq.Insync.Insync-Finder-Integration",
+    "com.box.desktop.findersyncext"
+  ) and
+  not process.parent.executable : (
+    "/Library/Application Support/IDriveforMac/IDriveHelperTools/FinderPluginApp.app/Contents/MacOS/FinderPluginApp"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,32 +73,3 @@ inApp" )
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[finder-sync-plugin-registered-and-enabled-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, user.id with maxspan = 5s [process where
-event.type in ("start", "process_started") and process.name :
-"pluginkit" and process.args : "-a"] [process where event.type in
-("start", "process_started") and process.name : "pluginkit" and
-process.args : "-e" and process.args : "use" and process.args : "-i"
-and not process.args : (
-"com.google.GoogleDrive.FinderSyncAPIExtension",
-"com.google.drivefs.findersync", "com.boxcryptor.osx.Rednif",
-"com.adobe.accmac.ACCFinderSync",
-"com.microsoft.OneDrive.FinderSync",
-"com.insynchq.Insync.Insync-Finder-Integration",
-"com.box.desktop.findersyncext" ) ]
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
new file mode 100644
index 0000000000..e5087ea7b5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
@@ -0,0 +1,119 @@
+[[first-time-seen-aws-secret-value-accessed-in-secrets-manager]]
+=== First Time Seen AWS Secret Value Accessed in Secrets Manager
+
+An adversary equipped with compromised credentials may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material.
+
+*Rule type*: new_terms
+
+*Rule indices*:
+
+* filebeat-*
+* logs-aws*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 10m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
+* http://detectioninthe.cloud/credential_access/access_secret_in_secrets_manager/
+
+*Tags*:
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 206
+
+*Rule authors*:
+
+* Nick Jones
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating First Time Seen AWS Secret Value Accessed in Secrets Manager
+
+AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.
+
+This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a [New Terms]({security-guide}/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+
+#### Possible investigation steps
+
+- Identify the account and its role in the environment, and inspect the related policy.
+- Identify the applications that should use this account.
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Investigate abnormal values in the `user_agent.original` field by comparing them with the intended and authorized usage and historical data. Suspicious user agent values include non-SDK, AWS CLI, custom user agents, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences involving other users.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Considering the source IP address and geolocation of the user who issued the command:
+    - Do they look normal for the calling user?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- Review IAM permission policies for the user identity and specific secrets accessed.
+- Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+### False positive analysis
+
+- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Rotate secrets or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Take the actions needed to return affected systems, data, or services to their normal operational levels.
+- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:aws.cloudtrail and event.provider:secretsmanager.amazonaws.com and
+    event.action:GetSecretValue and event.outcome:success and
+    not user_agent.name: ("Chrome" or "Firefox" or "Safari" or "Edge" or "Brave" or "Opera" or "aws-cli")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
new file mode 100644
index 0000000000..6087b9a0f2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
@@ -0,0 +1,125 @@
+[[first-time-seen-commonly-abused-remote-access-tool-execution]]
+=== First Time Seen Commonly Abused Remote Access Tool Execution
+
+Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/
+* https://attack.mitre.org/techniques/T1219/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating First Time Seen Commonly Abused Remote Access Tool Execution
+
+Remote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.
+
+At the same pace as IT departments adopt these tools, the attackers also adopt them as part of their workflow to connect into an interactive session, maintain access with legitimate software as a persistence mechanism, drop malicious software, etc.
+
+This rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Check if the execution of the remote access tool is approved by the organization's IT department.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+  - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+
+### False positive analysis
+
+- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.
+- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type: "windows" and
+
+   event.category: "process" and event.type : "start" and
+
+    (
+    process.code_signature.subject_name : (
+        TeamViewer* or "NetSupport Ltd" or "GlavSoft" or "LogMeIn, Inc." or "Ammyy LLC" or
+        "Nanosystems S.r.l." or "Remote Utilities LLC" or "ShowMyPC" or "Splashtop Inc." or
+        "Yakhnovets Denis Aleksandrovich IP" or "Pro Softnet Corporation" or "BeamYourScreen GmbH" or
+        "RealVNC" or "uvnc" or "SAFIB") or
+
+    process.name.caseless : (
+        "teamviewer.exe" or "apc_Admin.exe" or "apc_host.exe" or "SupremoHelper.exe" or "rfusclient.exe" or
+        "spclink.exe" or "smpcview.exe" or "ROMServer.exe" or "strwinclt.exe" or "RPCSuite.exe" or "RemotePCDesktop.exe" or
+        "RemotePCService.exe" or "tvn.exe" or "LMIIgnition.exe" or "B4-Service.exe" or "Mikogo-Service.exe" or "AnyDesk.exe" or
+        "Splashtop-streamer.exe" or AA_v*.exe, or "rutserv.exe" or "rutview.exe" or "vncserver.exe" or "vncviewer.exe" or
+        "tvnserver.exe" or "tvnviewer.exe" or "winvnc.exe" or "RemoteDesktopManager.exe" or "LogMeIn.exe" or ScreenConnect*.exe or
+        "RemotePC.exe" or "r_server.exe" or "radmin.exe" or "ROMServer.exe" or "ROMViewer.exe" or "DWRCC.exe" or "AeroAdmin.exe" or
+        "ISLLightClient.exe" or "ISLLight.exe" or "AteraAgent.exe" or "SRService.exe")
+	) and
+
+	not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
new file mode 100644
index 0000000000..f26041938b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -0,0 +1,134 @@
+[[first-time-seen-driver-loaded]]
+=== First Time Seen Driver Loaded
+
+Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
+
+*Rule type*: new_terms
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating First Time Seen Driver Loaded
+
+A driver is a software component that allows the operating system to communicate with hardware devices. It works at a high privilege level, the kernel level, having high control over the system's security and stability.
+
+Attackers may exploit known good but vulnerable drivers to execute code in their context because once an attacker can execute code in the kernel, security tools can no longer effectively protect the host. They can leverage these drivers to tamper, bypass and terminate security software, elevate privileges, create persistence mechanisms, and disable operating system protections and monitoring features. Attackers were seen in the wild conducting these actions before acting on their objectives, such as ransomware.
+
+Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elastic Security Labs [here](https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks).
+
+This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
+  - Identify the path that the driver was loaded from. If using Elastic Defend, this information can be found in the `dll.path` field.
+  - Examine the digital signature of the driver, and check if it's valid.
+  - Examine the creation and modification timestamps of the file:
+    - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `"dll.Ext.relative_file_name_modify_time"` fields, with the values being seconds.
+    - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.
+      - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+  - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Use Osquery to investigate the drivers loaded into the system.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+### False positive analysis
+
+- Matches derived from these rules are not inherently malicious. The security team should investigate them to ensure they are legitimate and needed, then include them in an allowlist only if required. The security team should address any vulnerable driver installation as it can put the user and the domain at risk.
+
+### Related Rules
+
+- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"driver" and host.os.type:windows and event.action:"load"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc
new file mode 100644
index 0000000000..5b2263ba00
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc
@@ -0,0 +1,97 @@
+[[first-time-seen-google-workspace-oauth-login-from-third-party-application]]
+=== First Time Seen Google Workspace OAuth Login from Third-Party Application
+
+Detects the first time a third-party application logs in and authenticated with OAuth. OAuth is used to grant permissions to specific resources and services in Google Workspace. Compromised credentials or service accounts could allow an adversary to authenticate to Google Workspace as a valid user and inherit their privileges.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-google_workspace*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 10m
+
+*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one
+* https://developers.google.com/apps-script/guides/bound
+* https://developers.google.com/identity/protocols/oauth2
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Google Workspace
+* Tactic: Defense Evasion
+* Tactic: Initial Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+
+### Important Information Regarding Google Workspace Event Lag Times
+- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
+- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
+- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
+- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
+- See the following references for further information:
+  - https://support.google.com/a/answer/7061566
+  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "google_workspace.token" and event.action: "authorize" and
+google_workspace.token.scope.data.scope_name: *Login and google_workspace.token.client.id: *apps.googleusercontent.com
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc
new file mode 100644
index 0000000000..1fb424c781
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc
@@ -0,0 +1,78 @@
+[[first-time-seen-removable-device]]
+=== First Time Seen Removable Device
+
+Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/USB-storage.html
+* https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Exfiltration
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"registry" and host.os.type:"windows" and registry.value:"FriendlyName" and registry.path:*USBSTOR*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Replication Through Removable Media
+** ID: T1091
+** Reference URL: https://attack.mitre.org/techniques/T1091/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Physical Medium
+** ID: T1052
+** Reference URL: https://attack.mitre.org/techniques/T1052/
+* Sub-technique:
+** Name: Exfiltration over USB
+** ID: T1052.001
+** Reference URL: https://attack.mitre.org/techniques/T1052/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc b/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc
new file mode 100644
index 0000000000..98b3b50c43
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc
@@ -0,0 +1,121 @@
+[[firsttime-seen-account-performing-dcsync]]
+=== FirstTime Seen Account Performing DCSync
+
+This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html
+* https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing
+* https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml
+* https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md
+* https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync
+* https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating FirstTime Seen Account Performing DCSync
+
+Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.
+
+Active Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.
+
+Adversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys that are used legitimately for creating tickets, but also for forging tickets by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.
+
+More details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).
+
+This rule monitors for when a Windows Event ID 4662 (Operation was performed on an Active Directory object) with the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set) is seen in the environment for the first time in the last 15 days.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.
+- Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).
+
+### False positive analysis
+
+- Administrators may use custom accounts on Azure AD Connect; investigate if this is part of a new Azure AD account setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.
+- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. Investigate if this is part of a new product setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the entire domain or the `krbtgt` user was compromised:
+  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.
+- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.action:"Directory Service Access" and event.code:"4662" and
+ winlog.event_data.Properties:(*DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or
+                               *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or
+                               *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*) and
+ not winlog.event_data.SubjectUserName:(*$ or MSOL_*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: DCSync
+** ID: T1003.006
+** Reference URL: https://attack.mitre.org/techniques/T1003/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc b/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc
new file mode 100644
index 0000000000..23fa88904b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc
@@ -0,0 +1,61 @@
+[[forwarded-google-workspace-security-alert]]
+=== Forwarded Google Workspace Security Alert
+
+Identifies the occurrence of a security alert from the Google Workspace alerts center. Google Workspace's security alert center provides an overview of actionable alerts that may be affecting an organization's domain. An alert is a warning of a potential security issue that Google has detected.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-google_workspace*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 10m
+
+*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://workspace.google.com/products/admin/alert-center/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Log Auditing
+* Use Case: Threat Detection
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+This is a promotion rule for Google Workspace security events, which are alertable events per the vendor.
+Consult vendor documentation on interpreting specific events.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: google_workspace.alert
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc b/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc
index da6aae9d1d..d6faafa388 100644
--- a/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc
@@ -5,7 +5,7 @@ Identifies the enable of the full user-mode dumps feature system-wide. This feat
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,48 +15,44 @@ Identifies the enable of the full user-mode dumps feature system-wide. This feat
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
 * https://github.com/deepinstinct/Lsass-Shtinkering
 * https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Version*: 1
+*Version*: 4
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error
-Reporting\\LocalDumps\\DumpType" and registry.data.strings : ("2",
-"0x00000002") and not (process.executable :
-"?:\\Windows\\system32\\svchost.exe" and user.id : ("S-1-5-18",
-"S-1-5-19", "S-1-5-20"))
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType" and
+    registry.data.strings : ("2", "0x00000002") and
+    not (process.executable : "?:\\Windows\\system32\\svchost.exe" and user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,8 +64,10 @@ Reporting\\LocalDumps\\DumpType" and registry.data.strings : ("2",
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc
index 9185ef0ace..483866214b 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Vi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,50 @@ Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Vi
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/vpc/docs/firewalls
 * https://cloud.google.com/appengine/docs/standard/python/understanding-firewalls
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 102 (<<gcp-firewall-rule-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Firewall rules may be created by system administrators. Verify that the firewall configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:(*.compute.firewalls.insert
-or google.appengine.*.Firewall.Create*Rule)
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:(*.compute.firewalls.insert or google.appengine.*.Firewall.Create*Rule)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,40 +69,3 @@ or google.appengine.*.Firewall.Create*Rule)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-firewall-rule-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:v*.compute.firewalls.insert
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:v*.compute.firewalls.insert
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc
index 3cc537f272..1142bcb2ab 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Vi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,50 @@ Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Vi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/vpc/docs/firewalls
 * https://cloud.google.com/appengine/docs/standard/python/understanding-firewalls
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 102 (<<gcp-firewall-rule-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Firewall rules may be deleted by system administrators. Verify that the firewall configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:(*.compute.firewalls.delete
-or google.appengine.*.Firewall.Delete*Rule)
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:(*.compute.firewalls.delete or google.appengine.*.Firewall.Delete*Rule)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,40 +69,3 @@ or google.appengine.*.Firewall.Delete*Rule)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-firewall-rule-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:v*.compute.firewalls.delete
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:v*.compute.firewalls.delete
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc
index 7c62fdadff..4d76276ac0 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for V
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,50 @@ Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for V
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/vpc/docs/firewalls
 * https://cloud.google.com/appengine/docs/standard/python/understanding-firewalls
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 102 (<<gcp-firewall-rule-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Firewall rules may be modified by system administrators. Verify that the firewall configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:(*.compute.firewalls.patch or
-google.appengine.*.Firewall.Update*Rule)
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:(*.compute.firewalls.patch or google.appengine.*.Firewall.Update*Rule)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,40 +69,3 @@ google.appengine.*.Firewall.Update*Rule)
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-firewall-rule-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:v*.compute.firewalls.patch
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:v*.compute.firewalls.patch
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc
index 166927a370..9dd08f1cae 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies an Identity and Access Management (IAM) custom role creation in Googl
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,58 +14,49 @@ Identifies an Identity and Access Management (IAM) custom role creation in Googl
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/understanding-custom-roles
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-iam-custom-role-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Custom role creations may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Role creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.CreateRole and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.CreateRole and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +68,6 @@ event.action:google.iam.admin.v*.CreateRole and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -87,43 +76,3 @@ event.action:google.iam.admin.v*.CreateRole and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[gcp-iam-custom-role-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.CreateRole and event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.CreateRole and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc
index 0fdb11b39a..bc883d4bd1 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies an Identity and Access Management (IAM) role deletion in Google Cloud
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,58 +14,49 @@ Identifies an Identity and Access Management (IAM) role deletion in Google Cloud
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/understanding-roles
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-iam-role-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Role deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Role deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.DeleteRole and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.DeleteRole and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,43 +68,3 @@ event.action:google.iam.admin.v*.DeleteRole and event.outcome:success
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[gcp-iam-role-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.DeleteRole and event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.DeleteRole and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc
index 76bf1a5713..ccece3ab62 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an Identity and Access Management (IAM) service accou
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,60 +14,50 @@ Identifies the deletion of an Identity and Access Management (IAM) service accou
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/service-accounts
 * https://cloud.google.com/iam/docs/creating-managing-service-account-keys
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-iam-service-account-key-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Service account key deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Key deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.DeleteServiceAccountKey and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.DeleteServiceAccountKey and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,45 +69,3 @@ event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[gcp-iam-service-account-key-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.DeleteServiceAccountKey and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.DeleteServiceAccountKey and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc
index 5709451843..98080df83a 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,60 +14,50 @@ Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/logging/docs/buckets
 * https://cloud.google.com/logging/docs/storage
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-logging-bucket-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Logging bucket deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Logging bucket deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,48 +69,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-logging-bucket-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and
-event.outcome:success
-----------------------------------
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc
index 7591c314e5..df69a232ca 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/logging/docs/export
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-logging-sink-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Logging sink deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Logging sink deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.logging.v*.ConfigServiceV*.DeleteSink and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.logging.v*.ConfigServiceV*.DeleteSink and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,45 +68,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-logging-sink-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.logging.v*.ConfigServiceV*.DeleteSink and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.logging.v*.ConfigServiceV*.DeleteSink and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc
index 309b38b88e..f55ad399b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logg
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logg
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/logging/docs/export#how_sinks_work
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-logging-sink-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Exfiltration
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Logging sink modifications may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Sink modifications from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.logging.v*.ConfigServiceV*.UpdateSink and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.logging.v*.ConfigServiceV*.UpdateSink and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,42 +68,3 @@ event.outcome:success
 ** Name: Transfer Data to Cloud Account
 ** ID: T1537
 ** Reference URL: https://attack.mitre.org/techniques/T1537/
-
-[[gcp-logging-sink-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.logging.v*.ConfigServiceV*.UpdateSink and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.logging.v*.ConfigServiceV*.UpdateSink and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc
index 8ab6c48ed9..fd938f3a21 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/pubsub/docs/overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-pub-sub-subscription-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Subscription creations may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Subscription creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.pubsub.v*.Subscriber.CreateSubscription and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.pubsub.v*.Subscriber.CreateSubscription and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,48 +65,6 @@ event.outcome:success
 ** ID: TA0009
 ** Reference URL: https://attack.mitre.org/tactics/TA0009/
 * Technique:
-** Name: Data from Cloud Storage Object
+** Name: Data from Cloud Storage
 ** ID: T1530
 ** Reference URL: https://attack.mitre.org/techniques/T1530/
-
-[[gcp-pub-sub-subscription-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.pubsub.v*.Subscriber.CreateSubscription and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.pubsub.v*.Subscriber.CreateSubscription and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc
index 8984943040..5680e414e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/pubsub/docs/overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-pub-sub-subscription-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Subscription deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Subscription deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.pubsub.v*.Subscriber.DeleteSubscription and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.pubsub.v*.Subscriber.DeleteSubscription and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,45 +68,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-pub-sub-subscription-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.pubsub.v*.Subscriber.DeleteSubscription and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.pubsub.v*.Subscriber.DeleteSubscription and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc
index 394686a706..8bed9079a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the p
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the p
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/pubsub/docs/admin
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-pub-sub-topic-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Topic creations may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Topic creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.pubsub.v*.Publisher.CreateTopic and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.pubsub.v*.Publisher.CreateTopic and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,48 +65,6 @@ event.outcome:success
 ** ID: TA0009
 ** Reference URL: https://attack.mitre.org/tactics/TA0009/
 * Technique:
-** Name: Data from Cloud Storage Object
+** Name: Data from Cloud Storage
 ** ID: T1530
 ** Reference URL: https://attack.mitre.org/techniques/T1530/
-
-[[gcp-pub-sub-topic-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.pubsub.v*.Publisher.CreateTopic and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.pubsub.v*.Publisher.CreateTopic and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc
index 5d080130f1..2f93815def 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the p
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the p
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/pubsub/docs/overview
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Log Auditing
-
-*Version*: 102 (<<gcp-pub-sub-topic-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Log Auditing
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Topic deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Topic deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.pubsub.v*.Publisher.DeleteTopic and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,45 +68,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-pub-sub-topic-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.pubsub.v*.Publisher.DeleteTopic and
-event.outcome:success
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.pubsub.v*.Publisher.DeleteTopic and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc
index cb399f7be7..4ec9a4a6ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies when a new service account is created in Google Cloud Platform (GCP).
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies when a new service account is created in Google Cloud Platform (GCP).
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/service-accounts
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-service-account-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Service accounts can be created by system administrators. Verify that the behavior was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.CreateServiceAccount and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.CreateServiceAccount and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,42 +68,3 @@ event.outcome:success
 ** Name: Create Account
 ** ID: T1136
 ** Reference URL: https://attack.mitre.org/techniques/T1136/
-
-[[gcp-service-account-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.CreateServiceAccount and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.CreateServiceAccount and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc
index 0539cdd690..293bda6650 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies when a service account is deleted in Google Cloud Platform (GCP). A s
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies when a service account is deleted in Google Cloud Platform (GCP). A s
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/service-accounts
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-service-account-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Service accounts may be deleted by system administrators. Verify that the behavior was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.DeleteServiceAccount and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.DeleteServiceAccount and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,42 +68,3 @@ event.outcome:success
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[gcp-service-account-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.DeleteServiceAccount and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.DeleteServiceAccount and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc
index 23c4270966..bd0e54748c 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when a service account is disabled in Google Cloud Platform (GCP). A
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies when a service account is disabled in Google Cloud Platform (GCP). A
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/service-accounts
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-service-account-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Service accounts may be disabled by system administrators. Verify that the behavior was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.DisableServiceAccount and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.DisableServiceAccount and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,42 +68,3 @@ event.outcome:success
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[gcp-service-account-disabled-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.DisableServiceAccount and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.DisableServiceAccount and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc
index 6f5da3a70c..4e2ef5fc3c 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies when a new key is created for a service account in Google Cloud Platf
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,60 +14,50 @@ Identifies when a new key is created for a service account in Google Cloud Platf
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/iam/docs/service-accounts
 * https://cloud.google.com/iam/docs/creating-managing-service-account-keys
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-service-account-key-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Service account keys may be created by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and
-event.action:google.iam.admin.v*.CreateServiceAccountKey and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:google.iam.admin.v*.CreateServiceAccountKey and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,42 +69,3 @@ event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[gcp-service-account-key-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:google.iam.admin.v*.CreateServiceAccountKey and
-event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:google.iam.admin.v*.CreateServiceAccountKey and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc
index 897f3d5250..362d6fd8b7 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when the configuration is modified for a storage bucket in Google Clo
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies when the configuration is modified for a storage bucket in Google Clo
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/storage/docs/key-terms#buckets
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Defense Evasion
-
-*Version*: 102 (<<gcp-storage-bucket-configuration-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Storage bucket configuration may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:"storage.buckets.update" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:"storage.buckets.update" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,46 +68,3 @@ event.outcome:success
 ** Name: Modify Cloud Compute Infrastructure
 ** ID: T1578
 ** Reference URL: https://attack.mitre.org/techniques/T1578/
-
-[[gcp-storage-bucket-configuration-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:"storage.buckets.update" and event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:storage.buckets.update and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:storage.buckets.update and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc
index 4c8164557e..baa04dc345 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adve
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,57 +14,48 @@ Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adve
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/storage/docs/key-terms#buckets
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<gcp-storage-bucket-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Storage buckets may be deleted by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Bucket deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:gcp.audit and event.action:"storage.buckets.delete"
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,49 +67,3 @@ event.dataset:gcp.audit and event.action:"storage.buckets.delete"
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-[[gcp-storage-bucket-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:"storage.buckets.delete"
-----------------------------------
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:storage.buckets.delete
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:storage.buckets.delete
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc
index 24dc149d42..847cafaa78 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when the Identity and Access Management (IAM) permissions are modifie
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,58 +14,49 @@ Identifies when the Identity and Access Management (IAM) permissions are modifie
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/storage/docs/access-control/iam-permissions
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<gcp-storage-bucket-permissions-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Storage bucket permissions may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:"storage.setIamPermissions"
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:"storage.setIamPermissions" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,46 +68,3 @@ and event.outcome:success
 ** Name: File and Directory Permissions Modification
 ** ID: T1222
 ** Reference URL: https://attack.mitre.org/techniques/T1222/
-
-[[gcp-storage-bucket-permissions-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:"storage.setIamPermissions" and event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:storage.setIamPermissions and event.outcome:success
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:storage.setIamPermissions and event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc
index 3fa38f3a8b..d95bc6d53c 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,59 +14,49 @@ Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/vpc/docs/vpc
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 102 (<<gcp-virtual-private-cloud-network-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Virtual Private Cloud networks may be deleted by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:v*.compute.networks.delete
-and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:v*.compute.networks.delete and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,40 +68,7 @@ and event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-virtual-private-cloud-network-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:v*.compute.networks.delete and event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:v*.compute.networks.delete and event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc
index 59152f721b..109afd60a2 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies when a virtual private cloud (VPC) route is created in Google Cloud P
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,60 +14,50 @@ Identifies when a virtual private cloud (VPC) route is created in Google Cloud P
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/vpc/docs/routes
 * https://cloud.google.com/vpc/docs/using-routes
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 102 (<<gcp-virtual-private-cloud-route-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Virtual Private Cloud routes may be created by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:(v*.compute.routes.insert or
-"beta.compute.routes.insert")
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:(v*.compute.routes.insert or "beta.compute.routes.insert")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,53 +69,7 @@ event.dataset:gcp.audit and event.action:(v*.compute.routes.insert or
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-virtual-private-cloud-route-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:(v*.compute.routes.insert or
-"beta.compute.routes.insert")
-----------------------------------
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:(v*.compute.routes.insert or beta.compute.routes.insert)
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:(v*.compute.routes.insert or beta.compute.routes.insert)
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc
index 73a091a287..c0da77fbc0 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud P
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-gcp*
@@ -14,60 +14,50 @@ Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud P
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cloud.google.com/vpc/docs/routes
 * https://cloud.google.com/vpc/docs/using-routes
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* GCP
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 102 (<<gcp-virtual-private-cloud-route-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: GCP
+* Data Source: Google Cloud Platform
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Virtual Private Cloud routes may be deleted by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:gcp.audit and event.action:v*.compute.routes.delete and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:gcp.audit and event.action:v*.compute.routes.delete and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,40 +69,7 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[gcp-virtual-private-cloud-route-deletion-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(googlecloud.audit or gcp.audit) and
-event.action:v*.compute.routes.delete and event.outcome:success
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:googlecloud.audit and
-event.action:v*.compute.routes.delete and event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Cloud Firewall
+** ID: T1562.007
+** Reference URL: https://attack.mitre.org/techniques/T1562/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc
index 6282e41ef8..317d90a9f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc
@@ -5,7 +5,7 @@ Drive and Docs is a Google Workspace service that allows users to leverage Googl
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,44 +14,79 @@ Drive and Docs is a Google Workspace service that allows users to leverage Googl
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/1247799?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Collection
-
-*Version*: 2 (<<google-drive-ownership-transferred-via-google-workspace-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Tactic: Collection
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Administrators may transfer file ownership during employee leave or absence to ensure continued operations by a new or existing employee.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Drive Ownership Transferred via Google Workspace
+
+Google Drive is a cloud storage service that allows users to store and access files. It is available to users with a Google Workspace account.
+
+Google Workspace administrators consider users' roles and organizational units when assigning permissions to files or shared drives. Owners of sensitive files and folders can grant permissions to users who make internal or external access requests. Adversaries abuse this trust system by accessing Google Drive resources with improperly scoped permissions and shared settings. Distributing phishing emails is another common approach to sharing malicious Google Drive documents. With this approach, adversaries aim to inherit the recipient's Google Workspace privileges when an external entity grants ownership.
+
+This rule identifies when the ownership of a shared drive within a Google Workspace organization is transferred to another internal user.
+
+#### Possible investigation steps
+
+- From the admin console, review admin logs for involved user accounts. To find admin logs, go to `Security > Reporting > Audit and investigation > Admin log events`.
+- Determine if involved user accounts are active. To view user activity, go to `Directory > Users`.
+- Check if the involved user accounts were recently disabled, then re-enabled.
+- Review involved user accounts for potentially misconfigured permissions or roles.
+- Review the involved shared drive or files and related policies to determine if this action was expected and appropriate.
+- If a shared drive, access requirements based on Organizational Units in `Apps > Google Workspace > Drive and Docs > Manage shared drives`.
+- Triage potentially related alerts based on the users involved. To find alerts, go to `Security > Alerts`.
+
+### False positive analysis
+
+- Transferring drives requires Google Workspace administration permissions related to Google Drive. Check if this action was planned/expected from the requester and is appropriately targeting the correct receiver.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -62,18 +97,15 @@ Administrators may transfer file ownership during employee leave or absence to e
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and
-event.action:"CREATE_DATA_TRANSFER_REQUEST" and event.category:"iam"
-and google_workspace.admin.application.name:Drive*
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.action:"CREATE_DATA_TRANSFER_REQUEST"
+  and event.category:"iam" and google_workspace.admin.application.name:Drive*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,10 +117,7 @@ and google_workspace.admin.application.name:Drive*
 ** Name: Data Staged
 ** ID: T1074
 ** Reference URL: https://attack.mitre.org/techniques/T1074/
-
-[[google-drive-ownership-transferred-via-google-workspace-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Remote Data Staging
+** ID: T1074.002
+** Reference URL: https://attack.mitre.org/techniques/T1074/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc
index 6bbf226144..f82feabb61 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc
@@ -5,7 +5,7 @@ Google Workspace admins may setup 2-step verification (2SV) to add an extra laye
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,81 @@ Google Workspace admins may setup 2-step verification (2SV) to add an extra laye
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/9176657?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Persistence
-
-*Version*: 2 (<<google-workspace-2sv-policy-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Administrators may remove 2-step verification (2SV) temporarily for testing or during maintenance. If 2SV was previously enabled, it is not common to disable this policy for extended periods of time.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace 2SV Policy Disabled
+
+Google Workspace administrators manage password policies to enforce password requirements for an organization's compliance needs. Administrators have the capability to set restrictions on password length, reset frequencies, reuse capability, expiration, and much more. Google Workspace also allows multi-factor authentication (MFA) and 2-step verification (2SV) for authentication. 2SV allows users to verify their identity using security keys, Google prompt, authentication codes, text messages, and more.
+
+2SV adds an extra authentication layer for Google Workspace users to verify their identity. If 2SV or MFA aren't implemented, users only authenticate with their user name and password credentials. This authentication method has often been compromised and can be susceptible to credential access techniques when weak password policies are used.
+
+This rule detects when a 2SV policy is disabled in Google Workspace.
+
+#### Possible investigation steps
+
+- Identify the associated user account(s) by reviewing `user.name` or `source.user.email` in the alert.
+- Identify what password setting was created or adjusted by reviewing `google_workspace.admin.setting.name`.
+- Review if a password setting was enabled or disabled by reviewing `google_workspace.admin.new_value` and `google_workspace.admin.old_value`.
+- After identifying the involved user account, verify administrative privileges are scoped properly.
+- Filter `event.dataset` for `google_workspace.login` and aggregate by `user.name`, `event.action`.
+  - The `google_workspace.login.challenge_method` field can be used to identify the challenge method that was used for failed and successful logins.
+
+### False positive analysis
+
+- After finding the user account that updated the password policy, verify whether the action was intentional.
+- Verify whether the user should have Google Workspace administrative privileges that allow them to modify password policies.
+- Review organizational units or groups the role may have been added to and ensure its privileges are properly aligned.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,16 +99,14 @@ Administrators may remove 2-step verification (2SV) temporarily for testing or d
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and event.action:"2sv_disable"
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.login" and event.action:"2sv_disable"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,10 +118,3 @@ event.dataset:"google_workspace.admin" and event.action:"2sv_disable"
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[google-workspace-2sv-policy-disabled-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc
index bda458f073..764d70dd8d 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc
@@ -5,7 +5,7 @@ Assigning the administrative role to a user will grant them access to the Google
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,85 @@ Assigning the administrative role to a user will grant them access to the Google
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/172176?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Persistence
-
-*Version*: 102 (<<google-workspace-admin-role-assigned-to-a-user-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 206
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Google Workspace admin role assignments may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Admin Role Assigned to a User
+
+Google Workspace roles allow administrators to assign specific permissions to users or groups. These assignments should follow the principle of least privilege (PoLP). Admin roles in Google Workspace grant users access to the Google Admin console, where more domain-wide settings are accessible. Google Workspace contains prebuilt administrator roles for performing business functions related to users, groups, and services. Custom administrator roles can be created when prebuilt roles are not sufficient.
+
+Administrator roles assigned to users will grant them additional permissions and privileges within the Google Workspace domain. Administrative roles also give users access to the admin console, where domain-wide settings can be adjusted. Threat actors might rely on these new privileges to advance their intrusion efforts and laterally move throughout the organization. Users with unexpected administrative privileges may also cause operational dysfunction if unfamiliar settings are adjusted without warning.
+
+This rule identifies when a Google Workspace administrative role is assigned to a user.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+  - The `user.target.email` field contains the user who received the admin role.
+- Identify the role given to the user by reviewing the `google_workspace.admin.role.name` field in the alert.
+- After identifying the involved user, verify their administrative privileges are scoped properly.
+- To identify other users with this role, search the alert for `event.action: ASSIGN_ROLE`.
+  - Add `google_workspace.admin.role.name` with the role added as an additional filter.
+  - Adjust the relative time accordingly to identify all users that were assigned this admin role.
+- Identify if the user account was recently created by searching for `event.action: CREATE_USER`.
+  - Add `user.email` with the target user account that recently received this new admin role.
+- After identifying the involved user, create a filter with their `user.name` or `user.target.email`. Review the last 48 hours of their activity for anything that may indicate a compromise.
+
+### False positive analysis
+
+- After identifying user account that added the admin role, verify the action was intentional.
+- Verify that the target user who was assigned the admin role should have administrative privileges in Google Workspace.
+- Review organizational units or groups the target user might have been added to and ensure the admin role permissions align.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,19 +103,15 @@ Google Workspace admin role assignments may be modified by system administrators
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and event.category:"iam" and
-event.action:"ASSIGN_ROLE" and
-google_workspace.event.type:"DELEGATED_ADMIN_SETTINGS" and
-google_workspace.admin.role.name : *_ADMIN_ROLE
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.category:"iam" and event.action:"ASSIGN_ROLE"
+  and google_workspace.event.type:"DELEGATED_ADMIN_SETTINGS" and google_workspace.admin.role.name : *_ADMIN_ROLE
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -87,50 +123,7 @@ google_workspace.admin.role.name : *_ADMIN_ROLE
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-admin-role-assigned-to-a-user-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:ASSIGN_ROLE
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:ASSIGN_ROLE
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Additional Cloud Roles
+** ID: T1098.003
+** Reference URL: https://attack.mitre.org/techniques/T1098/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc
index e6a4a7763a..839c74c47b 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc
@@ -5,7 +5,7 @@ Detects when a custom admin role is deleted. An adversary may delete a custom ad
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,80 @@ Detects when a custom admin role is deleted. An adversary may delete a custom ad
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/2406043?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Impact
-
-*Version*: 101 (<<google-workspace-admin-role-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Tactic: Impact
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Google Workspace admin roles may be deleted by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Admin Role Deletion
+
+Google Workspace roles allow administrators to assign specific permissions to users or groups where the principle of least privilege (PoLP) is recommended. Admin roles in Google Workspace grant users access to the Google Admin console, where further domain-wide settings are accessible. Google Workspace contains prebuilt administrator roles for performing business functions related to users, groups, and services. Custom administrator roles can be created where prebuilt roles are not preferred.
+
+Deleted administrator roles may render some user accounts inaccessible or cause operational failure where these roles are relied upon to perform daily administrative tasks. The deletion of roles may also hinder the response and remediation actions of administrators responding to security-related alerts and events. Without specific roles assigned, users will inherit the permissions and privileges of the root organizational unit.
+
+This rule identifies when a Google Workspace administrative role is deleted within the Google Admin console.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- Identify the role deleted by reviewing `google_workspace.admin.role.name` in the alert.
+- With the user identified, verify if he has administrative privileges to disable or delete administrative roles.
+- To identify other users affected by this role removed, search for `event.action: ASSIGN_ROLE`.
+    - Add `google_workspace.admin.role.name` with the role deleted as an additional filter.
+    - Adjust the relative time accordingly to identify all users that were assigned this admin role.
+
+### False positive analysis
+
+- After identifying the user account that disabled the admin role, verify the action was intentional.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Discuss with the user the affected users as a result of this action to mitigate operational discrepencies.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,17 +98,14 @@ Google Workspace admin roles may be deleted by system administrators. Verify tha
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:DELETE_ROLE
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:DELETE_ROLE
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,44 +117,3 @@ event.category:iam and event.action:DELETE_ROLE
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[google-workspace-admin-role-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:DELETE_ROLE
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc
index c4feeffcb2..974dc3bcd8 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc
@@ -5,7 +5,7 @@ Detects when a domain-wide delegation of authority is granted to a service accou
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,44 +14,82 @@ Detects when a domain-wide delegation of authority is granted to a service accou
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developers.google.com/admin-sdk/directory/v1/guides/delegation
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<google-workspace-api-access-granted-via-domain-wide-delegation-of-authority-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Domain-wide delegation of authority may be granted to service accounts by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating API Access Granted via Domain-Wide Delegation of Authority
+
+Domain-wide delegation is a feature that allows apps to access users' data across an organization's Google Workspace environment. Only super admins can manage domain-wide delegation, and they must specify each API scope that the application can access. Google Workspace services all have APIs that can be interacted with after domain-wide delegation is established with an OAuth2 client ID of the application. Typically, GCP service accounts and applications are created where the Google Workspace APIs are enabled, thus allowing the application to access resources and services in Google Workspace.
+
+Applications authorized to interact with Google Workspace resources and services through APIs have a wide range of capabilities depending on the scopes applied. If the principle of least privilege (PoLP) is not practiced when setting API scopes, threat actors could abuse additional privileges if the application is compromised. New applications created and given API access could indicate an attempt by a threat actor to register their malicious application with the Google Workspace domain in an attempt to establish a command and control foothold.
+
+This rule identifies when an application is authorized API client access.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+  - Only users with super admin privileges can authorize API client access.
+- Identify the API client name by reviewing the `google_workspace.admin.api.client.name` field in the alert.
+  - If GCP audit logs are ingested, pivot to reviewing the last 48 hours of activity related to the service account ID.
+  - Search for the `google_workspace.admin.api.client.name` value with wildcards in the `gcp.audit.resource_name` field.
+  - Search for API client name and aggregated results on `event.action` to determine what the service account is being used for in GWS.
+- After identifying the involved user, verify super administrative privileges to access domain-wide delegation settings.
+
+### False positive analysis
+
+- Changes to domain-wide delegation require super admin privileges. Check with the user to ensure these changes were expected.
+- Review scheduled maintenance notes related to expected API access changes.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Review the scope of the authorized API client access in Google Workspace.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -62,17 +100,14 @@ Domain-wide delegation of authority may be granted to service accounts by system
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:AUTHORIZE_API_CLIENT_ACCESS
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:AUTHORIZE_API_CLIENT_ACCESS
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,44 +119,3 @@ event.category:iam and event.action:AUTHORIZE_API_CLIENT_ACCESS
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-api-access-granted-via-domain-wide-delegation-of-authority-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:AUTHORIZE_API_CLIENT_ACCESS
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc
index f748cde8ae..33d128a036 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc
@@ -5,7 +5,7 @@ Google Workspace administrators whom manage Windows devices and have Windows dev
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,78 @@ Google Workspace administrators whom manage Windows devices and have Windows dev
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/9176657?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 2 (<<google-workspace-bitlocker-setting-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Administrators may temporarily disabled Bitlocker on managed devices for maintenance, testing or to resolve potential endpoint conflicts.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Bitlocker Setting Disabled
+
+BitLocker Drive Encryption is a data protection feature that integrates with the Windows operating system to address the data theft or exposure threats from lost, stolen, or inappropriately decommissioned computers. BitLocker helps mitigate unauthorized data access by enhancing file and system protections, such as data encryption and rendering data inaccessible. Google Workspace can sync with Windows endpoints that are registered in inventory, where BitLocker can be enabled and disabled.
+
+Disabling Bitlocker on an endpoint decrypts data at rest and makes it accessible, which raises the risk of exposing sensitive endpoint data.
+
+This rule identifies a user with administrative privileges and access to the admin console, disabling BitLocker for Windows endpoints.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- After identifying the user, verify if the user should have administrative privileges to disable BitLocker on Windows endpoints.
+- From the Google Workspace admin console, review `Reporting > Audit` and `Investigation > Device` logs, filtering on the user email identified from the alert.
+    - If a Google Workspace user logged into their account using a potentially compromised account, this will create an `Device sync event` event.
+
+### False positive analysis
+
+- An administrator may have intentionally disabled BitLocker for routine maintenance or endpoint updates.
+   - Verify with the user that they intended to disable BitLocker on Windows endpoints.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,19 +96,15 @@ Administrators may temporarily disabled Bitlocker on managed devices for mainten
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and
-event.action:"CHANGE_APPLICATION_SETTING" and event.category:(iam or
-configuration) and google_workspace.admin.new_value:"Disabled" and
-google_workspace.admin.setting.name:BitLocker*
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.action:"CHANGE_APPLICATION_SETTING" and event.category:(iam or configuration)
+    and google_workspace.admin.new_value:"Disabled" and google_workspace.admin.setting.name:BitLocker*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -87,10 +116,7 @@ google_workspace.admin.setting.name:BitLocker*
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[google-workspace-bitlocker-setting-disabled-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc
index 30d1807191..6ac045f769 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc
@@ -5,7 +5,7 @@ Detects when a custom admin role is created in Google Workspace. An adversary ma
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,44 +14,85 @@ Detects when a custom admin role is created in Google Workspace. An adversary ma
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/2406043?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<google-workspace-custom-admin-role-created-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Custom Google Workspace admin roles may be created by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Custom Admin Role Created
+
+Google Workspace roles allow administrators to assign specific permissions to users or groups where the principle of least privilege (PoLP) is recommended. Admin roles in Google Workspace grant users access to the Google Admin console, where more domain-wide settings are accessible. Google Workspace contains prebuilt administrator roles for performing business functions related to users, groups, and services. Custom administrator roles can be created where prebuilt roles are not preferred.
+
+Roles assigned to users will grant them additional permissions and privileges within the Google Workspace domain. Threat actors might create new admin roles with privileges to advance their intrusion efforts and laterally move throughout the organization if existing roles or users do not have privileges aligned with their modus operandi. Users with unexpected privileges from new admin roles may also cause operational dysfunction if unfamiliar settings are adjusted without warning. Instead of modifying existing roles, administrators might create new roles to accomplish short-term goals and unintentionally introduce additional risk exposure.
+
+This rule identifies when a Google Workspace administrative role is added within the Google Workspace admin console.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- Identify the role added by reviewing the `google_workspace.admin.role.name` field in the alert.
+- After identifying the involved user, verify if they should have administrative privileges to add administrative roles.
+- To identify if users have been assigned this role, search for `event.action: ASSIGN_ROLE`.
+    - Add `google_workspace.admin.role.name` with the role added as an additional filter.
+    - Adjust the relative time accordingly to identify all users that were possibly assigned this admin role.
+- Monitor users assigned the admin role for the next 24 hours and look for attempts to use related privileges.
+  - The `event.provider` field will help filter for specific services in Google Workspace such as Drive or Admin.
+  - The `event.action` field will help trace what actions are being taken by users.
+
+### False positive analysis
+
+- After identifying the user account that created the role, verify whether the action was intentional.
+- Verify that the user who created the role should have administrative privileges in Google Workspace to create custom roles.
+- Review organizational units or groups the role may have been added to and ensure the new privileges align properly.
+- Create a filter with the user's `user.name` and filter for `event.action`. In the results, check if there are multiple `CREATE_ROLE` actions and note whether they are new or historical.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -62,17 +103,14 @@ Custom Google Workspace admin roles may be created by system administrators. Ver
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:CREATE_ROLE
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:CREATE_ROLE
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,44 +122,3 @@ event.category:iam and event.action:CREATE_ROLE
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-custom-admin-role-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:CREATE_ROLE
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc
index 08e667dea5..c64dec9775 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc
@@ -5,7 +5,7 @@ Detects when a custom Gmail route is added or modified in Google Workspace. Adve
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,44 +14,78 @@ Detects when a custom Gmail route is added or modified in Google Workspace. Adve
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/2685650?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Collection
-
-*Version*: 2 (<<google-workspace-custom-gmail-route-created-or-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Tactic: Collection
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Administrators may create custom email routes in Google Workspace based on organizational policies, administrative preference or for security purposes regarding spam.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Custom Gmail Route Created or Modified
+
+Gmail is a popular cloud-based email service developed and managed by Google. Gmail is one of many services available for users with Google Workspace accounts.
+
+Threat actors often send phishing emails containing malicious URL links or attachments to corporate Gmail accounts. Google Workspace identity relies on the corporate user Gmail account and if stolen, allows threat actors to further their intrusion efforts from valid user accounts.
+
+This rule identifies the creation of a custom global Gmail route by an administrator from the Google Workspace admin console. Custom email routes could indicate an attempt to secretly forward sensitive emails to unintentional recipients.
+
+#### Possible investigation steps
+
+- Identify the user account that created the custom email route and verify that they should have administrative privileges.
+- Review the added recipients from the custom email route and confidentiality of potential email contents.
+- Identify the user account, then review `event.action` values for related activity within the last 48 hours.
+- If the Google Workspace license is Enterprise Plus or Education Plus, search for emails matching the route filters. To find the Gmail event logs, go to `Reporting > Audit and investigation > Gmail log events`.
+- If existing emails have been sent and match the custom route criteria, review the sender and contents for malicious URL links and attachments.
+- Identified URLs or attachments can be submitted to VirusTotal for reputational services.
+
+### False positive analysis
+
+- This rule searches for domain-wide custom email routes created in the admin console of Google Workspace. Administrators might create custom email routes to fulfill organizational requirements.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -62,20 +96,15 @@ Administrators may create custom email routes in Google Workspace based on organ
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and
-event.action:("CREATE_GMAIL_SETTING" or "CHANGE_GMAIL_SETTING") and
-google_workspace.event.type:"EMAIL_SETTINGS" and
-google_workspace.admin.setting.name:("EMAIL_ROUTE" or
-"MESSAGE_SECURITY_RULE")
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.action:("CREATE_GMAIL_SETTING" or "CHANGE_GMAIL_SETTING")
+  and google_workspace.event.type:"EMAIL_SETTINGS" and google_workspace.admin.setting.name:("EMAIL_ROUTE" or "MESSAGE_SECURITY_RULE")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -87,10 +116,7 @@ google_workspace.admin.setting.name:("EMAIL_ROUTE" or
 ** Name: Email Collection
 ** ID: T1114
 ** Reference URL: https://attack.mitre.org/techniques/T1114/
-
-[[google-workspace-custom-gmail-route-created-or-modified-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Email Forwarding Rule
+** ID: T1114.003
+** Reference URL: https://attack.mitre.org/techniques/T1114/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc
new file mode 100644
index 0000000000..6704c0510e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc
@@ -0,0 +1,85 @@
+[[google-workspace-drive-encryption-key-s-accessed-from-anonymous-user]]
+=== Google Workspace Drive Encryption Key(s) Accessed from Anonymous User
+
+Detects when an external (anonymous) user has viewed, copied or downloaded an encryption key file from a Google Workspace drive. Adversaries may gain access to encryption keys stored in private drives from rogue access links that do not have an expiration. Access to encryption keys may allow adversaries to access sensitive data or authenticate on behalf of users.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-google_workspace*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 10m
+
+*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://support.google.com/drive/answer/2494822
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Credential Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Important Information Regarding Google Workspace Event Lag Times
+- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
+- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
+- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
+- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
+- See the following references for further information:
+  - https://support.google.com/a/answer/7061566
+  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where event.dataset == "google_workspace.drive" and event.action : ("copy", "view", "download") and
+    google_workspace.drive.visibility: "people_with_link" and source.user.email == "" and
+    file.extension: (
+        "token","assig", "pssc", "keystore", "pub", "pgp.asc", "ps1xml", "pem", "gpg.sig", "der", "key",
+        "p7r", "p12", "asc", "jks", "p7b", "signature", "gpg", "pgp.sig", "sst", "pgp", "gpgz", "pfx", "crt",
+        "p8", "sig", "pkcs7", "jceks", "pkcs8", "psc1", "p7c", "csr", "cer", "spc", "ps2xml")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
+* Sub-technique:
+** Name: Private Keys
+** ID: T1552.004
+** Reference URL: https://attack.mitre.org/techniques/T1552/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc
index f5a7493f49..69e30484da 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc
@@ -5,7 +5,7 @@ Detects when multi-factor authentication (MFA) enforcement is disabled for Googl
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,61 +14,49 @@ Detects when multi-factor authentication (MFA) enforcement is disabled for Googl
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/9176657?hl=en#
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Impact
-* Investigation Guide
-
-*Version*: 103 (<<google-workspace-mfa-enforcement-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Impact
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 207
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-MFA policies may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Google Workspace MFA Enforcement Disabled
 
-Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form
-of identification, such as a code on their cellphone or a fingerprint scan.
+Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form of identification, such as a code on their cellphone or a fingerprint scan.
 
-If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or
-has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication,
-security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
+If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
 
 For more information about using MFA in Google Workspace, access the [official documentation](https://support.google.com/a/answer/175197).
 
-This rule identifies the disabling of MFA enforcement in Google Workspace. This modification weakens the security of
-the accounts and can lead to the compromise of accounts and other assets.
+This rule identifies the disabling of MFA enforcement in Google Workspace. This modification weakens the security of the accounts and can lead to the compromise of accounts and other assets.
 
 #### Possible investigation steps
 
@@ -76,13 +64,11 @@ the accounts and can lead to the compromise of accounts and other assets.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- While this activity can be done by administrators, all users must use MFA. The security team should address any
-potential benign true positive (B-TP), as this configuration can risk the user and domain.
+- While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
 ### Response and remediation
 
@@ -94,19 +80,17 @@ potential benign true positive (B-TP), as this configuration can risk the user a
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate the multi-factor authentication enforcement.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
 ### Important Information Regarding Google Workspace Event Lag Times
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -116,18 +100,16 @@ mean time to respond (MTTR).
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:ENFORCE_STRONG_AUTHENTICATION
-and google_workspace.admin.new_value:false
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin
+  and event.category:iam and event.action:ENFORCE_STRONG_AUTHENTICATION
+  and google_workspace.admin.new_value:false
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -139,64 +121,3 @@ and google_workspace.admin.new_value:false
 ** Name: Account Access Removal
 ** ID: T1531
 ** Reference URL: https://attack.mitre.org/techniques/T1531/
-
-[[google-workspace-mfa-enforcement-disabled-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 15 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:ENFORCE_STRONG_AUTHENTICATION and
-google_workspace.admin.new_value:false
-----------------------------------
-
-Version 13 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:ENFORCE_STRONG_AUTHENTICATION and
-(gsuite.admin.new_value:false or
-google_workspace.admin.new_value:false)
-----------------------------------
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:ENFORCE_STRONG_AUTHENTICATION and
-gsuite.admin.new_value:false
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc
new file mode 100644
index 0000000000..3576292c94
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc
@@ -0,0 +1,138 @@
+[[google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application]]
+=== Google Workspace Object Copied from External Drive and Access Granted to Custom Application
+
+Detects when a user copies a Google spreadsheet, form, document or script from an external drive. Sequence logic has been added to also detect when a user grants a custom Google application permission via OAuth shortly after. An adversary may send a phishing email to the victim with a Drive object link where "copy" is included in the URI, thus copying the object to the victim's drive. If a container-bound script exists within the object, execution will require permission access via OAuth in which the user has to accept.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-google_workspace*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 10m
+
+*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one
+* https://developers.google.com/apps-script/guides/bound
+* https://support.google.com/a/users/answer/13004165#share_make_a_copy_links
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Google Workspace
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Resource Copied from External Drive and Access Granted to Custom Application
+
+Google Workspace users can share access to Drive objects such as documents, sheets, and forms via email delivery or a shared link. Shared link URIs have parameters like `view` or `edit` to indicate the recipient's permissions. The `copy` parameter allows the recipient to copy the object to their own Drive, which grants the object with the same privileges as the recipient. Specific objects in Google Drive allow container-bound scripts that run on Google's Apps Script platform. Container-bound scripts can contain malicious code that executes with the recipient's privileges if in their Drive.
+
+This rule aims to detect when a user copies an external Drive object to their Drive storage and then grants permissions to a custom application via OAuth prompt.
+
+#### Possible investigation steps
+- Identify user account(s) associated by reviewing `user.name` or `source.user.email` in the alert.
+- Identify the name of the file copied by reviewing `file.name` as well as the `file.id` for triaging.
+- Identify the file type by reviewing `google_workspace.drive.file.type`.
+- With the information gathered so far, query across data for the file metadata to determine if this activity is isolated or widespread.
+- Within the OAuth token event, identify the application name by reviewing `google_workspace.token.app_name`.
+    - Review the application ID as well from `google_workspace.token.client.id`.
+    - This metadata can be used to report the malicious application to Google for permanent blacklisting.
+- Identify the permissions granted to the application by the user by reviewing `google_workspace.token.scope.data.scope_name`.
+    - This information will help pivot and triage into what services may have been affected.
+- If a container-bound script was attached to the copied object, it will also exist in the user's drive.
+    - This object should be removed from all users affected and investigated for a better understanding of the malicious code.
+
+### False positive analysis
+- Communicate with the affected user to identify if these actions were intentional
+- If a container-bound script exists, review code to identify if it is benign or malicious
+
+### Response and remediation
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+    - Resetting passwords will revoke OAuth tokens which could have been stolen.
+- Reactivate multi-factor authentication for the user.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security defaults [provided by Google](https://cloud.google.com/security-command-center/docs/how-to-investigate-threats).
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+## Setup
+
+### Important Information Regarding Google Workspace Event Lag Times
+- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
+- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
+- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
+- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
+- See the following references for further information:
+  - https://support.google.com/a/answer/7061566
+  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by source.user.email with maxspan=3m
+[file where event.dataset == "google_workspace.drive" and event.action == "copy" and
+
+    /* Should only match if the object lives in a Drive that is external to the user's GWS organization */
+    google_workspace.drive.owner_is_team_drive == "false" and google_workspace.drive.copy_type == "external" and
+
+    /* Google Script, Forms, Sheets and Document can have container-bound scripts */
+    google_workspace.drive.file.type: ("script", "form", "spreadsheet", "document")]
+
+[any where event.dataset == "google_workspace.token" and event.action == "authorize" and
+
+    /* Ensures application ID references custom app in Google Workspace and not GCP */
+    google_workspace.token.client.id : "*apps.googleusercontent.com"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc
index 75afafceb8..263a4bec44 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc
@@ -5,7 +5,7 @@ Detects when a Google Workspace password policy is modified. An adversary may at
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,43 +14,83 @@ Detects when a Google Workspace password policy is modified. An adversary may at
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Persistence
+*Tags*: 
 
-*Version*: 101 (<<google-workspace-password-policy-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Password policies may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Password Policy Modified
+
+Google Workspace administrators manage password policies to enforce password requirements for an organization's compliance needs. Administrators have the capability to set restrictions on password length, reset frequency, reuse capability, expiration, and much more. Google Workspace also allows multi-factor authentication (MFA) and 2-step verification (2SV) for authentication.
+
+Threat actors might rely on weak password policies or restrictions to attempt credential access by using password stuffing or spraying techniques for cloud-based user accounts. Administrators might introduce increased risk to credential access from a third-party by weakening the password restrictions for an organization.
+
+This rule detects when a Google Workspace password policy is modified to decrease password complexity or to adjust the reuse and reset frequency.
+
+#### Possible investigation steps
+
+- Identify associated user account(s) by reviewing the `user.name` or `source.user.email` fields in the alert.
+- Identify the password setting that was created or adjusted by reviewing `google_workspace.admin.setting.name` field.
+- Check if a password setting was enabled or disabled by reviewing the `google_workspace.admin.new_value` and `google_workspace.admin.old_value` fields.
+- After identifying the involved user, verify administrative privileges are scoped properly to change.
+- Filter `event.dataset` for `google_workspace.login` and aggregate by `user.name`, `event.action`.
+  - The `google_workspace.login.challenge_method` field can be used to identify the challenge method used for failed and successful logins.
+
+### False positive analysis
+
+- After identifying the user account that updated the password policy, verify whether the action was intentional.
+- Verify whether the user should have administrative privileges in Google Workspace to modify password policies.
+- Review organizational units or groups the role may have been added to and ensure the new privileges align properly.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Consider resetting passwords for potentially affected users.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Reactivate multi-factor authentication for the user.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
-- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
+- As per Google's documentation, Google Workspace administrators might observe lag times ranging from several minutes to 3 days between the event occurrence time and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
 - By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
@@ -59,24 +99,23 @@ Password policies may be modified by system administrators. Verify that the conf
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:(CHANGE_APPLICATION_SETTING or
-CREATE_APPLICATION_SETTING) and
-google_workspace.admin.setting.name:( "Password Management -
-Enforce strong password" or "Password Management - Password reset
-frequency" or "Password Management - Enable password reuse" or
-"Password Management - Enforce password policy at next login" or
-"Password Management - Minimum password length" or "Password
-Management - Maximum password length" )
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and
+  event.action:(CHANGE_APPLICATION_SETTING or CREATE_APPLICATION_SETTING) and
+  google_workspace.admin.setting.name:(
+    "Password Management - Enforce strong password" or
+    "Password Management - Password reset frequency" or
+    "Password Management - Enable password reuse" or
+    "Password Management - Enforce password policy at next login" or
+    "Password Management - Minimum password length" or
+    "Password Management - Maximum password length"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -88,72 +127,3 @@ Management - Maximum password length" )
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-password-policy-modified-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 15 (8.4.0 release)::
-* Formatting only
-
-Version 13 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:(CHANGE_APPLICATION_SETTING or
-CREATE_APPLICATION_SETTING) and gsuite.admin.setting.name:(
-"Password Management - Enforce strong password" or "Password
-Management - Password reset frequency" or "Password Management -
-Enable password reuse" or "Password Management - Enforce password
-policy at next login" or "Password Management - Minimum password
-length" or "Password Management - Maximum password length" ) or
-google_workspace.admin.setting.name:( "Password Management -
-Enforce strong password" or "Password Management - Password reset
-frequency" or "Password Management - Enable password reuse" or
-"Password Management - Enforce password policy at next login" or
-"Password Management - Minimum password length" or "Password
-Management - Maximum password length" )
-----------------------------------
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:(CHANGE_APPLICATION_SETTING or
-CREATE_APPLICATION_SETTING) and gsuite.admin.setting.name:( "Password
-Management - Enforce strong password" or "Password Management -
-Password reset frequency" or "Password Management - Enable password
-reuse" or "Password Management - Enforce password policy at next
-login" or "Password Management - Minimum password length" or "Password
-Management - Maximum password length" )
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc
index 658014bf18..95de6bcc91 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc
@@ -5,7 +5,7 @@ Detects when the Google Marketplace restrictions are changed to allow any applic
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,85 @@ Detects when the Google Marketplace restrictions are changed to allow any applic
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/6089179?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Defense Evasion
-
-*Version*: 2 (<<google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Applications can be added and removed from blocklists by Google Workspace administrators, but they can all be explicitly allowed for users. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Restrictions for Google Marketplace Modified to Allow Any App
+
+Google Workspace Marketplace is an online store for free and paid web applications that work with Google Workspace services and third-party software. Listed applications are based on Google APIs or Google Apps Script and created by both Google and third-party developers.
+
+Marketplace applications require access to specific Google Workspace resources. Applications can be installed by individual users, if they have permission, or can be installed for an entire Google Workspace domain by administrators. Consent screens typically display what permissions and privileges the application requires during installation. As a result, malicious Marketplace applications may require more permissions than necessary or have malicious intent.
+
+Google clearly states that they are not responsible for any product on the Marketplace that originates from a source other than Google.
+
+This rule identifies when the global allow-all setting is enabled for Google Workspace Marketplace applications.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- This rule relies on data from `google_workspace.admin`, thus indicating the associated user has administrative privileges to the Marketplace.
+- Search for `event.action` is `ADD_APPLICATION` to identify applications installed after these changes were made.
+    - The `google_workspace.admin.application.name` field will help identify what applications were added.
+- With the user account, review other potentially related events within the last 48 hours.
+- Re-assess the permissions and reviews of the Marketplace applications to determine if they violate organizational policies or introduce unexpected risks.
+- With access to the Google Workspace admin console, determine if the application was installed domain-wide or individually by visiting `Apps > Google Workspace Marketplace Apps`.
+
+### False positive analysis
+
+- Identify the user account associated with this action and assess their administrative privileges with Google Workspace Marketplace.
+- Google Workspace administrators may intentionally add an application from the marketplace based on organizational needs.
+    - Follow up with the user who added the application to ensure this was intended.
+- Verify the application identified has been assessed thoroughly by an administrator.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,22 +103,16 @@ Applications can be added and removed from blocklists by Google Workspace admini
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and
-event.action:"CHANGE_APPLICATION_SETTING" and event.category:(iam or
-configuration) and
-google_workspace.event.type:"APPLICATION_SETTINGS" and
-google_workspace.admin.application.name:"Google Workspace Marketplace"
-and google_workspace.admin.setting.name:"Apps Access Setting Allowlist
-access" and google_workspace.admin.new_value:"ALLOW_ALL"
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.action:"CHANGE_APPLICATION_SETTING" and event.category:(iam or configuration)
+    and google_workspace.event.type:"APPLICATION_SETTINGS" and google_workspace.admin.application.name:"Google Workspace Marketplace"
+        and google_workspace.admin.setting.name:"Apps Access Setting Allowlist access"  and google_workspace.admin.new_value:"ALLOW_ALL"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -90,10 +124,7 @@ access" and google_workspace.admin.new_value:"ALLOW_ALL"
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc
index f01705e7f6..ad2ba662db 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc
@@ -5,7 +5,7 @@ Detects when a custom admin role or its permissions are modified. An adversary m
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,44 +14,87 @@ Detects when a custom admin role or its permissions are modified. An adversary m
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/2406043?hl=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<google-workspace-role-modified-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Google Workspace admin roles may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace Role Modified
+
+Google Workspace roles allow administrators to assign specific permissions to users or groups where the principle of least privilege (PoLP) is recommended. Admin roles in Google Workspace grant users access to the Google Admin console, where more domain-wide settings are accessible. Google Workspace contains prebuilt admin roles for performing business functions related to users, groups, and services. Custom administrator roles can be created where prebuilt roles are not preferred. Each Google Workspace service has a set of custodial privileges that can be added to custom roles.
+
+Roles assigned to users will grant them additional permissions and privileges within the Google Workspace domain. Threat actors might modify existing roles with new privileges to advance their intrusion efforts and laterally move throughout the organization. Users with unexpected privileges might also cause operational dysfunction if unfamiliar settings are adjusted without warning.
+
+This rule identifies when a Google Workspace role is modified.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+- Identify the role modified by reviewing the `google_workspace.admin.role.name` field in the alert.
+- Identify the privilege that was added or removed by reviewing the `google_workspace.admin.privilege.name` field in the alert.
+- After identifying the involved user, verify administrative privileges are scoped properly.
+- To identify other users with this role, search for `event.action: ASSIGN_ROLE`
+  - Add `google_workspace.admin.role.name` with the role added as an additional filter.
+  - Adjust the relative time accordingly to identify all users that were assigned this role.
+- Identify if the user account was recently created by searching for `event.action: CREATE_USER`.
+- If a privilege was added, monitor users assigned this role for the next 24 hours and look for attempts to use the new privilege.
+  - The `event.provider` field will help filter for specific services in Google Workspace such as Drive or Admin.
+  - The `event.action` field will help trace actions that are being taken by users.
+
+### False positive analysis
+
+- After identifying the user account that modified the role, verify the action was intentional.
+- Verify that the user is expected to have administrative privileges in Google Workspace to modify roles.
+- Review organizational units or groups the role might have been added to and ensure the new privileges align properly.
+- Use the `user.name` to filter for `event.action` where `ADD_PRIVILEGE` or `UPDATE_ROLE` has been seen before to check if these actions are new or historical.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -62,17 +105,14 @@ Google Workspace admin roles may be modified by system administrators. Verify th
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:(ADD_PRIVILEGE or UPDATE_ROLE)
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:(ADD_PRIVILEGE or UPDATE_ROLE)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,44 +124,3 @@ event.category:iam and event.action:(ADD_PRIVILEGE or UPDATE_ROLE)
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-role-modified-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:(ADD_PRIVILEGE or UPDATE_ROLE)
-----------------------------------
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc
new file mode 100644
index 0000000000..d7778e9bf1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc
@@ -0,0 +1,80 @@
+[[google-workspace-suspended-user-account-renewed]]
+=== Google Workspace Suspended User Account Renewed
+
+Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended user account to maintain access to the Google Workspace organization with a valid account.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-google_workspace*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 10m
+
+*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://support.google.com/a/answer/1110339
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Important Information Regarding Google Workspace Event Lag Times
+- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
+- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
+- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
+- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
+- See the following references for further information:
+  - https://support.google.com/a/answer/7061566
+  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:google_workspace.admin and event.category:iam and event.action:UNSUSPEND_USER
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc
index b26e319a68..5d99ddb835 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc
@@ -5,7 +5,7 @@ Users in Google Workspace are typically assigned a specific organizational unit
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,45 +14,84 @@ Users in Google Workspace are typically assigned a specific organizational unit
 
 *Risk score*: 21
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.google.com/a/answer/6328701?hl=en#
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Persistence
-
-*Version*: 2 (<<google-workspace-user-organizational-unit-changed-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Configuration Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Google Workspace administrators may adjust change which organizational unit a user belongs to as a result of internal role adjustments.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Google Workspace User Organizational Unit Changed
+
+An organizational unit is a group that an administrator can create in the Google Admin console to apply settings to a specific set of users for Google Workspace. By default, all users are placed in the top-level (parent) organizational unit. Child organizational units inherit the settings from the parent but can be changed to fit the needs of the child organizational unit.
+
+Permissions and privileges for users are often inherited from the organizational unit they are placed in. Therefore, if a user is changed to a separate organizational unit, they will inherit all privileges and permissions. User accounts may have unexpected privileges when switching organizational units that would allow a threat actor to gain a stronger foothold within the organization. The principle of least privileged (PoLP) should be followed when users are switched to different groups in Google Workspace.
+
+This rule identifies when a user has been moved to a different organizational unit.
+
+#### Possible investigation steps
+
+- Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
+  - The `user.target.email` field contains the user that had their assigned organizational unit switched.
+- Identify the user's previously assigned unit and new organizational unit by checking the `google_workspace.admin.org_unit.name` and `google_workspace.admin.new_value` fields.
+- Identify Google Workspace applications whose settings were explicitly set for this organizational unit.
+    - Search for `event.action` is `CREATE_APPLICATION_SETTING` where `google_workspace.admin.org_unit.name` is the new organizational unit.
+- After identifying the involved user, verify administrative privileges are scoped properly to allow changing user organizational units.
+- Identify if the user account was recently created by searching for `event.action: CREATE_USER`.
+  - Add `user.email` with the target user account that recently had their organizational unit changed.
+- Filter on `user.name` or `user.target.email` of the user who took this action and review the last 48 hours of activity for anything that may indicate a compromise.
+
+### False positive analysis
+
+- After identifying the user account that changed another user's organizational unit, verify the action was intentional.
+- Verify whether the target user who received this update is expected to inherit privileges from the new organizational unit.
+- Review potential maintenance notes or organizational changes. They might explain why a user's organization was changed.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -63,18 +102,15 @@ Google Workspace administrators may adjust change which organizational unit a us
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and event.type:change and
-event.category:iam and google_workspace.event.type:"USER_SETTINGS"
-and event.action:"MOVE_USER_TO_ORG_UNIT"
+[source, js]
 ----------------------------------
+event.dataset:"google_workspace.admin" and event.type:change and event.category:iam
+    and google_workspace.event.type:"USER_SETTINGS" and event.action:"MOVE_USER_TO_ORG_UNIT"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -86,10 +122,7 @@ and event.action:"MOVE_USER_TO_ORG_UNIT"
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-user-organizational-unit-changed-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Additional Cloud Roles
+** ID: T1098.003
+** Reference URL: https://attack.mitre.org/techniques/T1098/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc
index 068857c561..9319cd6774 100644
--- a/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc
@@ -5,72 +5,66 @@ Detects the first occurrence of a modification to Group Policy Object Attributes
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md
 * https://labs.f-secure.com/tools/sharpgpoabuse
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<group-policy-abuse-for-privilege-addition-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Group Policy Abuse for Privilege Addition
 
-Group Policy Objects (GPOs) can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF
-file named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO.
-This file is unique for each GPO, and only exists if the GPO contains security settings.
-Example Path: "\\DC.com\SysVol\DC.com\Policies\{PolicyGUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf"
+Group Policy Objects (GPOs) can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF file named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO. This file is unique for each GPO, and only exists if the GPO contains security settings. Example Path: "\\DC.com\SysVol\DC.com\Policies\{PolicyGUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf"
 
 #### Possible investigation steps
 
-- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity
-is legitimate and the administrator is authorized to perform this operation.
-- Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially
-dangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.
+- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
+- Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially dangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.
 - Inspect the user security identifiers (SIDs) associated with these privileges, and if they should have these privileges.
 
 ### False positive analysis
 
-- Inspect whether the user that has done the modifications should be allowed to. The user name can be found in the
-`winlog.event_data.SubjectUserName` field.
+- Inspect whether the user that has done the modifications should be allowed to. The user name can be found in the `winlog.event_data.SubjectUserName` field.
 
 ### Related rules
 
@@ -85,19 +79,16 @@ dangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelega
 - Check if other GPOs have suspicious scripts attached.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.code: "5136" and
-winlog.event_data.AttributeLDAPDisplayName:"gPCMachineExtensionNames"
-and winlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F7
-9F83A* and *803E14A0-B4FB-11D0-A0D0-00A0C90F574B*)
-----------------------------------
+  winlog.event_data.AttributeLDAPDisplayName:"gPCMachineExtensionNames" and
+  winlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F79F83A* and *803E14A0-B4FB-11D0-A0D0-00A0C90F574B*)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -109,33 +100,7 @@ and winlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F7
 ** Name: Domain Policy Modification
 ** ID: T1484
 ** Reference URL: https://attack.mitre.org/techniques/T1484/
-
-[[group-policy-abuse-for-privilege-addition-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code: "5136" and
-winlog.event_data.AttributeLDAPDisplayName:"gPCMachineExtensionNames"
-and winlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F
-79F83A* and *803E14A0-B4FB-11D0-A0D0-00A0C90F574B*)
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Group Policy Modification
+** ID: T1484.001
+** Reference URL: https://attack.mitre.org/techniques/T1484/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
new file mode 100644
index 0000000000..95ec8a9969
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
@@ -0,0 +1,63 @@
+[[group-policy-discovery-via-microsoft-gpresult-utility]]
+=== Group Policy Discovery via Microsoft GPResult Utility
+
+Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(process.name: "gpresult.exe" or process.pe.original_file_name == "gprslt.exe") and process.args: ("/z", "/v", "/r", "/x")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Group Policy Discovery
+** ID: T1615
+** Reference URL: https://attack.mitre.org/techniques/T1615/
diff --git a/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc
index 34fa6de3e5..3cc8ba3ba3 100644
--- a/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc
@@ -5,73 +5,61 @@ Halfbaked is a malware family used to establish persistence in a contested netwo
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
 * https://attack.mitre.org/software/S0151/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<halfbaked-command-and-control-beacon-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This rule should be tailored to exclude systems, either as sources or destinations, in which this behavior is expected.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Threat intel
 
 This activity has been observed in FIN7 campaigns.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network OR network_traffic) AND network.protocol:http
-AND network.transport:tcp AND
-url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/
-AND destination.port:(53 OR 80 OR 8080 OR 443)
+[source, js]
 ----------------------------------
+event.dataset: (network_traffic.tls or network_traffic.http) AND
+  network.transport:tcp AND url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ AND
+  destination.port:(53 OR 80 OR 8080 OR 443)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,33 +71,11 @@ AND destination.port:(53 OR 80 OR 8080 OR 443)
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[halfbaked-command-and-control-beacon-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network OR network_traffic) AND network.protocol:http
-AND network.transport:tcp AND
-url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/
-AND destination.port:(53 OR 80 OR 8080 OR 443)
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc
index 2a1f514c14..2aacccc74a 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc
@@ -5,7 +5,7 @@ Identifies a high number of Okta user password reset or account unlock attempts.
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,66 +14,79 @@ Identifies a high number of Okta user password reset or account unlock attempts.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<high-number-of-okta-user-password-reset-or-unlock-attempts-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, @BenB196, Austin Songer
+* Elastic
+* @BenB196
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The number of Okta user password reset or account unlock attempts will likely vary between organizations. To fit this rule to their organization, users can duplicate this rule and edit the schedule and threshold values in the new rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating High Number of Okta User Password Reset or Unlock Attempts
+
+This rule is designed to detect a suspiciously high number of password reset or account unlock attempts in Okta. Excessive password resets or account unlocks can be indicative of an attacker's attempt to gain unauthorized access to an account.
+
+#### Possible investigation steps:
+- Identify the actor associated with the excessive attempts. The `okta.actor.alternate_id` field can be used for this purpose.
+- Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.
+- Review the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the password reset or unlock attempts.
+- Review the event actions associated with these attempts. Look at the `event.action` field and filter for actions related to password reset and account unlock attempts.
+- Check for other similar patterns of behavior from the same actor or IP address. If there is a high number of failed login attempts before the password reset or unlock attempts, this may suggest a brute force attack.
+- Also, look at the times when these attempts were made. If these were made during off-hours, it could further suggest an adversary's activity.
+
+### False positive analysis:
+- This alert might be a false positive if there are legitimate reasons for a high number of password reset or unlock attempts. This could be due to the user forgetting their password or account lockouts due to too many incorrect attempts.
+- Check the actor's past behavior. If this is their usual behavior and they have a valid reason for it, then it might be a false positive.
+
+### Response and remediation:
+- If unauthorized attempts are confirmed, initiate the incident response process.
+- Reset the user's password and enforce MFA re-enrollment, if applicable.
+- Block the IP address or device used in the attempts, if they appear suspicious.
+- If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.
+- Consider a security review of your Okta policies and rules to ensure they follow security best practices.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:okta.system and
-event.action:(system.email.account_unlock.sent_message or
-system.email.password_reset.sent_message or
-system.sms.send_account_unlock_message or
-system.sms.send_password_reset_message or
-system.voice.send_account_unlock_call or
-system.voice.send_password_reset_call or
-user.account.unlock_token)
-----------------------------------
+  event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or
+                system.sms.send_account_unlock_message or system.sms.send_password_reset_message or
+                system.voice.send_account_unlock_call or system.voice.send_password_reset_call or
+                user.account.unlock_token)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,8 +98,6 @@ user.account.unlock_token)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -95,8 +106,6 @@ user.account.unlock_token)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -105,39 +114,3 @@ user.account.unlock_token)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[high-number-of-okta-user-password-reset-or-unlock-attempts-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:okta.system and
-event.action:(system.email.account_unlock.sent_message or
-system.email.password_reset.sent_message or
-system.sms.send_account_unlock_message or
-system.sms.send_password_reset_message or
-system.voice.send_account_unlock_call or
-system.voice.send_password_reset_call or user.account.unlock_token)
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
index 8a806e9522..9d62652fea 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
@@ -5,65 +5,61 @@ This rule identifies a high number (10) of process terminations (stop, delete, o
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/security-labs/luna-ransomware-attack-pattern
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
-
-*Version*: 102 (<<high-number-of-process-and-or-service-terminations-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating High Number of Process and/or Service Terminations
 
-Attackers can stop services and kill processes for a variety of purposes. For example, they can stop services associated
-with business applications and databases to release the lock on files used by these applications so they may be encrypted,
-or stop security and backup solutions, etc.
+Attackers can stop services and kill processes for a variety of purposes. For example, they can stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted, or stop security and backup solutions, etc.
 
-This rule identifies a high number (10) of service and/or process terminations (stop, delete, or suspend) from the same
-host within a short time period.
+This rule identifies a high number (10) of service and/or process terminations (stop, delete, or suspend) from the same host within a short time period.
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -77,32 +73,24 @@ prevalence, whether they are located in expected locations, and if they are sign
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Reimage the host operating system or restore it to the operational state.
-- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look
-for ransomware preparation and execution activities.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and process.name:(net.exe
-or sc.exe or taskkill.exe) and process.args:(stop or pause or delete
-or "/PID" or "/IM" or "/T" or "/F" or "/t" or "/f" or "/im" or "/pid")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and event.type:start and process.name:(net.exe or sc.exe or taskkill.exe) and
+ process.args:(stop or pause or delete or "/PID" or "/IM" or "/T" or "/F" or "/t" or "/f" or "/im" or "/pid")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -114,28 +102,3 @@ or "/PID" or "/IM" or "/T" or "/F" or "/t" or "/f" or "/im" or "/pid")
 ** Name: Service Stop
 ** ID: T1489
 ** Reference URL: https://attack.mitre.org/techniques/T1489/
-
-[[high-number-of-process-and-or-service-terminations-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc
index d6b75b2349..aaf7ad5618 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc
@@ -5,66 +5,63 @@ This rule identifies a high number (10) of process terminations via pkill from t
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Impact
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<high-number-of-process-terminations-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating High Number of Process Terminations
 
-Attackers can kill processes for a variety of purposes. For example, they can kill process associated
-with business applications and databases to release the lock on files used by these applications so they may be
-encrypted,or stop security and backup solutions, etc.
+Attackers can kill processes for a variety of purposes. For example, they can kill process associated with business applications and databases to release the lock on files used by these applications so they may be encrypted,or stop security and backup solutions, etc.
 
-This rule identifies a high number (10) of process terminations via pkill from the same
-host within a short time period.
+This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.
 
 #### Possible investigation steps
 
-Detection alerts from this rule indicate High Number of Process Terminations from the same host
-Here are some possible avenues of investigation:
 - Examine the entry point to the host and user in action via the Analyse View.
-  - Identify the session entry leader and session user
+  - Identify the session entry leader and session user.
 - Examine the contents of session leading to the process termination(s) via the Session View.
-  - Examine the command execution pattern in the session, which may lead to suspricous activities
+  - Examine the command execution pattern in the session, which may lead to suspricous activities.
 - Examine the process killed during the malicious execution
-  - Identify imment threat to the system from the process killed
-  - Take necessary incident response actions to respawn necessary process
+  - Identify imment threat to the system from the process killed.
+  - Take necessary incident response actions to respawn necessary process.
 
 ### False positive analysis
 
@@ -74,31 +71,23 @@ Here are some possible avenues of investigation:
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Reimage the host operating system or restore it to the operational state.
-- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look
-for ransomware preparation and execution activities.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and process.name:"pkill"
-and process.args:"-f"
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:start and process.name:"pkill" and process.args:"-f"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -110,13 +99,3 @@ and process.args:"-f"
 ** Name: Service Stop
 ** ID: T1489
 ** Reference URL: https://attack.mitre.org/techniques/T1489/
-
-[[high-number-of-process-terminations-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/host-files-system-changes-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/rule-details/host-files-system-changes-via-windows-subsystem-for-linux.asciidoc
new file mode 100644
index 0000000000..33bd8ee5b8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/host-files-system-changes-via-windows-subsystem-for-linux.asciidoc
@@ -0,0 +1,69 @@
+[[host-files-system-changes-via-windows-subsystem-for-linux]]
+=== Host Files System Changes via Windows Subsystem for Linux
+
+Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/microsoft/WSL
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=5m
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.name : "dllhost.exe" and 
+   /* Plan9FileSystem CLSID - WSL Host File System Worker */
+  process.command_line : "*{DFB65C4C-B34F-435D-AFE9-A86218684AA8}*"]
+ [file where host.os.type == "windows" and process.name : "dllhost.exe" and not file.path : "?:\\Users\\*\\Downloads\\*"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc
index f75ff6d02b..d9da789ca9 100644
--- a/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc
@@ -5,7 +5,7 @@ The hosts file on endpoints is used to control manual IP address to hostname res
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * winlogbeat-*
@@ -16,107 +16,95 @@ The hosts file on endpoints is used to control manual IP address to hostname res
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-reference-yml.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Windows
-* macOS
-* Threat Detection
-* Impact
-* Investigation Guide
-
-*Version*: 102 (<<hosts-file-modified-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: Windows
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Hosts File Modified
 
-Operating systems use the hosts file to map a connection between an IP address and domain names before going to domain
-name servers. Attackers can abuse this mechanism to route traffic to malicious infrastructure or disrupt security that
-depends on server communications. For example, Russian threat actors modified this file on a domain controller to
-redirect Duo MFA calls to localhost instead of the Duo server, which prevented the MFA service from contacting its
-server to validate MFA login. This effectively disabled MFA for active domain accounts because the default policy of Duo
-for Windows is to "Fail open" if the MFA server is unreachable. This can happen in any MFA implementation and is not
-exclusive to Duo. Find more details in this [CISA Alert](https://www.cisa.gov/uscert/ncas/alerts/aa22-074a).
+Operating systems use the hosts file to map a connection between an IP address and domain names before going to domain name servers. Attackers can abuse this mechanism to route traffic to malicious infrastructure or disrupt security that depends on server communications. For example, Russian threat actors modified this file on a domain controller to redirect Duo MFA calls to localhost instead of the Duo server, which prevented the MFA service from contacting its server to validate MFA login. This effectively disabled MFA for active domain accounts because the default policy of Duo for Windows is to "Fail open" if the MFA server is unreachable. This can happen in any MFA implementation and is not exclusive to Duo. Find more details in this [CISA Alert](https://www.cisa.gov/uscert/ncas/alerts/aa22-074a).
 
-This rule identifies modifications in the hosts file across multiple operating systems using process creation events for
-Linux and file events in Windows and macOS.
+This rule identifies modifications in the hosts file across multiple operating systems using process creation events for Linux and file events in Windows and macOS.
 
 #### Possible investigation steps
 
 - Identify the specifics of the involved assets, such as role, criticality, and associated users.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Examine the changes to the hosts file by comparing it against file backups, volume shadow copies, and other restoration
-mechanisms.
+- Examine the changes to the hosts file by comparing it against file backups, volume shadow copies, and other restoration mechanisms.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity
-and the configuration was justified.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and the configuration was justified.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Review the privileges of the administrator account that performed the action.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where /* file events for creation; file change events are not
-captured by some of the included sources for linux and so may
-miss this, which is the purpose of the process + command line args
-logic below */ ( event.category == "file" and event.type in
-("change", "creation") and file.path : ("/private/etc/hosts",
-"/etc/hosts", "?:\\Windows\\System32\\drivers\\etc\\hosts") ) or
-/* process events for change targeting linux only */ (
-event.category == "process" and event.type in ("start") and
-process.name in ("nano", "vim", "vi", "emacs", "echo", "sed") and
-process.args : ("/etc/hosts") )
+[source, js]
 ----------------------------------
+any where
+
+  /* file events for creation; file change events are not captured by some of the included sources for linux and so may
+     miss this, which is the purpose of the process + command line args logic below */
+  (
+   event.category == "file" and event.type in ("change", "creation") and
+     file.path : ("/private/etc/hosts", "/etc/hosts", "?:\\Windows\\System32\\drivers\\etc\\hosts")
+  )
+  or
+
+  /* process events for change targeting linux only */
+  (
+   event.category == "process" and event.type in ("start") and
+     process.name in ("nano", "vim", "vi", "emacs", "echo", "sed") and
+     process.args : ("/etc/hosts")
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -128,51 +116,7 @@ process.args : ("/etc/hosts") )
 ** Name: Data Manipulation
 ** ID: T1565
 ** Reference URL: https://attack.mitre.org/techniques/T1565/
-
-[[hosts-file-modified-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type in ("change", "creation") and file.path :
-("/private/etc/hosts", "/etc/hosts",
-"?:\\Windows\\System32\\drivers\\etc\\hosts")
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:(change or creation) and
-file.path:("/private/etc/hosts" or "/etc/hosts" or
-"C:\Windows\System32\drivers\etc\hosts")
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Stored Data Manipulation
+** ID: T1565.001
+** Reference URL: https://attack.mitre.org/techniques/T1565/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc
index 4eb7448043..a1ca636e69 100644
--- a/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc
@@ -5,57 +5,51 @@ Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://en.wikipedia.org/wiki/Hping
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Discovery
-
-*Version*: 100 (<<hping-process-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(hping or hping2 or hping3)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(hping or hping2 or hping3)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -67,44 +61,3 @@ process.name:(hping or hping2 or hping3)
 ** Name: System Information Discovery
 ** ID: T1082
 ** Reference URL: https://attack.mitre.org/techniques/T1082/
-
-[[hping-process-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:(hping or hping2 or hping3) and event.action:executed
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name: (hping3 or hping2 or hping) and event.action:executed
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
index 575372fb7e..ddad904bbe 100644
--- a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,115 +16,95 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<iis-http-logging-disabled-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating IIS HTTP Logging Disabled
 
+IIS (Internet Information Services) is a Microsoft web server software used to host websites and web applications on Windows. It provides features for serving dynamic and static content, and can be managed through a graphical interface or command-line tools.
 
-==== Rule query
+IIS logging is a data source that can be used for security monitoring, forensics, and incident response. It contains mainly information related to requests done to the web server, and can be used to spot malicious activities like webshells. Adversaries can tamper, clear, and delete this data to evade detection, cover their tracks, and slow down incident response.
 
+This rule monitors commands that disable IIS logging.
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "appcmd.exe"
-or process.pe.original_file_name == "appcmd.exe") and process.args :
-"/dontLog*:*True" and not process.parent.name : "iissetup.exe"
-----------------------------------
+#### Possible investigation steps
 
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Verify whether the logs stored in the `C:\inetpub\logs\logfiles\w3svc1` directory were deleted after this action.
+- Check if this operation is done under change management and approved according to the organization's policy.
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Impair Defenses
-** ID: T1562
-** Reference URL: https://attack.mitre.org/techniques/T1562/
+### False positive analysis
 
-[[iis-http-logging-disabled-history]]
-==== Rule version history
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-Version 102 (8.6.0 release)::
-* Formatting only
+### Response and remediation
 
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Re-enable affected logging components, services, and security monitoring.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "appcmd.exe" or process.pe.original_file_name ==
-"appcmd.exe") and process.args : "/dontLog*:*True" and not
-process.parent.name : "iissetup.exe"
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
 
-Version 7 (8.2.0 release)::
-* Formatting only
+==== Rule query
 
-Version 6 (7.16.0 release)::
-* Formatting only
 
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:appcmd.exe or process.pe.original_file_name:appcmd.exe)
-and process.args:/dontLog\:\"True\" and not
-process.parent.name:iissetup.exe
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "appcmd.exe" or process.pe.original_file_name == "appcmd.exe") and
+  process.args : "/dontLog*:*True" and
+  not process.parent.name : "iissetup.exe"
 
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:appcmd.exe or process.pe.original_file_name:appcmd.exe
-or winlog.event_data.OriginalFileName:appcmd.exe) and
-process.args:/dontLog\:\"True\" and not
-process.parent.name:iissetup.exe
 ----------------------------------
 
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc b/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc
index 9061b6faa5..a402df69a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc
@@ -5,62 +5,62 @@ The Debugger and SilentProcessExit registry keys can allow an adversary to inter
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<image-file-execution-options-injection-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where length(registry.data.strings) > 0 and registry.path :
-("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File
-Execution Options\\*.exe\\Debugger",
-"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
-"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess") and /*
-add FPs here */ not registry.data.strings regex~ ("""C:\\Program
-Files( \(x86\))?\\ThinKiosk\\thinkiosk\.exe""",
-""".*\\PSAppDeployToolkit\\.*""")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and length(registry.data.strings) > 0 and
+  registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*.exe\\Debugger",
+    "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
+    "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*.exe\\Debugger",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess"
+  ) and
+    /* add FPs here */
+  not registry.data.strings regex~ ("""C:\\Program Files( \(x86\))?\\ThinKiosk\\thinkiosk\.exe""", """.*\\PSAppDeployToolkit\\.*""")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,56 +72,7 @@ Files( \(x86\))?\\ThinKiosk\\thinkiosk\.exe""",
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[image-file-execution-options-injection-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where length(registry.data.strings) > 0 and registry.path :
-("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File
-Execution Options\\*.exe\\Debugger",
-"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
-"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess") and /*
-add FPs here */ not registry.data.strings regex~ ("""C:\\Program
-Files( \(x86\))?\\ThinKiosk\\thinkiosk\.exe""",
-""".*\\PSAppDeployToolkit\\.*""")
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where length(registry.data.strings) > 0 and registry.path :
-("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File
-Execution Options\\*.exe\\Debugger",
-"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
-"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess") and /*
-add FPs here */ not registry.data.strings : ("C:\\Program
-Files*\\ThinKiosk\\thinkiosk.exe", "*\\PSAppDeployToolkit\\*")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Image File Execution Options Injection
+** ID: T1546.012
+** Reference URL: https://attack.mitre.org/techniques/T1546/012/
diff --git a/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
index ed24aacbe8..e1344d16d7 100644
--- a/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
@@ -5,7 +5,7 @@ Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,60 +16,54 @@ Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://dtm.uk/wuauclt/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<imageload-via-windows-update-auto-update-client-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-(process.pe.original_file_name == "wuauclt.exe" or process.name :
-"wuauclt.exe") and /* necessary windows update client args to load
-a dll */ process.args : "/RunHandlerComServer" and process.args :
-"/UpdateDeploymentProvider" and /* common paths writeable by a
-standard user where the target DLL can be placed */ process.args :
-("C:\\Users\\*.dll", "C:\\ProgramData\\*.dll",
-"C:\\Windows\\Temp\\*.dll", "C:\\Windows\\Tasks\\*.dll")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.pe.original_file_name == "wuauclt.exe" or process.name : "wuauclt.exe") and
+   /* necessary windows update client args to load a dll */
+   process.args : "/RunHandlerComServer" and process.args : "/UpdateDeploymentProvider" and
+   /* common paths writeable by a standard user where the target DLL can be placed */
+   process.args : ("C:\\Users\\*.dll", "C:\\ProgramData\\*.dll", "C:\\Windows\\Temp\\*.dll", "C:\\Windows\\Tasks\\*.dll")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,40 +75,3 @@ standard user where the target DLL can be placed */ process.args :
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[imageload-via-windows-update-auto-update-client-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.pe.original_file_name == "wuauclt.exe" or process.name :
-"wuauclt.exe") and /* necessary windows update client args to load
-a dll */ process.args : "/RunHandlerComServer" and process.args :
-"/UpdateDeploymentProvider" and /* common paths writeable by a
-standard user where the target DLL can be placed */ process.args :
-("C:\\Users\\*.dll", "C:\\ProgramData\\*.dll",
-"C:\\Windows\\Temp\\*.dll", "C:\\Windows\\Tasks\\*.dll")
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc b/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
index b1ef58cc01..bdec9b0803 100644
--- a/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
@@ -5,71 +5,57 @@ Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS),
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html
 * https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-http-options.html#_send_all_headers
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* Initial Access
-* Host
-
-*Version*: 100 (<<inbound-connection-to-an-unsecure-elasticsearch-node-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If you have front-facing proxies that provide authentication and TLS, this rule would need to be tuned to eliminate the source IP address of your reverse-proxy.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:network_traffic AND network.protocol:http AND status:OK
-AND destination.port:9200 AND network.direction:inbound AND NOT
-http.response.headers.content-type:"image/x-icon" AND NOT
-_exists_:http.request.headers.authorization
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.http AND status:OK AND destination.port:9200 AND network.direction:inbound AND NOT http.response.headers.content-type:"image/x-icon" AND NOT _exists_:http.request.headers.authorization
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,33 +67,3 @@ _exists_:http.request.headers.authorization
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[inbound-connection-to-an-unsecure-elasticsearch-node-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network_traffic AND network.protocol:http AND status:OK
-AND destination.port:9200 AND network.direction:inbound AND NOT
-http.response.headers.content-type:"image/x-icon" AND NOT
-_exists_:http.request.headers.authorization
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-via-mshta.asciidoc b/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-via-mshta.asciidoc
index 595ef6d6f2..024a9b4ca6 100644
--- a/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-via-mshta.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-via-mshta.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of Distributed Component Object Model (DCOM) to execute comma
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,49 +15,47 @@ Identifies the use of Distributed Component Object Model (DCOM) to execute comma
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://codewhitesec.blogspot.com/2018/07/lethalhta.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 101 (<<incoming-dcom-lateral-movement-via-mshta-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=1m [process where event.type == "start" and
-process.name : "mshta.exe" and process.args : "-Embedding" ] by
-host.id, process.entity_id [network where event.type == "start" and
-process.name : "mshta.exe" and network.direction : ("incoming",
-"ingress") and network.transport == "tcp" and source.port > 49151
-and destination.port > 49151 and source.ip != "127.0.0.1" and
-source.ip != "::1" ] by host.id, process.entity_id
+[source, js]
 ----------------------------------
+sequence with maxspan=1m
+  [process where host.os.type == "windows" and event.type == "start" and
+     process.name : "mshta.exe" and process.args : "-Embedding"
+  ] by host.id, process.entity_id
+  [network where host.os.type == "windows" and event.type == "start" and process.name : "mshta.exe" and
+     network.direction : ("incoming", "ingress") and network.transport == "tcp" and
+     source.port > 49151 and destination.port > 49151 and source.ip != "127.0.0.1" and source.ip != "::1"
+  ] by host.id, process.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,8 +67,10 @@ source.ip != "::1" ] by host.id, process.entity_id
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
+* Sub-technique:
+** Name: Distributed Component Object Model
+** ID: T1021.003
+** Reference URL: https://attack.mitre.org/techniques/T1021/003/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -79,73 +79,7 @@ source.ip != "::1" ] by host.id, process.entity_id
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[incoming-dcom-lateral-movement-via-mshta-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type in ("start",
-"process_started") and process.name : "mshta.exe" and
-process.args : "-Embedding" ] by host.id, process.entity_id
-[network where event.type == "start" and process.name : "mshta.exe"
-and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" and source.port > 49151 and
-destination.port > 49151 and source.ip != "127.0.0.1" and source.ip !=
-"::1" ] by host.id, process.entity_id
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type in ("start",
-"process_started") and process.name : "mshta.exe" and
-process.args : "-Embedding" ] by host.id, process.entity_id
-[network where event.type == "start" and process.name : "mshta.exe"
-and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" and source.port > 49151 and
-destination.port > 49151 and source.ip != "127.0.0.1" and source.ip !=
-"::1" ] by host.id, process.entity_id
-----------------------------------
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type in ("start",
-"process_started") and process.name : "mshta.exe" and
-process.args : "-Embedding" ] by host.id, process.entity_id
-[network where event.type == "start" and process.name : "mshta.exe"
-and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" and source.port > 49151 and
-destination.port > 49151 and not source.address in ("127.0.0.1",
-"::1") ] by host.id, process.entity_id
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type in ("start",
-"process_started") and process.name : "mshta.exe" and
-process.args : "-Embedding" ] by host.id, process.entity_id
-[network where event.type == "start" and process.name : "mshta.exe"
-and network.direction == "incoming" and network.transport ==
-"tcp" and source.port > 49151 and destination.port > 49151 and
-not source.address in ("127.0.0.1", "::1") ] by host.id,
-process.entity_id
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Mshta
+** ID: T1218.005
+** Reference URL: https://attack.mitre.org/techniques/T1218/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-mmc.asciidoc b/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-mmc.asciidoc
index 2d4d615152..a6acd51054 100644
--- a/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-mmc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-mmc.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of Distributed Component Object Model (DCOM) to run commands
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,49 +15,46 @@ Identifies the use of Distributed Component Object Model (DCOM) to run commands
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 101 (<<incoming-dcom-lateral-movement-with-mmc-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=1m [network where event.type ==
-"start" and process.name : "mmc.exe" and source.port >= 49152 and
-destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip
-!= "::1" and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" ] by process.entity_id [process where
-event.type == "start" and process.parent.name : "mmc.exe" ] by
-process.parent.entity_id
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=1m
+ [network where host.os.type == "windows" and event.type == "start" and process.name : "mmc.exe" and source.port >= 49152 and
+ destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip != "::1" and
+  network.direction : ("incoming", "ingress") and network.transport == "tcp"
+ ] by process.entity_id
+ [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "mmc.exe"
+ ] by process.parent.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,55 +66,7 @@ process.parent.entity_id
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[incoming-dcom-lateral-movement-with-mmc-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [network where event.type ==
-"start" and process.name : "mmc.exe" and source.port >= 49152 and
-destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip
-!= "::1" and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" ] by process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"mmc.exe" ] by process.parent.entity_id
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [network where event.type ==
-"start" and process.name : "mmc.exe" and source.port >= 49152 and
-destination.port >= 49152 and source.address not in ("127.0.0.1",
-"::1") and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" ] by process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"mmc.exe" ] by process.parent.entity_id
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [network where event.type ==
-"start" and process.name : "mmc.exe" and source.port >= 49152 and
-destination.port >= 49152 and source.address not in ("127.0.0.1",
-"::1") and network.direction == "incoming" and network.transport ==
-"tcp" ] by process.entity_id [process where event.type in ("start",
-"process_started") and process.parent.name : "mmc.exe" ] by
-process.parent.entity_id
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Distributed Component Object Model
+** ID: T1021.003
+** Reference URL: https://attack.mitre.org/techniques/T1021/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc b/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc
index 69e9a4ddc6..4be815c928 100644
--- a/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc
@@ -5,7 +5,7 @@ Identifies use of Distributed Component Object Model (DCOM) to run commands from
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,49 +15,47 @@ Identifies use of Distributed Component Object Model (DCOM) to run commands from
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 101 (<<incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5s [network where event.type ==
-"start" and process.name : "explorer.exe" and network.direction :
-("incoming", "ingress") and network.transport == "tcp" and
-source.port > 49151 and destination.port > 49151 and source.ip !=
-"127.0.0.1" and source.ip != "::1" ] by process.entity_id [process
-where event.type == "start" and process.parent.name : "explorer.exe"
-] by process.parent.entity_id
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=5s
+ [network where host.os.type == "windows" and event.type == "start" and process.name : "explorer.exe" and
+  network.direction : ("incoming", "ingress") and network.transport == "tcp" and
+  source.port > 49151 and destination.port > 49151 and source.ip != "127.0.0.1" and source.ip != "::1"
+ ] by process.entity_id
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "explorer.exe"
+ ] by process.parent.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,55 +67,7 @@ where event.type == "start" and process.parent.name : "explorer.exe"
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [network where event.type ==
-"start" and process.name : "explorer.exe" and network.direction :
-("incoming", "ingress") and network.transport == "tcp" and
-source.port > 49151 and destination.port > 49151 and source.ip !=
-"127.0.0.1" and source.ip != "::1" ] by process.entity_id [process
-where event.type in ("start", "process_started") and
-process.parent.name : "explorer.exe" ] by process.parent.entity_id
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [network where event.type ==
-"start" and process.name : "explorer.exe" and network.direction :
-("incoming", "ingress") and network.transport == "tcp" and
-source.port > 49151 and destination.port > 49151 and not
-source.address in ("127.0.0.1", "::1") ] by process.entity_id
-[process where event.type in ("start", "process_started") and
-process.parent.name : "explorer.exe" ] by process.parent.entity_id
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [network where event.type ==
-"start" and process.name : "explorer.exe" and network.direction ==
-"incoming" and network.transport == "tcp" and source.port > 49151
-and destination.port > 49151 and not source.address in ("127.0.0.1",
-"::1") ] by process.entity_id [process where event.type in ("start",
-"process_started") and process.parent.name : "explorer.exe" ] by
-process.parent.entity_id
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Distributed Component Object Model
+** ID: T1021.003
+** Reference URL: https://attack.mitre.org/techniques/T1021/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-powershell-remoting.asciidoc b/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-powershell-remoting.asciidoc
index 72c778f96c..0a2fbcbc35 100644
--- a/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-powershell-remoting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-powershell-remoting.asciidoc
@@ -5,7 +5,7 @@ Identifies remote execution via Windows PowerShell remoting. Windows PowerShell
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,52 +15,44 @@ Identifies remote execution via Windows PowerShell remoting. Windows PowerShell
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<incoming-execution-via-powershell-remoting-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan = 30s [network where
-network.direction : ("incoming", "ingress") and destination.port in
-(5985, 5986) and network.protocol == "http" and source.ip !=
-"127.0.0.1" and source.ip != "::1" ] [process where event.type
-== "start" and process.parent.name : "wsmprovhost.exe" and not
-process.name : "conhost.exe"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan = 30s
+   [network where host.os.type == "windows" and network.direction : ("incoming", "ingress") and destination.port in (5985, 5986) and
+    network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
+   [process where host.os.type == "windows" and 
+    event.type == "start" and process.parent.name : "wsmprovhost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,45 +64,7 @@ process.name : "conhost.exe"]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[incoming-execution-via-powershell-remoting-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 30s [network where
-network.direction : ("incoming", "ingress") and destination.port in
-(5985, 5986) and network.protocol == "http" and source.address !=
-"127.0.0.1" and source.address != "::1" ] [process where
-event.type == "start" and process.parent.name : "wsmprovhost.exe" and
-not process.name : "conhost.exe"]
-----------------------------------
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 30s [network where
-network.direction == "incoming" and destination.port in (5985, 5986)
-and network.protocol == "http" and source.address != "127.0.0.1"
-and source.address != "::1" ] [process where event.type ==
-"start" and process.parent.name : "wsmprovhost.exe" and not
-process.name : "conhost.exe"]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Remote Management
+** ID: T1021.006
+** Reference URL: https://attack.mitre.org/techniques/T1021/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-winrm-remote-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-winrm-remote-shell.asciidoc
index 97c0e57315..0b9cfc469d 100644
--- a/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-winrm-remote-shell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/incoming-execution-via-winrm-remote-shell.asciidoc
@@ -5,7 +5,7 @@ Identifies remote execution via Windows Remote Management (WinRM) remote shell o
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,48 +15,42 @@ Identifies remote execution via Windows Remote Management (WinRM) remote shell o
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
+*Tags*: 
 
-*Version*: 100 (<<incoming-execution-via-winrm-remote-shell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-WinRM is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=30s [network where process.pid ==
-4 and network.direction : ("incoming", "ingress") and
-destination.port in (5985, 5986) and network.protocol == "http" and
-source.ip != "127.0.0.1" and source.ip != "::1" ] [process where
-event.type == "start" and process.parent.name : "winrshost.exe" and
-not process.name : "conhost.exe"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=30s
+   [network where host.os.type == "windows" and process.pid == 4 and network.direction : ("incoming", "ingress") and
+    destination.port in (5985, 5986) and network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
+   [process where host.os.type == "windows" and 
+    event.type == "start" and process.parent.name : "winrshost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,42 +62,7 @@ not process.name : "conhost.exe"]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[incoming-execution-via-winrm-remote-shell-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=30s [network where process.pid ==
-4 and network.direction : ("incoming", "ingress") and
-destination.port in (5985, 5986) and network.protocol == "http" and
-not source.address in ("::1", "127.0.0.1") ] [process where
-event.type == "start" and process.parent.name : "winrshost.exe" and
-not process.name : "conhost.exe"]
-----------------------------------
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=30s [network where process.pid ==
-4 and network.direction == "incoming" and destination.port in
-(5985, 5986) and network.protocol == "http" and not source.address in
-("::1", "127.0.0.1") ] [process where event.type == "start" and
-process.parent.name : "winrshost.exe" and not process.name :
-"conhost.exe"]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Remote Management
+** ID: T1021.006
+** Reference URL: https://attack.mitre.org/techniques/T1021/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc b/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
new file mode 100644
index 0000000000..fca139db75
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
@@ -0,0 +1,78 @@
+[[ingress-transfer-via-windows-bits]]
+=== Ingress Transfer via Windows BITS
+
+Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1197/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Command and Control
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.action == "rename" and
+
+process.name : "svchost.exe" and file.Ext.original.name : "BIT*.tmp" and 
+ (file.extension :("exe", "zip", "rar", "bat", "dll", "ps1", "vbs", "wsh", "js", "vbe", "pif", "scr", "cmd", "cpl") or file.Ext.header_bytes : "4d5a*") and 
+ 
+ /* noisy paths, for hunting purposes you can use the same query without the following exclusions */
+ not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\*", "?:\\ProgramData\\*\\*") and 
+ 
+ /* lot of third party SW use BITS to download executables with a long file name */
+ not length(file.name) > 30
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: BITS Jobs
+** ID: T1197
+** Reference URL: https://attack.mitre.org/techniques/T1197/
diff --git a/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc b/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc
index 03979469f5..27dc951b13 100644
--- a/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc
@@ -5,7 +5,7 @@ Identifies the installation of custom Application Compatibility Shim databases.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,44 +15,42 @@ Identifies the installation of custom Application Compatibility Shim databases.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 101 (<<installation-of-custom-shim-databases-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan = 5m [process where
-event.type == "start" and not (process.name : "sdbinst.exe" and
-process.parent.name : "msiexec.exe")] [registry where event.type in
-("creation", "change") and registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan = 5m
+  [process where host.os.type == "windows" and event.type == "start" and
+    not (process.name : "sdbinst.exe" and process.parent.name : "msiexec.exe")]
+  [registry where host.os.type == "windows" and event.type in ("creation", "change") and
+    registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,39 +62,7 @@ NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb"]
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[installation-of-custom-shim-databases-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan = 5m [process where
-event.type in ("start", "process_started") and not (process.name :
-"sdbinst.exe" and process.parent.name : "msiexec.exe")] [registry
-where event.type in ("creation", "change") and registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb"]
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=5m [process where
-event.type in ("start", "process_started") and not (process.name
-: "sdbinst.exe" and process.parent.name : "msiexec.exe")] [registry
-where event.type in ("creation", "change") and
-wildcard(registry.path, "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb")]
-----------------------------------
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Application Shimming
+** ID: T1546.011
+** Reference URL: https://attack.mitre.org/techniques/T1546/011/
diff --git a/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
index 5699702e53..0adab25ed0 100644
--- a/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
@@ -5,63 +5,65 @@ Identifies registry modifications related to the Windows Security Support Provid
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<installation-of-security-support-provider-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path :
-("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
-"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security
-Packages*") and not process.executable :
-("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+   registry.path : (
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security Packages*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security Packages*"
+   ) and
+   not process.executable : ("C:\\Windows\\System32\\msiexec.exe", "C:\\Windows\\SysWOW64\\msiexec.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,45 +75,7 @@ Packages*") and not process.executable :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[installation-of-security-support-provider-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
-"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security
-Packages*") and not process.executable :
-("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe")
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages*",
-"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security
-Packages*") and not process.executable :
-("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Security Support Provider
+** ID: T1547.005
+** Reference URL: https://attack.mitre.org/techniques/T1547/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/installutil-process-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/installutil-process-making-network-connections.asciidoc
index 63cb7c3962..4027c0de50 100644
--- a/docs/detections/prebuilt-rules/rule-details/installutil-process-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/installutil-process-making-network-connections.asciidoc
@@ -5,7 +5,7 @@ Identifies InstallUtil.exe making outbound network connections. This may indicat
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,43 +15,42 @@ Identifies InstallUtil.exe making outbound network connections. This may indicat
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 101 (<<installutil-process-making-network-connections-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* the benefit of doing this as an eql sequence vs kql is this will
-limit to alerting only on the first network connection */ sequence by
-process.entity_id [process where event.type == "start" and
-process.name : "installutil.exe"] [network where process.name :
-"installutil.exe" and network.direction : ("outgoing", "egress")]
+[source, js]
 ----------------------------------
+/* the benefit of doing this as an eql sequence vs kql is this will limit to alerting only on the first network connection */
 
-==== Threat mapping
+sequence by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "installutil.exe"]
+  [network where host.os.type == "windows" and process.name : "installutil.exe" and network.direction : ("outgoing", "egress")]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,42 +62,7 @@ process.name : "installutil.exe"] [network where process.name :
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[installutil-process-making-network-connections-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* the benefit of doing this as an eql sequence vs kql is this will
-limit to alerting only on the first network connection */ sequence by
-process.entity_id [process where event.type in ("start",
-"process_started") and process.name : "installutil.exe"] [network
-where process.name : "installutil.exe" and network.direction :
-("outgoing", "egress")]
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* the benefit of doing this as an eql sequence vs kql is this will
-limit to alerting only on the first network connection */ sequence by
-process.entity_id [process where event.type in ("start",
-"process_started") and process.name : "installutil.exe"] [network
-where process.name : "installutil.exe" and network.direction ==
-"outgoing"]
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: InstallUtil
+** ID: T1218.004
+** Reference URL: https://attack.mitre.org/techniques/T1218/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/interactive-exec-command-launched-against-a-running-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/interactive-exec-command-launched-against-a-running-container.asciidoc
new file mode 100644
index 0000000000..b5eea02c89
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/interactive-exec-command-launched-against-a-running-container.asciidoc
@@ -0,0 +1,79 @@
+[[interactive-exec-command-launched-against-a-running-container]]
+=== Interactive Exec Command Launched Against A Running Container
+
+This rule detects interactive 'exec' events launched against a container using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/command inside the container. This rule specifically targets higher-risk interactive commands that allow real-time interaction with a container's shell. A malicious actor could use this level of access to further compromise the container environment or attempt a container breakout.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/
+* https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id : "*" and event.type== "start" and 
+
+/* use of kubectl exec to enter a container */
+process.entry_leader.entry_meta.type : "container" and 
+
+/* process is the inital process run in a container */
+process.entry_leader.same_as_process== true and
+
+/* interactive process */
+process.interactive == true
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Technique:
+** Name: Container Administration Command
+** ID: T1609
+** Reference URL: https://attack.mitre.org/techniques/T1609/
diff --git a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc
index 6db17dc1d5..7a79f2bbcc 100644
--- a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc
@@ -5,50 +5,50 @@ Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a si
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
+*Tags*: 
 
-*Version*: 100 (<<interactive-terminal-spawned-via-perl-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:perl and process.args:("exec \"/bin/sh\";" or "exec
-\"/bin/dash\";" or "exec \"/bin/bash\";")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:perl and
+  process.args:("exec \"/bin/sh\";" or "exec \"/bin/dash\";" or "exec \"/bin/bash\";")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -60,34 +60,3 @@ process.name:perl and process.args:("exec \"/bin/sh\";" or "exec
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[interactive-terminal-spawned-via-perl-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and process.name:perl and process.args:("exec
-\"/bin/sh\";" or "exec \"/bin/dash\";" or "exec \"/bin/bash\";")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc
index 9f279afdb4..9b7f85c778 100644
--- a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc
@@ -3,54 +3,56 @@
 
 Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.
 
-*Rule type*: query
+*Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
+*Tags*: 
 
-*Version*: 100 (<<interactive-terminal-spawned-via-python-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:python* and process.args:("import pty;
-pty.spawn(\"/bin/sh\")" or "import pty;
-pty.spawn(\"/bin/dash\")" or "import pty;
-pty.spawn(\"/bin/bash\")")
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and
+(
+  (process.parent.name : "python*" and process.name : "*sh" and process.parent.args_count >= 3 and
+   process.parent.args : "*pty.spawn*" and process.parent.args : "-c") or
+  (process.parent.name : "python*" and process.name : "*sh" and process.args : "*sh" and process.args_count == 1
+   and process.parent.args_count == 1)
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -62,59 +64,7 @@ pty.spawn(\"/bin/bash\")")
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[interactive-terminal-spawned-via-python-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:python* and process.args:("import pty;
-pty.spawn(\"/bin/sh\")" or "import pty;
-pty.spawn(\"/bin/dash\")" or "import pty;
-pty.spawn(\"/bin/bash\")")
-----------------------------------
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:python and process.args:("import pty;
-pty.spawn(\"/bin/sh\")" or "import pty;
-pty.spawn(\"/bin/dash\")" or "import pty;
-pty.spawn(\"/bin/bash\")")
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and process.name:python and
-process.args:("import pty; pty.spawn(\"/bin/sh\")" or "import pty;
-pty.spawn(\"/bin/dash\")" or "import pty; pty.spawn(\"/bin/bash\")")
-----------------------------------
-
+* Sub-technique:
+** Name: Python
+** ID: T1059.006
+** Reference URL: https://attack.mitre.org/techniques/T1059/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/ipsec-nat-traversal-port-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/ipsec-nat-traversal-port-activity.asciidoc
index aea60f0350..4961b00a59 100644
--- a/docs/detections/prebuilt-rules/rule-details/ipsec-nat-traversal-port-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ipsec-nat-traversal-port-activity.asciidoc
@@ -5,56 +5,47 @@ This rule detects events that could be describing IPSEC NAT Traversal traffic. I
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Command and Control
-* Host
+*Tags*: 
 
-*Version*: 100 (<<ipsec-nat-traversal-port-activity-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:udp
-and destination.port:4500
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:udp and destination.port:4500
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -62,45 +53,3 @@ and destination.port:4500
 ** Name: Command and Control
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
-
-[[ipsec-nat-traversal-port-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:udp
-and destination.port:4500
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:udp and destination.port:4500
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
index 680db815a9..a3fdbcca6a 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of the Kerberos credential cache (kcc) utility to dump locall
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,45 +14,43 @@ Identifies the use of the Kerberos credential cache (kcc) utility to dump locall
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py
 * https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<kerberos-cached-credentials-dumping-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:kcc and process.args:copy_cred_cache
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.name:kcc and
+  process.args:copy_cred_cache
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,22 +62,11 @@ process.name:kcc and process.args:copy_cred_cache
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[kerberos-cached-credentials-dumping-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc
index 447b6e1eda..97bb4a4807 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc
@@ -5,65 +5,59 @@ Identifies the modification of an account's Kerberos pre-authentication options.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://harmj0y.medium.com/roasting-as-reps-e6179a65216b
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
 * https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<kerberos-pre-authentication-disabled-for-user-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Kerberos Pre-authentication Disabled for User
 
-Kerberos pre-authentication is an account protection against offline password cracking. When enabled, a user requesting
-access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request
-(AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to
-successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server
-Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is
-signed with the user’s password. Microsoft's security monitoring [recommendations](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738) state that `'Don't Require Preauth' – Enabled` should not be enabled for user accounts because it weakens security for the account’s Kerberos authentication.
+Kerberos pre-authentication is an account protection against offline password cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password. Microsoft's security monitoring [recommendations](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738) state that `'Don't Require Preauth' – Enabled` should not be enabled for user accounts because it weakens security for the account’s Kerberos authentication.
 
-AS-REP roasting is an attack against Kerberos for user accounts that do not require pre-authentication, which means that
-if the target user has pre-authentication disabled, an attacker can request authentication data for it and get a TGT that
-can be brute-forced offline, similarly to Kerberoasting.
+AS-REP roasting is an attack against Kerberos for user accounts that do not require pre-authentication, which means that if the target user has pre-authentication disabled, an attacker can request authentication data for it and get a TGT that can be brute-forced offline, similarly to Kerberoasting.
 
 #### Possible investigation steps
 
@@ -74,8 +68,7 @@ can be brute-forced offline, similarly to Kerberoasting.
 
 ### False positive analysis
 
-- Disabling pre-authentication is a bad security practice and should not be allowed in the domain. The security team
-should map and monitor any potential benign true positives (B-TPs), especially if the target account is privileged.
+- Disabling pre-authentication is a bad security practice and should not be allowed in the domain. The security team should map and monitor any potential benign true positives (B-TPs), especially if the target account is privileged.
 
 ### Response and remediation
 
@@ -83,23 +76,18 @@ should map and monitor any potential benign true positives (B-TPs), especially i
 - Reset the target account's password if there is any risk of TGTs having been retrieved.
 - Re-enable the preauthentication option or disable the target account.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.code:4738 and message:"'Don't Require Preauth' - Enabled"
+[source, js]
 ----------------------------------
+event.code:4738 and winlog.api:"wineventlog" and message:"'Don't Require Preauth' - Enabled"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -111,21 +99,7 @@ event.code:4738 and message:"'Don't Require Preauth' - Enabled"
 ** Name: Steal or Forge Kerberos Tickets
 ** ID: T1558
 ** Reference URL: https://attack.mitre.org/techniques/T1558/
-
-[[kerberos-pre-authentication-disabled-for-user-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Rule name changed from: Kerberos Preauthentication Disabled for User
+* Sub-technique:
+** Name: AS-REP Roasting
+** ID: T1558.004
+** Reference URL: https://attack.mitre.org/techniques/T1558/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index fca39329f8..12cd264aa3 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -15,130 +15,134 @@ Identifies network connections to the standard Kerberos port from an unusual pro
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<kerberos-traffic-from-unusual-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-HTTP traffic on a non standard port. Verify that the destination IP address is not related to a Domain Controller.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Kerberos Traffic from Unusual Process
 
-Kerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for
-client/server applications by using secret-key cryptography.
+Kerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for client/server applications by using secret-key cryptography.
 
-Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of
-traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of
-Kerberos tickets.
+Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check if the Destination IP is related to a Domain Controller.
 - Review event ID 4769 for suspicious ticket requests.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This rule uses a Kerberos-related port but does not identify the protocol used on that port. HTTP traffic on a
-non-standard port or destination IP address unrelated to Domain controllers can create false positives.
+- This rule uses a Kerberos-related port but does not identify the protocol used on that port. HTTP traffic on a non-standard port or destination IP address unrelated to Domain controllers can create false positives.
 - Exceptions can be added for noisy/frequent connections.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
   - Ticket requests can be used to investigate potentially compromised accounts.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-network where event.type == "start" and network.direction :
-("outgoing", "egress") and destination.port == 88 and source.port >=
-49152 and not process.executable :
-("?:\\Windows\\System32\\lsass.exe", "System",
-"\\device\\harddiskvolume?\\windows\\system32\\lsass.exe",
-"?:\\Program Files\\rapid7\\nexpose\\nse\\.DLLCACHE\\nseserv.exe",
-"?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe",
-"?:\\Program Files (x86)\\SuperScan\\scanner.exe",
-"?:\\Program Files (x86)\\Nmap\\nmap.exe",
-"\\device\\harddiskvolume?\\program files (x86)\\nmap\\nmap.exe") and
-destination.address !="127.0.0.1" and destination.address !="::1" and
-/* insert false positives here */ not process.name in ("swi_fc.exe",
-"fsIPcam.exe", "IPCamera.exe", "MicrosoftEdgeCP.exe",
-"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe", "msedge.exe",
-"opera.exe", "firefox.exe")
+[source, js]
 ----------------------------------
+network where host.os.type == "windows" and event.type == "start" and network.direction : ("outgoing", "egress") and
+ destination.port == 88 and source.port >= 49152 and process.pid != 4 and
+ not process.executable :
+            ("?:\\Windows\\System32\\lsass.exe",
+             "System",
+             "?:\\Windows\\System32\\svchost.exe",
+             "?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe",
+             "\\device\\harddiskvolume?\\windows\\system32\\lsass.exe",
+             "?:\\Program Files\\rapid7\\nexpose\\nse\\.DLLCACHE\\nseserv.exe",
+             "?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe",
+             "?:\\Program Files (x86)\\SuperScan\\scanner.exe",
+             "?:\\Program Files (x86)\\Nmap\\nmap.exe",
+             "?:\\Program Files\\Tenable\\Nessus\\nessusd.exe",
+             "\\device\\harddiskvolume?\\program files (x86)\\nmap\\nmap.exe",
+             "?:\\Program Files\\Docker\\Docker\\resources\\vpnkit.exe",
+             "?:\\Program Files\\Docker\\Docker\\resources\\com.docker.vpnkit.exe",
+             "?:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe",
+             "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcpatchscan.exe",
+             "\\device\\harddiskvolume?\\program files (x86)\\nmap oem\\nmap.exe",
+             "?:\\Program Files (x86)\\Nmap OEM\\nmap.exe",
+             "?:\\Program Files (x86)\\Zscaler\\ZSATunnel\\ZSATunnel.exe",
+             "?:\\Program Files\\JetBrains\\PyCharm Community Edition*\\bin\\pycharm64.exe",
+             "?:\\Program Files (x86)\\Advanced Port Scanner\\advanced_port_scanner.exe",
+             "?:\\Program Files (x86)\\nwps\\NetScanTools Pro\\NSTPRO.exe",
+             "?:\\Program Files\\BlackBerry\\UEM\\Proxy Server\\bin\\prunsrv.exe",
+             "?:\\Program Files (x86)\\Microsoft Silverlight\\sllauncher.exe",
+             "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+             "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe",
+             "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
+             "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+             "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+             "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+             "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
+             "?:\\Program Files\\Internet Explorer\\iexplore.exe",
+             "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"
+             ) and
+ destination.address != "127.0.0.1" and destination.address != "::1"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -150,70 +154,3 @@ destination.address !="127.0.0.1" and destination.address !="::1" and
 ** Name: Steal or Forge Kerberos Tickets
 ** ID: T1558
 ** Reference URL: https://attack.mitre.org/techniques/T1558/
-
-[[kerberos-traffic-from-unusual-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where event.type == "start" and network.direction :
-("outgoing", "egress") and destination.port == 88 and source.port >=
-49152 and process.executable != "C:\\Windows\\System32\\lsass.exe"
-and destination.address !="127.0.0.1" and destination.address !="::1"
-and /* insert false positives here */ not process.name in
-("swi_fc.exe", "fsIPcam.exe", "IPCamera.exe", "MicrosoftEdgeCP.exe",
-"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe", "msedge.exe",
-"opera.exe", "firefox.exe")
-----------------------------------
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where event.type == "start" and network.direction :
-("outgoing", "egress") and destination.port == 88 and source.port >=
-49152 and process.executable != "C:\\Windows\\System32\\lsass.exe"
-and destination.address !="127.0.0.1" and destination.address !="::1"
-and /* insert False Positives here */ not process.name in
-("swi_fc.exe", "fsIPcam.exe", "IPCamera.exe", "MicrosoftEdgeCP.exe",
-"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe", "msedge.exe",
-"opera.exe", "firefox.exe")
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where event.type == "start" and network.direction ==
-"outgoing" and destination.port == 88 and source.port >= 49152 and
-process.executable != "C:\\Windows\\System32\\lsass.exe" and
-destination.address !="127.0.0.1" and destination.address !="::1" and
-/* insert False Positives here */ not process.name in ("swi_fc.exe",
-"fsIPcam.exe", "IPCamera.exe", "MicrosoftEdgeCP.exe",
-"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe", "msedge.exe",
-"opera.exe", "firefox.exe")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc
new file mode 100644
index 0000000000..6103e185ea
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc
@@ -0,0 +1,89 @@
+[[kernel-load-or-unload-via-kexec-detected]]
+=== Kernel Load or Unload via Kexec Detected
+
+This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.crowdstrike.com/blog/venom-vulnerability-details/
+* https://www.makeuseof.com/what-is-venom-vulnerability/
+* https://madaidans-insecurities.github.io/guides/linux-hardening.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action == "exec" and process.name == "kexec" and 
+process.args in ("--exec", "-e", "--load", "-l", "--unload", "-u")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Escape to Host
+** ID: T1611
+** Reference URL: https://attack.mitre.org/techniques/T1611/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify System Image
+** ID: T1601
+** Reference URL: https://attack.mitre.org/techniques/T1601/
+* Sub-technique:
+** Name: Patch System Image
+** ID: T1601.001
+** Reference URL: https://attack.mitre.org/techniques/T1601/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc
index b8ea822158..ec70c49cb5 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc
@@ -5,53 +5,52 @@ Detects the use of the insmod binary to load a Linux kernel object file. Threat
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* logs-*
+* logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-* Rootkit
-
-*Version*: 100 (<<kernel-module-load-via-insmod-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Threat: Rootkit
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.executable :
-"/usr/sbin/insmod" and process.args : "*.ko"
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+  process.executable : "/usr/sbin/insmod" and process.args : "*.ko"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,10 +62,7 @@ process where event.type == "start" and process.executable :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[kernel-module-load-via-insmod-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc
index 63277ea649..cd2289e59f 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc
@@ -3,60 +3,53 @@
 
 Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module.
 
-*Rule type*: query
+*Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * http://man7.org/linux/man-pages/man8/modprobe.8.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<kernel-module-removal-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-There is usually no reason to remove modules, but some buggy modules require it. These can be exempted by username. Note that some Linux distributions are not built to support the removal of modules at all.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:((rmmod and sudo) or (modprobe and sudo and ("--remove"
-or "-r")))
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.action == "exec" and process.name == "rmmod" or
+(process.name == "modprobe" and process.args in ("--remove", "-r"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,8 +61,10 @@ or "-r")))
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -78,37 +73,7 @@ or "-r")))
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[kernel-module-removal-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and process.args:(rmmod and sudo or modprobe and
-sudo and ("--remove" or "-r"))
-----------------------------------
-
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
index a0daef31f0..dc07f81022 100644
--- a/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
@@ -5,7 +5,7 @@ Adversaries may collect keychain storage data from a system to in order to acqui
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,65 +14,54 @@ Adversaries may collect keychain storage data from a system to in order to acqui
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.netmeister.org/blog/keychain-passwords.html
 * https://github.com/priyankchheda/chrome_password_grabber/blob/master/chrome.py
 * https://ss64.com/osx/security.html
 * https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<keychain-password-retrieval-via-command-line-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Applications for password management.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "security" and
-process.args : "-wa" and process.args : ("find-generic-password",
-"find-internet-password") and process.args : ("Chrome*", "Chromium",
-"Opera", "Safari*", "Brave", "Microsoft Edge", "Edge", "Firefox*") and
-not process.parent.executable : "/Applications/Keeper Password
-Manager.app/Contents/Frameworks/Keeper Password Manager
-Helper*/Contents/MacOS/Keeper Password Manager Helper*"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type == "start" and
+ process.name : "security" and process.args : "-wa" and process.args : ("find-generic-password", "find-internet-password") and
+ process.args : ("Chrome*", "Chromium", "Opera", "Safari*", "Brave", "Microsoft Edge", "Edge", "Firefox*") and
+ not process.parent.executable : "/Applications/Keeper Password Manager.app/Contents/Frameworks/Keeper Password Manager Helper*/Contents/MacOS/Keeper Password Manager Helper*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,26 +73,15 @@ Helper*/Contents/MacOS/Keeper Password Manager Helper*"
 ** Name: Credentials from Password Stores
 ** ID: T1555
 ** Reference URL: https://attack.mitre.org/techniques/T1555/
-
-[[keychain-password-retrieval-via-command-line-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:security and process.args:("find-generic-password" or
-"find-internet-password")
-----------------------------------
-
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Credentials from Web Browsers
+** ID: T1555.003
+** Reference URL: https://attack.mitre.org/techniques/T1555/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc b/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc
index 059b187baf..d412fd0b79 100644
--- a/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc
@@ -5,64 +5,62 @@ Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://skyblue.team/posts/delegate-krbtgt
 * https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Active Directory
-
-*Version*: 100 (<<krbtgt-delegation-backdoor-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.action:modified-user-account and event.code:4738 and
-winlog.event_data.AllowedToDelegateTo:*krbtgt*
-----------------------------------
+  winlog.event_data.AllowedToDelegateTo:*krbtgt*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,8 +72,6 @@ winlog.event_data.AllowedToDelegateTo:*krbtgt*
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -84,16 +80,3 @@ winlog.event_data.AllowedToDelegateTo:*krbtgt*
 ** Name: Steal or Forge Kerberos Tickets
 ** ID: T1558
 ** Reference URL: https://attack.mitre.org/techniques/T1558/
-
-[[krbtgt-delegation-backdoor-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc
index 26dcfe971b..a8b8090eb5 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc
@@ -5,7 +5,7 @@ This rule detects when an unauthenticated user request is authorized within the
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,62 +13,51 @@ This rule detects when an unauthenticated user request is authorized within the
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Initial Access
-* Defense Evasion
-
-*Version*: 2 (<<kubernetes-anonymous-request-authorized-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Initial Access
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 5
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Anonymous access to the API server is a dangerous setting enabled by default. Common anonymous connections (e.g., health checks) have been excluded from this rule. All other instances of authorized anonymous requests should be investigated.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and (kubernetes.audit.user.username:("system:anonymous" or
-"system:unauthenticated") or not kubernetes.audit.user.username:*)
-and not kubernetes.audit.objectRef.resource:("healthz" or "livez" or
-"readyz")
+[source, js]
 ----------------------------------
+event.dataset:kubernetes.audit_logs
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:allow
+  and kubernetes.audit.user.username:("system:anonymous" or "system:unauthenticated" or not *)
+  and not kubernetes.audit.requestURI:(/healthz* or /livez* or /readyz*)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,19 +69,7 @@ and not kubernetes.audit.objectRef.resource:("healthz" or "livez" or
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[kubernetes-anonymous-request-authorized-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and (kubernetes.audit.user.username:("system:anonymous" or
-"system:unauthenticated") or not kubernetes.audit.user.username:*)
-and not kubernetes.audit.objectRef.resource:("healthz" or "livez" or
-"readyz")
-----------------------------------
-
+* Sub-technique:
+** Name: Default Accounts
+** ID: T1078.001
+** Reference URL: https://attack.mitre.org/techniques/T1078/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc
index 17293f6099..2f443004d6 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc
@@ -5,7 +5,7 @@ This rule detects a container deployed with one or more dangerously permissive L
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,43 +13,38 @@ This rule detects a container deployed with one or more dangerously permissive L
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container
 * https://0xn3va.gitbook.io/cheat-sheets/container/escaping/excessive-capabilities
 * https://man7.org/linux/man-pages/man7/capabilities.7.html
 * https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Version*: 1
+*Version*: 3
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Some container images require the addition of privileged capabilities. This rule leaves space for the exception of trusted container images. To add an exception, add the trusted container image name to the query field, kubernetes.audit.requestObject.spec.containers.image.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -58,14 +53,14 @@ Some container images require the addition of privileged capabilities. This rule
 Linux capabilities were designed to divide root privileges into smaller units. Each capability grants a thread just enough power to perform specific privileged tasks. In Kubernetes, containers are given a set of default capabilities that can be dropped or added to at the time of creation. Added capabilities entitle containers in a pod with additional privileges that can be used to change
 core processes, change network settings of a cluster, or directly access the underlying host. The following have been used in container escape techniques:
 
-BPF - Allow creating BPF maps, loading BPF Type Format (BTF) data, retrieve JITed code of BPF programs, and more. 
-DAC_READ_SEARCH - Bypass file read permission checks and directory read and execute permission checks. 
-NET_ADMIN - Perform various network-related operations. 
-SYS_ADMIN - Perform a range of system administration operations. 
-SYS_BOOT - Use reboot(2) and kexec_load(2), reboot and load a new kernel for later execution. 
-SYS_MODULE - Load and unload kernel modules. 
+BPF - Allow creating BPF maps, loading BPF Type Format (BTF) data, retrieve JITed code of BPF programs, and more.
+DAC_READ_SEARCH - Bypass file read permission checks and directory read and execute permission checks.
+NET_ADMIN - Perform various network-related operations.
+SYS_ADMIN - Perform a range of system administration operations.
+SYS_BOOT - Use reboot(2) and kexec_load(2), reboot and load a new kernel for later execution.
+SYS_MODULE - Load and unload kernel modules.
 SYS_PTRACE - Trace arbitrary processes using ptrace(2).
-SYS_RAWIO - Perform I/O port operations (iopl(2) and ioperm(2)). 
+SYS_RAWIO - Perform I/O port operations (iopl(2) and ioperm(2)).
 SYSLOG - Perform privileged syslog(2) operations.
 
 ### False positive analysis
@@ -73,25 +68,19 @@ SYSLOG - Perform privileged syslog(2) operations.
 - While these capabilities are not included by default in containers, some legitimate images may need to add them. This rule leaves space for the exception of trusted container images. To add an exception, add the trusted container image name to the query field, kubernetes.audit.requestObject.spec.containers.image.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset: kubernetes.audit_logs and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.verb: create and
-kubernetes.audit.objectRef.resource: pods and kubernetes.audit.requ
-estObject.spec.containers.securityContext.capabilities.add: ("BPF" or
-"DAC_READ_SEARCH" or "NET_ADMIN" or "SYS_ADMIN" or "SYS_BOOT" or
-"SYS_MODULE" or "SYS_PTRACE" or "SYS_RAWIO" or "SYSLOG") and not
-kubernetes.audit.requestObject.spec.containers.image :
-("docker.elastic.co/beats/elastic-agent:8.4.0" or "rancher/klipper-
-lb:v0.3.5" or "")
+[source, js]
 ----------------------------------
+event.dataset: kubernetes.audit_logs
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.verb: create
+  and kubernetes.audit.objectRef.resource: pods
+  and kubernetes.audit.requestObject.spec.containers.securityContext.capabilities.add: ("BPF" or "DAC_READ_SEARCH"  or "NET_ADMIN" or "SYS_ADMIN" or "SYS_BOOT" or "SYS_MODULE" or "SYS_PTRACE" or "SYS_RAWIO"  or "SYSLOG")
+  and not kubernetes.audit.requestObject.spec.containers.image : ("docker.elastic.co/beats/elastic-agent:8.4.0" or "rancher/klipper-lb:v0.3.5" or "")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -103,8 +92,6 @@ lb:v0.3.5" or "")
 ** Name: Escape to Host
 ** ID: T1611
 ** Reference URL: https://attack.mitre.org/techniques/T1611/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc
index f6d0918e9a..ed855cb8e0 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc
@@ -5,7 +5,7 @@ This rule detects when a service account makes an unauthorized request for resou
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,58 +13,49 @@ This rule detects when a service account makes an unauthorized request for resou
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections
 * https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Discovery
-
-*Version*: 2 (<<kubernetes-denied-service-account-request-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Discovery
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 4
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Unauthorized requests from service accounts are highly abnormal and more indicative of human behavior or a serious problem within the cluster. This behavior should be investigated further.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset: "kubernetes.audit_logs" and
-kubernetes.audit.user.username: system\:serviceaccount\:* and
-kubernetes.audit.annotations.authorization_k8s_io/decision: "forbid"
+[source, js]
 ----------------------------------
+event.dataset: "kubernetes.audit_logs"
+  and kubernetes.audit.user.username: system\:serviceaccount\:*
+  and kubernetes.audit.annotations.authorization_k8s_io/decision: "forbid"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,10 +67,3 @@ kubernetes.audit.annotations.authorization_k8s_io/decision: "forbid"
 ** Name: Container and Resource Discovery
 ** ID: T1613
 ** Reference URL: https://attack.mitre.org/techniques/T1613/
-
-[[kubernetes-denied-service-account-request-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc
index 81b1c9d26f..54fc6a2ef0 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc
@@ -5,7 +5,7 @@ This rule detects an attempt to create or modify a service as type NodePort. The
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,62 +13,53 @@ This rule detects an attempt to create or modify a service as type NodePort. The
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
 * https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
 * https://www.tigera.io/blog/new-vulnerability-exposes-kubernetes-to-man-in-the-middle-attacks-heres-how-to-mitigate/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Persistence
-
-*Version*: 200 (<<kubernetes-exposed-service-created-with-type-nodeport-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Developers may have a legitimate use for NodePorts. For frontend parts of an application you may want to expose a Service onto an external IP address without using cloud specific Loadbalancers. NodePort can be used to expose the Service on each Node's IP at a static port (the NodePort). You'll be able to contact the NodePort Service from outside the cluster, by requesting <NodeIP>:<NodePort>. NodePort unlike Loadbalancers, allow the freedom to set up your own load balancing solution, configure environments that aren't fully supported by Kubernetes, or even to expose one or more node's IPs directly.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.objectRef.resource:"services" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.type:"NodePort"
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.objectRef.resource:"services"
+  and kubernetes.audit.verb:("create" or "update" or "patch")
+  and kubernetes.audit.requestObject.spec.type:"NodePort"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,20 +71,3 @@ kubernetes.audit.requestObject.spec.type:"NodePort"
 ** Name: External Remote Services
 ** ID: T1133
 ** Reference URL: https://attack.mitre.org/techniques/T1133/
-
-[[kubernetes-exposed-service-created-with-type-nodeport-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"services" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.type:"NodePort"
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc
index f11384be9e..ec1621d871 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc
@@ -5,7 +5,7 @@ This rule detects when a pod is created with a sensitive volume of type hostPath
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,69 +13,69 @@ This rule detects when a pod is created with a sensitive volume of type hostPath
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
 * https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
-
-*Version*: 200 (<<kubernetes-pod-created-with-a-sensitive-hostpath-volume-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An administrator may need to attach a hostPath volume for a legitimate reason. This alert should be investigated for legitimacy by determining if the kuberenetes.audit.requestObject.spec.volumes.hostPath.path triggered is one needed by its target container/pod. For example, when the fleet managed elastic agent is deployed as a daemonset it creates several hostPath volume mounts, some of which are sensitive host directories like /proc, /etc/kubernetes, and /var/log. Add exceptions for trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.volumes.hostPath.path: ("/" or
-"/proc" or "/root" or "/var" or "/var/run" or
-"/var/run/docker.sock" or "/var/run/crio/crio.sock" or
-"/var/run/cri-dockerd.sock" or "/var/lib/kubelet" or
-"/var/lib/kubelet/pki" or "/var/lib/docker/overlay2" or "/etc"
-or "/etc/kubernetes" or "/etc/kubernetes/manifests" or
-"/etc/kubernetes/pki" or "/home/admin") and not
-kubernetes.audit.requestObject.spec.containers.image:
-("docker.elastic.co/beats/elastic-agent:8.4.0")
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.objectRef.resource:"pods"
+  and kubernetes.audit.verb:("create" or "update" or "patch")
+  and kubernetes.audit.requestObject.spec.volumes.hostPath.path:
+  ("/" or
+  "/proc" or
+  "/root" or
+  "/var" or
+  "/var/run" or
+  "/var/run/docker.sock" or
+  "/var/run/crio/crio.sock" or
+  "/var/run/cri-dockerd.sock" or
+  "/var/lib/kubelet" or
+  "/var/lib/kubelet/pki" or
+  "/var/lib/docker/overlay2" or
+  "/etc" or
+  "/etc/kubernetes" or
+  "/etc/kubernetes/manifests" or
+  "/etc/kubernetes/pki" or
+  "/home/admin")
+  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -87,8 +87,6 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Escape to Host
 ** ID: T1611
 ** Reference URL: https://attack.mitre.org/techniques/T1611/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -97,37 +95,3 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Deploy Container
 ** ID: T1610
 ** Reference URL: https://attack.mitre.org/techniques/T1610/
-
-[[kubernetes-pod-created-with-a-sensitive-hostpath-volume-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.volumes.hostPath.path:("/" or
-"/proc" or "/root" or "/var" or "/var/run/docker.sock" or
-"/var/run/crio/crio.sock" or "/var/run/cri-dockerd.sock" or
-"/var/lib/kubelet" or "/var/lib/kubelet/pki" or
-"/var/lib/docker/overlay2" or "/etc" or "/etc/kubernetes" or
-"/etc/kubernetes/manifests" or "/home/admin")
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.volumes.hostPath.path:("/" or
-"/proc" or "/root" or "/var" or "/var/run/docker.sock" or
-"/var/run/crio/crio.sock" or "/var/run/cri-dockerd.sock" or
-"/var/lib/kubelet" or "/var/lib/kubelet/pki" or
-"/var/lib/docker/overlay2" or "/etc" or "/etc/kubernetes" or
-"/etc/kubernetes/manifests" or "/home/admin")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc
index f5dbb98a35..7034b26d02 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc
@@ -5,7 +5,7 @@ This rule detects an attempt to create or modify a pod using the host IPC namesp
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,64 +13,54 @@ This rule detects an attempt to create or modify a pod using the host IPC namesp
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections
 * https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces
 * https://bishopfox.com/blog/kubernetes-pod-privilege-escalation
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
-
-*Version*: 200 (<<kubernetes-pod-created-with-hostipc-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An administrator or developer may want to use a pod that runs as root and shares the host's IPC, Network, and PID namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and network namespaces from the host's perspective. Add exceptions for trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.hostIPC:true and not
-kubernetes.audit.requestObject.spec.containers.image:
-("docker.elastic.co/beats/elastic-agent:8.4.0")
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.objectRef.resource:"pods"
+  and kubernetes.audit.verb:("create" or "update" or "patch")
+  and kubernetes.audit.requestObject.spec.hostIPC:true
+  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,8 +72,6 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Escape to Host
 ** ID: T1611
 ** Reference URL: https://attack.mitre.org/techniques/T1611/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -92,20 +80,3 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Deploy Container
 ** ID: T1610
 ** Reference URL: https://attack.mitre.org/techniques/T1610/
-
-[[kubernetes-pod-created-with-hostipc-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.hostIPC:true
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc
index b7c8842525..f14ce4836f 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc
@@ -5,7 +5,7 @@ This rules detects an attempt to create or modify a pod attached to the host net
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,64 +13,54 @@ This rules detects an attempt to create or modify a pod attached to the host net
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections
 * https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces
 * https://bishopfox.com/blog/kubernetes-pod-privilege-escalation
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
-
-*Version*: 200 (<<kubernetes-pod-created-with-hostnetwork-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An administrator or developer may want to use a pod that runs as root and shares the hosts IPC, Network, and PID namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and network namespaces from the host's perspective. Add exceptions for trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.hostNetwork:true and not
-kubernetes.audit.requestObject.spec.containers.image:
-("docker.elastic.co/beats/elastic-agent:8.4.0")
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.objectRef.resource:"pods"
+  and kubernetes.audit.verb:("create" or "update" or "patch")
+  and kubernetes.audit.requestObject.spec.hostNetwork:true
+  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,8 +72,6 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Escape to Host
 ** ID: T1611
 ** Reference URL: https://attack.mitre.org/techniques/T1611/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -92,20 +80,3 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Deploy Container
 ** ID: T1610
 ** Reference URL: https://attack.mitre.org/techniques/T1610/
-
-[[kubernetes-pod-created-with-hostnetwork-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.hostNetwork:true
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc
index 7ed6ac6619..2b9905edc1 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc
@@ -5,7 +5,7 @@ This rule detects an attempt to create or modify a pod attached to the host PID
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,64 +13,54 @@ This rule detects an attempt to create or modify a pod attached to the host PID
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections
 * https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces
 * https://bishopfox.com/blog/kubernetes-pod-privilege-escalation
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
-
-*Version*: 200 (<<kubernetes-pod-created-with-hostpid-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An administrator or developer may want to use a pod that runs as root and shares the hosts IPC, Network, and PID namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and network namespaces from the host's perspective. Add exceptions for trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.hostPID:true and not
-kubernetes.audit.requestObject.spec.containers.image:
-("docker.elastic.co/beats/elastic-agent:8.4.0")
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.objectRef.resource:"pods"
+  and kubernetes.audit.verb:("create" or "update" or "patch")
+  and kubernetes.audit.requestObject.spec.hostPID:true
+  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,8 +72,6 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Escape to Host
 ** ID: T1611
 ** Reference URL: https://attack.mitre.org/techniques/T1611/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -92,20 +80,3 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Deploy Container
 ** ID: T1610
 ** Reference URL: https://attack.mitre.org/techniques/T1610/
-
-[[kubernetes-pod-created-with-hostpid-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.verb:("create" or "update" or "patch") and
-kubernetes.audit.requestObject.spec.hostPID:true
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc
index e2652aec69..94bd796ec9 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc
@@ -5,7 +5,7 @@ This rule detects when a user creates a pod/container running in privileged mode
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,63 +13,53 @@ This rule detects when a user creates a pod/container running in privileged mode
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF
 * https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
-
-*Version*: 200 (<<kubernetes-privileged-pod-created-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-By default a container is not allowed to access any devices on the host, but a "privileged" container is given access to all devices on the host. This allows the container nearly all the same access as processes running on the host. An administrator may want to run a privileged container to use operating system administrative capabilities such as manipulating the network stack or accessing hardware devices from within the cluster. Add exceptions for trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.objectRef.resource:pods and
-kubernetes.audit.verb:create and kubernetes.audit.requestObject.spe
-c.containers.securityContext.privileged:true and not
-kubernetes.audit.requestObject.spec.containers.image:
-("docker.elastic.co/beats/elastic-agent:8.4.0")
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.objectRef.resource:pods
+  and kubernetes.audit.verb:create
+  and kubernetes.audit.requestObject.spec.containers.securityContext.privileged:true
+  and not kubernetes.audit.requestObject.spec.containers.image: ("docker.elastic.co/beats/elastic-agent:8.4.0")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,8 +71,6 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Escape to Host
 ** ID: T1611
 ** Reference URL: https://attack.mitre.org/techniques/T1611/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -91,20 +79,3 @@ kubernetes.audit.requestObject.spec.containers.image:
 ** Name: Deploy Container
 ** ID: T1610
 ** Reference URL: https://attack.mitre.org/techniques/T1610/
-
-[[kubernetes-privileged-pod-created-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:pods and
-kubernetes.audit.verb:create and kubernetes.audit.requestObject.spec
-.containers.securityContext.privileged:true
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc
index 0142bccf08..5354df4143 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc
@@ -5,7 +5,7 @@ This rule detects a request to attach a controller service account to an existin
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,61 +13,52 @@ This rule detects a request to attach a controller service account to an existin
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-* Privilege Escalation
-
-*Version*: 3 (<<kubernetes-suspicious-assignment-of-controller-service-account-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 5
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Controller service accounts aren't normally assigned to running pods, this is abnormal behavior with very few legitimate use-cases and should result in very few false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.verb : "create" and
-kubernetes.audit.objectRef.resource : "pods" and
-kubernetes.audit.objectRef.namespace : "kube-system" and
-kubernetes.audit.requestObject.spec.serviceAccountName:*controller
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.verb : "create"
+  and kubernetes.audit.objectRef.resource : "pods"
+  and kubernetes.audit.objectRef.namespace : "kube-system"
+  and kubernetes.audit.requestObject.spec.serviceAccountName:*controller
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,18 +70,7 @@ kubernetes.audit.requestObject.spec.serviceAccountName:*controller
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[kubernetes-suspicious-assignment-of-controller-service-account-history]]
-==== Rule version history
-
-Version 3 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and kubernetes.audit.verb :
-"create" and kubernetes.audit.objectRef.resource : "pods" and
-kubernetes.audit.objectRef.namespace : "kube-system" and
-kubernetes.audit.requestObject.spec.serviceAccountName:*controller
-----------------------------------
-
+* Sub-technique:
+** Name: Default Accounts
+** ID: T1078.001
+** Reference URL: https://attack.mitre.org/techniques/T1078/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc
index 0a5a0cbafe..2633a7a2b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc
@@ -5,7 +5,7 @@ This rule detects when a service account or node attempts to enumerate their own
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,65 +13,53 @@ This rule detects when a service account or node attempts to enumerate their own
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms
 * https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access
 * https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/detecting-identity-attacks-in-kubernetes/ba-p/3232340
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Discovery
-
-*Version*: 200 (<<kubernetes-suspicious-self-subject-review-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Discovery
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An administrator may submit this request as an "impersonatedUser" to determine what privileges a particular service account has been granted. However, an adversary may utilize the same technique as a means to determine the privileges of another token other than that of the compromised account.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.verb:"create" and
-kubernetes.audit.objectRef.resource:("selfsubjectaccessreviews" or
-"selfsubjectrulesreviews") and
-(kubernetes.audit.user.username:(system\:serviceaccount\:* or
-system\:node\:*) or
-kubernetes.audit.impersonatedUser.username:(system\:serviceaccount\:*
-or system\:node\:*))
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.verb:"create"
+  and kubernetes.audit.objectRef.resource:("selfsubjectaccessreviews" or "selfsubjectrulesreviews")
+  and (kubernetes.audit.user.username:(system\:serviceaccount\:* or system\:node\:*)
+  or kubernetes.audit.impersonatedUser.username:(system\:serviceaccount\:* or system\:node\:*))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,35 +71,3 @@ or system\:node\:*))
 ** Name: Container and Resource Discovery
 ** ID: T1613
 ** Reference URL: https://attack.mitre.org/techniques/T1613/
-
-[[kubernetes-suspicious-self-subject-review-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.verb:"create" and
-kubernetes.audit.objectRef.resource:("selfsubjectaccessreviews" or
-"selfsubjectrulesreviews") and
-kubernetes.audit.user.username:(system\:serviceaccount\:* or
-system\:node\:*) or
-kubernetes.audit.impersonatedUser.username:(system\:serviceaccount\:*
-or system\:node\:*)
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.verb:"create" and
-kubernetes.audit.objectRef.resource:("selfsubjectaccessreviews" or
-"selfsubjectrulesreviews") and
-kubernetes.audit.user.username:(system\:serviceaccount\:* or
-system\:node\:*) or
-kubernetes.audit.impersonatedUser.username:(system\:serviceaccount\:*
-or system\:node\:*)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc
index 7d3218f133..713c51353a 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc
@@ -5,7 +5,7 @@ This rule detects a user attempt to establish a shell session into a pod using t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-kubernetes.*
 
@@ -13,60 +13,51 @@ This rule detects a user attempt to establish a shell session into a pod using t
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/
 * https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Kubernetes
-* Continuous Monitoring
-* Execution
-
-*Version*: 200 (<<kubernetes-user-exec-into-pod-history, version history>>)
+* Data Source: Kubernetes
+* Tactic: Execution
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 202
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An administrator may need to exec into a pod for a legitimate reason like debugging purposes. Containers built from Linux and Windows OS images, tend to include debugging utilities. In this case, an admin may choose to run commands inside a specific container with kubectl exec ${POD_NAME} -c ${CONTAINER_NAME} -- ${CMD} ${ARG1} ${ARG2} ... ${ARGN}. For example, the following command can be used to look at logs from a running Cassandra pod: kubectl exec cassandra --cat /var/log/cassandra/system.log . Additionally, the -i and -t arguments might be used to run a shell connected to the terminal: kubectl exec -i -t cassandra -- sh
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset : "kubernetes.audit_logs" and
-kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
-and kubernetes.audit.verb:"create" and
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.objectRef.subresource:"exec"
+[source, js]
 ----------------------------------
+event.dataset : "kubernetes.audit_logs"
+  and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
+  and kubernetes.audit.verb:"create"
+  and kubernetes.audit.objectRef.resource:"pods"
+  and kubernetes.audit.objectRef.subresource:"exec"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,35 +69,3 @@ kubernetes.audit.objectRef.subresource:"exec"
 ** Name: Container Administration Command
 ** ID: T1609
 ** Reference URL: https://attack.mitre.org/techniques/T1609/
-
-[[kubernetes-user-exec-into-pod-history]]
-==== Rule version history
-
-Version 200 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.objectRef.subresource:"exec"
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.objectRef.subresource:"exec"
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:"kubernetes.audit_logs" and
-kubernetes.audit.objectRef.resource:"pods" and
-kubernetes.audit.objectRef.subresource:"exec"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc b/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
index b1ecaefead..a57f620a3a 100644
--- a/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
@@ -5,68 +5,66 @@ Identifies suspicious file creations in the startup folder of a remote system. A
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.mdsec.co.uk/2017/06/rdpinception/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<lateral-movement-via-startup-folder-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type in ("creation", "change") and /* via RDP
-TSClient mounted share or SMB */ (process.name : "mstsc.exe" or
-process.pid == 4) and file.path :
-("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*",
-"?:\\ProgramData\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type in ("creation", "change") and
+
+ /* via RDP TSClient mounted share or SMB */
+  (process.name : "mstsc.exe" or process.pid == 4) and
 
-==== Threat mapping
+   file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+                "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,8 +76,6 @@ Menu\\Programs\\Startup\\*")
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -88,30 +84,7 @@ Menu\\Programs\\Startup\\*")
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[lateral-movement-via-startup-folder-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type in ("creation", "change") and /* via RDP
-TSClient mounted share or SMB */ (process.name : "mstsc.exe" or
-process.pid == 4) and file.path : "C:\\*\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*"
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
index 5e7841a938..55ada730e8 100644
--- a/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
@@ -5,7 +5,7 @@ An adversary can establish persistence by installing a new launch agent that exe
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,44 @@ An adversary can establish persistence by installing a new launch agent that exe
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<launch-agent-creation-or-modification-and-immediate-loading-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted applications persisting via LaunchAgent
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=1m [file where event.type !=
-"deletion" and file.path : ("/System/Library/LaunchAgents/*",
-"/Library/LaunchAgents/*", "/Users/*/Library/LaunchAgents/*") ]
-[process where event.type in ("start", "process_started") and
-process.name == "launchctl" and process.args == "load"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=1m
+ [file where host.os.type == "macos" and event.type != "deletion" and
+  file.path : ("/System/Library/LaunchAgents/*", "/Library/LaunchAgents/*", "/Users/*/Library/LaunchAgents/*")
+ ]
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "launchctl" and process.args == "load"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,25 +63,7 @@ process.name == "launchctl" and process.args == "load"]
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[launch-agent-creation-or-modification-and-immediate-loading-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [file where event.type !=
-"deletion" and file.path : ("/System/Library/LaunchAgents/*",
-"/Library/LaunchAgents/*", "/Users/*/Library/LaunchAgents/*") ]
-[process where event.type in ("start", "process_started") and
-process.name == "launchctl" and process.args == "load"]
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Launch Agent
+** ID: T1543.001
+** Reference URL: https://attack.mitre.org/techniques/T1543/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
index 7d6d6bee2a..7b2463875c 100644
--- a/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
@@ -5,7 +5,7 @@ Indicates the creation or modification of a launch daemon, which adversaries may
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,42 @@ Indicates the creation or modification of a launch daemon, which adversaries may
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<launchdaemon-creation-or-modification-and-immediate-loading-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted applications persisting via LaunchDaemons
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=1m [file where event.type !=
-"deletion" and file.path : ("/System/Library/LaunchDaemons/*",
-"/Library/LaunchDaemons/*")] [process where event.type in ("start",
-"process_started") and process.name == "launchctl" and process.args ==
-"load"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=1m
+ [file where host.os.type == "macos" and event.type != "deletion" and file.path : ("/System/Library/LaunchDaemons/*", "/Library/LaunchDaemons/*")]
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "launchctl" and process.args == "load"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,40 +61,3 @@ sequence by host.id with maxspan=1m [file where event.type !=
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[launchdaemon-creation-or-modification-and-immediate-loading-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [file where event.type !=
-"deletion" and file.path in ("/System/Library/LaunchDaemons/*",
-"/Library/LaunchDaemons/*")] [process where event.type in ("start",
-"process_started") and process.name == "launchctl" and process.args ==
-"load"]
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [file where event.type !=
-"deletion" and file.path in ("/System/Library/LaunchDaemons/*", "
-/Library/LaunchDaemons/*")] [process where event.type in ("start",
-"process_started") and process.name == "launchctl" and process.args ==
-"load"]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
new file mode 100644
index 0000000000..1aaa59dd0b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -0,0 +1,118 @@
+[[linux-group-creation]]
+=== Linux Group Creation
+
+Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-system.auth-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Linux Group Creation
+
+The `groupadd` and `addgroup` commands are used to create new user groups in Linux-based operating systems.
+
+Attackers may create new groups to maintain access to victim systems or escalate privileges by assigning a compromised account to a privileged group.
+
+This rule identifies the usages of `groupadd` and `addgroup` to create new groups.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible investigation steps
+
+- Investigate whether the group was created succesfully.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}}
+- Identify if a user account was added to this group after creation.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- Group creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Delete the created group and, in case an account was added to this group, delete the account.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+iam where host.os.type == "linux" and (event.type == "group" and event.type == "creation") and
+process.name in ("groupadd", "addgroup") and group.name != null
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
new file mode 100644
index 0000000000..911192d2fd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
@@ -0,0 +1,184 @@
+[[linux-restricted-shell-breakout-via-linux-binary-s]]
+=== Linux Restricted Shell Breakout via Linux Binary(s)
+
+Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://gtfobins.github.io/gtfobins/apt/
+* https://gtfobins.github.io/gtfobins/apt-get/
+* https://gtfobins.github.io/gtfobins/nawk/
+* https://gtfobins.github.io/gtfobins/mawk/
+* https://gtfobins.github.io/gtfobins/awk/
+* https://gtfobins.github.io/gtfobins/gawk/
+* https://gtfobins.github.io/gtfobins/busybox/
+* https://gtfobins.github.io/gtfobins/c89/
+* https://gtfobins.github.io/gtfobins/c99/
+* https://gtfobins.github.io/gtfobins/cpulimit/
+* https://gtfobins.github.io/gtfobins/crash/
+* https://gtfobins.github.io/gtfobins/env/
+* https://gtfobins.github.io/gtfobins/expect/
+* https://gtfobins.github.io/gtfobins/find/
+* https://gtfobins.github.io/gtfobins/flock/
+* https://gtfobins.github.io/gtfobins/gcc/
+* https://gtfobins.github.io/gtfobins/mysql/
+* https://gtfobins.github.io/gtfobins/nice/
+* https://gtfobins.github.io/gtfobins/ssh/
+* https://gtfobins.github.io/gtfobins/vi/
+* https://gtfobins.github.io/gtfobins/vim/
+* https://gtfobins.github.io/gtfobins/capsh/
+* https://gtfobins.github.io/gtfobins/byebug/
+* https://gtfobins.github.io/gtfobins/git/
+* https://gtfobins.github.io/gtfobins/ftp/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Shell Evasion via Linux Utilities
+Detection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or
+environments by spawning an interactive system shell.
+Here are some possible avenues of investigation:
+- Examine the entry point to the host and user in action via the Analyse View.
+  - Identify the session entry leader and session user
+- Examine the contents of session leading to the abuse via the Session View.
+  - Examine the command execution pattern in the session, which may lead to suspricous activities
+- Examine the execution of commands in the spawned shell.
+  - Identify imment threat to the system from the executed commands
+  - Take necessary incident response actions to contain any malicious behviour caused via this execution.
+
+### Related rules
+
+- A malicious spawned shell can execute any of the possible MITTRE ATT&CK vectors mainly to impair defences.
+- Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment
+
+### Response and remediation
+
+Initiate the incident response process based on the outcome of the triage.
+
+- If the triage releaved suspicious netwrok activity from the malicious spawned shell,
+  - Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware execution via the maliciously spawned shell,
+  - Search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- If the triage revelaed defence evasion for imparing defenses
+  - Isolate the involved host to prevent further post-compromise behavior.
+  - Identified the disabled security guard components on the host and take necessary steps in renebaling the same.
+  - If any tools have been disbaled / uninstalled or config tampered work towards reenabling the same.
+- If the triage revelaed addition of persistence mechanism exploit like auto start scripts
+  - Isolate further login to the systems that can initae auto start scripts.
+  - Identify the auto start scripts and disable and remove the same from the systems
+- If the triage revealed data crawling or data export via remote copy
+  - Investigate credential exposure on systems compromised / used / decoded by the attacker during the data crawling
+  - Intiate compromised credential deactivation and credential rotation process for all exposed crednetials.
+  - Investiagte if any IPR data was accessed during the data crawling and take appropriate actions.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+(
+  /* launching shell from capsh */
+  (process.name == "capsh" and process.args == "--") or
+  
+  /* launching shells from unusual parents or parent+arg combos */
+  (process.name : "*sh" and (
+    (process.parent.name : ("byebug", "ftp", "strace", "zip", "*awk", "git", "tar") and 
+    (
+      process.parent.args : "BEGIN {system(*)}" or
+      (process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or process.args : ("*PAGER*", "!*sh", "exec *sh")) or
+      (
+        (process.parent.args : "exec=*sh" or (process.parent.args : "-I" and process.parent.args : "*sh")) or
+        (process.args : "exec=*sh" or (process.args : "-I" and process.args : "*sh"))
+        )
+      )
+    ) or
+    
+    /* shells specified in parent args */
+    /* nice rule is broken in 8.2 */
+    (process.parent.args : "*sh" and
+      (
+        (process.parent.name == "nice") or
+        (process.parent.name == "cpulimit" and process.parent.args == "-f") or
+        (process.parent.name == "find" and process.parent.args == "-exec" and process.parent.args == ";" and process.parent.args == "-p") or
+        (process.parent.name == "flock" and process.parent.args == "-u" and process.parent.args == "/")
+      )
+    )
+  )) or
+
+  /* shells specified in args */
+  (process.args : "*sh" and (
+    (process.parent.name == "crash" and process.parent.args == "-h") or
+    (process.name == "sensible-pager" and process.parent.name in ("apt", "apt-get") and process.parent.args == "changelog")
+    /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */
+    
+  )) or
+  (process.name == "busybox" and event.action == "exec" and process.args_count == 2 and process.args : "*sh" and not process.executable : "/var/lib/docker/overlay2/*/merged/bin/busybox") or
+  (process.name == "env" and process.args_count == 2 and process.args : "*sh") or
+  (process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args : ":!*sh") or
+  (process.parent.name in ("c89", "c99", "gcc") and process.parent.args : "*sh,-s" and process.parent.args == "-wrapper") or
+  (process.parent.name == "expect" and process.parent.args == "-c" and process.parent.args : "spawn *sh;interact") or
+  (process.parent.name == "mysql" and process.parent.args == "-e" and process.parent.args : "\\!*sh") or
+  (process.parent.name == "ssh" and process.parent.args == "-o" and process.parent.args : "ProxyCommand=;*sh 0<&2 1>&2")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-system-information-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-system-information-discovery.asciidoc
new file mode 100644
index 0000000000..49f5eea7dd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/linux-system-information-discovery.asciidoc
@@ -0,0 +1,65 @@
+[[linux-system-information-discovery]]
+=== Linux System Information Discovery
+
+Enrich process events with uname and other command lines that imply Linux system information discovery.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type == "start" and
+(
+  process.name: "uname" or
+  (process.name: ("cat", "more", "less") and
+  process.args: ("*issue*", "*version*", "*profile*", "*services*", "*cpuinfo*"))
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
new file mode 100644
index 0000000000..84aaaa8be9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -0,0 +1,117 @@
+[[linux-user-account-creation]]
+=== Linux User Account Creation
+
+Identifies attempts to create new users. Attackers may add new users to establish persistence on a system.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-system.auth-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Linux User Account Creation
+
+The `useradd` and `adduser` commands are used to create new user accounts in Linux-based operating systems.
+
+Attackers may create new accounts (both local and domain) to maintain access to victim systems.
+
+This rule identifies the usage of `useradd` and `adduser` to create new accounts.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible investigation steps
+
+- Investigate whether the user was created succesfully.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Identify if the account was added to privileged groups or assigned special privileges after creation.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}}
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Delete the created account.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+iam where host.os.type == "linux" and (event.type == "user" and event.type == "creation") and
+process.name in ("useradd", "adduser") and user.name != null
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
new file mode 100644
index 0000000000..fac1c027cd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -0,0 +1,126 @@
+[[linux-user-added-to-privileged-group]]
+=== Linux User Added to Privileged Group
+
+Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Linux User User Added to Privileged Group
+
+The `usermod`, `adduser`, and `gpasswd` commands can be used to assign user accounts to new groups in Linux-based operating systems.
+
+Attackers may add users to a privileged group in order to escalate privileges or establish persistence on a system or domain.
+
+This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible investigation steps
+
+- Investigate whether the user was succesfully added to the privileged group.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Retrieve information about the privileged group to which the user was added.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}}
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- Adding accounts to a group is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Delete the account that seems to be involved in malicious activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+process.parent.name == "sudo" and
+process.args in ("root", "admin", "wheel", "staff", "sudo",
+                             "disk", "video", "shadow", "lxc", "lxd") and
+(
+  process.name in ("usermod", "adduser") or
+  process.name == "gpasswd" and
+  process.args in ("-a", "--add", "-M", "--members")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc
index 6d1918c626..fde30cfd03 100644
--- a/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,48 +16,47 @@ Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.stigviewer.com/stig/windows_server_2008_r2_member_server/2014-04-02/finding/V-36439
 * https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167
 * https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Privilege Escalation
-* Elastic Endgame
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Version*: 1
+*Version*: 4
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path : (
-"HKLM\\*\\LocalAccountTokenFilterPolicy",
-"\\REGISTRY\\MACHINE\\*\\LocalAccountTokenFilterPolicy") and
-registry.data.strings : ("1", "0x00000001")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+  "HKLM\\*\\LocalAccountTokenFilterPolicy",
+  "\\REGISTRY\\MACHINE\\*\\LocalAccountTokenFilterPolicy") and
+  registry.data.strings : ("1", "0x00000001")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,8 +68,6 @@ registry.data.strings : ("1", "0x00000001")
 ** Name: Modify Registry
 ** ID: T1112
 ** Reference URL: https://attack.mitre.org/techniques/T1112/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -79,3 +76,7 @@ registry.data.strings : ("1", "0x00000001")
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc
index cbf64342fc..14ee811d53 100644
--- a/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc
@@ -5,7 +5,7 @@ Indicates the creation of a scheduled task. Adversaries can use these to establi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,65 +15,54 @@ Indicates the creation of a scheduled task. Adversaries can use these to establi
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
 * https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-2
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 101 (<<local-scheduled-task-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks may be created during installation of new software.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=1m [process where event.type != "end" and
-((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe",
-"regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe", "WmiPrvSe.exe",
-"wsmprovhost.exe", "winrshost.exe") or
-process.pe.original_file_name : ("cmd.exe", "wscript.exe",
-"rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.dll", "powershell_ise.exe", "WmiPrvSe.exe",
-"wsmprovhost.exe",
-"winrshost.exe")) or process.code_signature.trusted == false)] by
-process.entity_id [process where event.type == "start" and
-(process.name : "schtasks.exe" or process.pe.original_file_name ==
-"schtasks.exe") and process.args : ("/create", "-create") and
-process.args : ("/RU", "/SC", "/TN", "/TR", "/F", "/XML") and /*
-exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM
-user */ not (?process.Ext.token.integrity_level_name : "System" or
-?winlog.event_data.IntegrityLevel : "System") ] by
-process.parent.entity_id
+[source, js]
 ----------------------------------
+sequence with maxspan=1m
+  [process where host.os.type == "windows" and event.type != "end" and
+    ((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
+                      "powershell.exe", "pwsh.exe", "powershell_ise.exe", "WmiPrvSe.exe", "wsmprovhost.exe", "winrshost.exe") or
+    process.pe.original_file_name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
+                                     "powershell.exe", "pwsh.dll", "powershell_ise.exe", "WmiPrvSe.exe", "wsmprovhost.exe",
+                                     "winrshost.exe")) or
+    process.code_signature.trusted == false)] by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and
+    (process.name : "schtasks.exe" or process.pe.original_file_name == "schtasks.exe") and
+    process.args : ("/create", "-create") and process.args : ("/RU", "/SC", "/TN", "/TR", "/F", "/XML") and
+    /* exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM user */
+    not (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System")
+  ] by process.parent.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,132 +74,7 @@ process.parent.entity_id
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[local-scheduled-task-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type != "end" and
-((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe",
-"regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe", "WmiPrvSe.exe",
-"wsmprovhost.exe", "winrshost.exe") or
-process.pe.original_file_name : ("cmd.exe", "wscript.exe",
-"rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.dll", "powershell_ise.exe", "WmiPrvSe.exe",
-"wsmprovhost.exe",
-"winrshost.exe")) or process.code_signature.trusted == false)] by
-process.entity_id [process where event.type == "start" and
-(process.name : "schtasks.exe" or process.pe.original_file_name ==
-"schtasks.exe") and process.args : ("/create", "-create") and
-process.args : ("/RU", "/SC", "/TN", "/TR", "/F", "/XML") and /*
-exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM
-user */ not (process.Ext.token.integrity_level_name : "System" or
-winlog.event_data.IntegrityLevel : "System") ] by
-process.parent.entity_id
-----------------------------------
-
-Version 10 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type != "end" and
-((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe",
-"regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe", "WmiPrvSe.exe",
-"wsmprovhost.exe", "winrshost.exe") or
-process.pe.original_file_name : ("cmd.exe", "wscript.exe",
-"rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.dll", "powershell_ise.exe", "WmiPrvSe.exe",
-"wsmprovhost.exe",
-"winrshost.exe")) or process.code_signature.trusted == false)] by
-process.entity_id [process where event.type == "start" and
-(process.name : "schtasks.exe" or process.pe.original_file_name ==
-"schtasks.exe") and process.args : ("/create", "-create") and
-process.args : ("/RU", "/SC", "/TN", "/TR", "/F", "/XML") and /*
-exclude SYSTEM SIDs - look for task creations by non-SYSTEM user */
-not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")] by
-process.parent.entity_id
-----------------------------------
-
-Version 9 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [process where event.type != "end" and
-((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe",
-"regsvr32.exe", "wmic.exe", "mshta.exe",
-"powershell.exe", "pwsh.exe", "WmiPrvSe.exe", "wsmprovhost.exe",
-"winrshost.exe") or process.pe.original_file_name : ("cmd.exe",
-"wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe",
-"mshta.exe", "powershell.exe",
-"pwsh.exe", "WmiPrvSe.exe", "wsmprovhost.exe",
-"winrshost.exe")) or process.code_signature.trusted == false)] by
-process.entity_id [process where event.type == "start" and
-(process.name : "schtasks.exe" or process.pe.original_file_name ==
-"schtasks.exe") and process.args : ("/create", "-create") and
-process.args : ("/RU", "/SC", "/TN", "/TR", "/F", "/XML") and /*
-exclude SYSTEM SIDs - look for task creations by non-SYSTEM user */
-not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")] by
-process.parent.entity_id
-----------------------------------
-
-Version 8 (7.13.0 release)::
-* Rule name changed from: Local Scheduled Task Commands
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:schtasks.exe and process.args:(-change or -create or -run
-or -s or /S or /change or /create or /run)
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:schtasks.exe and process.args:(-change or -create or -run
-or -s or /S or /change or /create or /run)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:schtasks.exe and process.args:("/create" or "-create" or
-"/S" or "-s" or "/run" or "-run" or "/change" or "-change")
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index 719f4f8438..4c1c2c4293 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -16,7 +16,7 @@ Identifies the creation of a Local Security Authority Subsystem Service (lsass.e
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -29,50 +29,94 @@ Identifies the creation of a Local Security Authority Subsystem Service (lsass.e
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 101 (<<lsass-memory-dump-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating LSASS Memory Dump Creation
+
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
+
+This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the process responsible for creating the dump file.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp",
-"SQLDmpr*.mdmp", "Coredump.dmp") and not (process.executable :
-("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe",
-"?:\\Windows\\System32\\dllhost.exe") and file.path :
-("?:\\Program Files\\Microsoft SQL
-Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp",
-"?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp")) and not
-(process.executable : "?:\\WINDOWS\\system32\\WerFault.exe" and
-file.path : "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Lo
-cal\\CrashDumps\\lsass.exe.*.dmp")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") and
+
+ not (process.executable : ("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe", "?:\\Windows\\System32\\dllhost.exe") and
+      file.path : ("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp",
+                   "?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp")) and
 
-==== Threat mapping
+ not (process.executable : "?:\\WINDOWS\\system32\\WerFault.exe" and
+      file.path : "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\lsass.exe.*.dmp")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,46 +128,7 @@ cal\\CrashDumps\\lsass.exe.*.dmp")
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[lsass-memory-dump-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp",
-"SQLDmpr*.mdmp", "Coredump.dmp")
-----------------------------------
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and file.name:(lsass.DMP or lsass*.dmp or
-dumpert.dmp or Andrew.dmp or SQLDmpr*.mdmp or Coredump.dmp)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index a2b84fe3bf..586a578425 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -9,12 +9,13 @@ Identifies handle requests for the Local Security Authority Subsystem Service (L
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -31,74 +32,61 @@ Identifies handle requests for the Local Security Authority Subsystem Service (L
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<lsass-memory-dump-handle-access-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 108
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating LSASS Memory Dump Handle Access
 
-Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible
-for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles
-password changes, and creates access tokens.
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
 
-Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on,the system
-generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single
-sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be
-harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using
-[alternate authentication material](https://attack.mitre.org/techniques/T1550/).
+Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
 
-- There should be very few or no false positives for this rule. If this activity is expected or noisy in your environment,
-consider adding exceptions — preferably with a combination of user and command line conditions.
-- If the process is related to antivirus or endpoint detection and response solutions, validate that it is installed on
-the correct path and signed with the company's valid digital signature.
+- There should be very few or no false positives for this rule. If this activity is expected or noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If the process is related to antivirus or endpoint detection and response solutions, validate that it is installed on the correct path and signed with the company's valid digital signature.
 
 ### Response and remediation
 
@@ -109,17 +97,12 @@ the correct path and signed with the company's valid digital signature.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 Ensure advanced audit policies for Windows are enabled, specifically:
 Object Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested)
@@ -141,33 +124,36 @@ Also, this event generates only if the object’s [SACL](https://docs.microsoft.
 If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 any where event.action == "File System" and event.code == "4656" and
-winlog.event_data.ObjectName : (
-"?:\\Windows\\System32\\lsass.exe",
-"\\Device\\HarddiskVolume?\\Windows\\System32\\lsass.exe",
-"\\Device\\HarddiskVolume??\\Windows\\System32\\lsass.exe") and
-/* The right to perform an operation controlled by an extended access
-right. */ (winlog.event_data.AccessMask : ("0x1fffff" , "0x1010",
-"0x120089", "0x1F3FFF") or
-winlog.event_data.AccessMaskDescription : ("READ_CONTROL", "Read from
-process memory")) /* Common Noisy False Positives */ and
-not winlog.event_data.ProcessName : ( "?:\\Program
-Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\system32\\wbem\\WmiPrvSE.exe",
-"?:\\Windows\\System32\\dllhost.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\msiexec.exe",
-"?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
-"?:\\Windows\\explorer.exe")
-----------------------------------
 
-==== Threat mapping
+    winlog.event_data.ObjectName : (
+        "?:\\Windows\\System32\\lsass.exe",
+        "\\Device\\HarddiskVolume?\\Windows\\System32\\lsass.exe",
+        "\\Device\\HarddiskVolume??\\Windows\\System32\\lsass.exe") and
+
+    /* The right to perform an operation controlled by an extended access right. */
+
+    (winlog.event_data.AccessMask : ("0x1fffff" , "0x1010", "0x120089", "0x1F3FFF") or
+     winlog.event_data.AccessMaskDescription : ("READ_CONTROL", "Read from process memory"))
+
+     /* Common Noisy False Positives */
+
+    and not winlog.event_data.ProcessName : (
+        "?:\\Program Files\\*.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Windows\\system32\\wbem\\WmiPrvSE.exe",
+        "?:\\Windows\\System32\\dllhost.exe",
+        "?:\\Windows\\System32\\svchost.exe",
+        "?:\\Windows\\System32\\msiexec.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+        "?:\\Windows\\explorer.exe")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -179,19 +165,7 @@ Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[lsass-memory-dump-handle-access-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
new file mode 100644
index 0000000000..a2d14a4441
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
@@ -0,0 +1,65 @@
+[[lsass-process-access-via-windows-api]]
+=== LSASS Process Access via Windows API
+
+Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+api where host.os.type == "windows" and 
+ process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
index c32107bae5..ba66525f59 100644
--- a/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
@@ -5,7 +5,7 @@ Detects the execution of a MacOS installer package with an abnormal child proces
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,55 +13,45 @@ Detects the execution of a MacOS installer package with an abnormal child proces
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://redcanary.com/blog/clipping-silver-sparrows-wings
 * https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520
 * https://github.com/D00MFist/Mystikal
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Execution
-* Command and Control
-
-*Version*: 100 (<<macos-installer-package-spawns-network-event-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Custom organization-specific macOS packages that use .pkg files to run cURL could trigger this rule. If known behavior is causing false positives, it can be excluded from the rule.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, user.id with maxspan=30s [process where
-event.type == "start" and event.action == "exec" and
-process.parent.name : ("installer", "package_script_service") and
-process.name : ("bash", "sh", "zsh", "python", "osascript", "tclsh*")]
-[network where event.type == "start" and process.name : ("curl",
-"osascript", "wget", "python")]
+[source, js]
 ----------------------------------
+sequence by host.id, user.id with maxspan=30s
+[process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and process.parent.name : ("installer", "package_script_service") and process.name : ("bash", "sh", "zsh", "python", "osascript", "tclsh*")]
+[network where host.os.type == "macos" and event.type == "start" and process.name : ("curl", "osascript", "wget", "python")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,8 +63,10 @@ process.name : ("bash", "sh", "zsh", "python", "osascript", "tclsh*")]
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
+* Sub-technique:
+** Name: JavaScript
+** ID: T1059.007
+** Reference URL: https://attack.mitre.org/techniques/T1059/007/
 * Tactic:
 ** Name: Command and Control
 ** ID: TA0011
@@ -83,62 +75,7 @@ process.name : ("bash", "sh", "zsh", "python", "osascript", "tclsh*")]
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[macos-installer-package-spawns-network-event-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, user.id with maxspan=30s [process where
-event.type == "start" and event.action == "exec" and
-process.parent.name : ("installer", "package_script_service") and
-process.name : ("bash", "sh", "zsh", "python", "osascript", "tclsh*")]
-[network where event.type == "start" and process.name : ("curl",
-"osascript", "wget", "python")]
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Rule name changed from: macOS Installer Spawns Network Event
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [process where
-event.type == "start" and host.os.family == "macos" and
-process.parent.executable in ("/usr/sbin/installer",
-"/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer")
-] [network where not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
-"192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
-"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.15.0 release)::
-* Formatting only
-
-Version 2 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [ process where
-event.type == "start" and host.os.family == "macos" and
-process.parent.executable in ("/usr/sbin/installer",
-"/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer")
-] [ network where not cidrmatch(destination.ip,
-"192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12",
-"224.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16",
-"::1", "FE80::/10", "FF00::/8") ]
-----------------------------------
-
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/malware-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/malware-detected-elastic-endgame.asciidoc
index 251a1ae211..1acb6bb2af 100644
--- a/docs/detections/prebuilt-rules/rule-details/malware-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/malware-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.mo
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,67 +13,32 @@ Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.mo
 
 *Risk score*: 99
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 100 (<<malware-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and
-(event.action:file_classification_event or
-endgame.event_subtype_full:file_classification_event)
-----------------------------------
-
-
-[[malware-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
 
-Version 7 (8.0.0 release)::
-* Formatting only
+==== Rule query
 
-Version 6 (7.12.1 release)::
-* Formatting only
 
-Version 5 (7.12.0 release)::
-* Rule name changed from: Malware - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Malware - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Malware - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:file_classification_event and
-endgame.metadata.type:detection
-----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/malware-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/malware-prevented-elastic-endgame.asciidoc
index 0fbf8d6b8b..27dc8cab14 100644
--- a/docs/detections/prebuilt-rules/rule-details/malware-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/malware-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.m
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,67 +13,32 @@ Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.m
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 100 (<<malware-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and
-(event.action:file_classification_event or
-endgame.event_subtype_full:file_classification_event)
-----------------------------------
-
-
-[[malware-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
 
-Version 7 (8.0.0 release)::
-* Formatting only
+==== Rule query
 
-Version 6 (7.12.1 release)::
-* Formatting only
 
-Version 5 (7.12.0 release)::
-* Rule name changed from: Malware - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Malware - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Malware - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:file_classification_event and
-endgame.metadata.type:prevention
-----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:file_classification_event or endgame.event_subtype_full:file_classification_event)
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc b/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc
index 5e0b5c7c3a..bc5f54ca8a 100644
--- a/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc
@@ -5,7 +5,7 @@ This rules identifies a process created from an executable with a space appended
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,53 +14,52 @@ This rules identifies a process created from an executable with a space appended
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1036-masquerading
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Defense Evasion
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Version*: 1
+*Version*: 3
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where host.os.type:("linux","macos") and event.type ==
-"start" and (process.executable regex~ """/[a-z0-9\s_\-\\./]+\s""")
-and not process.name in ("ls", "find", "grep", "xkbcomp")
+[source, js]
 ----------------------------------
+process where host.os.type:("linux","macos") and
+  event.type == "start" and
+  (process.executable regex~ """/[a-z0-9\s_\-\\./]+\s""") and not
+  process.name in ("ls", "find", "grep", "xkbcomp")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,3 +71,7 @@ and not process.name in ("ls", "find", "grep", "xkbcomp")
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Space after Filename
+** ID: T1036.006
+** Reference URL: https://attack.mitre.org/techniques/T1036/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc b/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc
index 69802426a9..484eced8d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc
@@ -5,7 +5,7 @@ Detects when multi-factor authentication (MFA) is disabled for a Google Workspac
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-google_workspace*
@@ -14,41 +14,79 @@ Detects when multi-factor authentication (MFA) is disabled for a Google Workspac
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Persistence
+*Tags*: 
 
-*Version*: 101 (<<mfa-disabled-for-google-workspace-organization-history, version history>>)
+* Domain: Cloud
+* Data Source: Google Workspace
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 205
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-MFA settings may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating MFA Disabled for Google Workspace Organization
+
+Multi-factor authentication (MFA) is a process in which users are prompted for an additional form of identification, such as a code on their cell phone or a fingerprint scan, during the sign-in process.
+
+If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the users's password is weak or has been exposed elsewhere, an attacker could use it to gain access. Requiring a second form of authentication increases security because attackers cannot easily obtain or duplicate the additional authentication factor.
+
+For more information about using MFA in Google Workspace, access the [official documentation](https://support.google.com/a/answer/175197).
+
+This rule identifies when MFA enforcement is turned off in Google Workspace. This modification weakens account security and can lead to accounts and other assets being compromised.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account and resource owners and confirm whether they are aware of this activity.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+### False positive analysis
+
+- While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Reactivate the multi-factor authentication enforcement.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
 ### Important Information Regarding Google Workspace Event Lag Times
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -59,19 +97,14 @@ MFA settings may be modified by system administrators. Verify that the configura
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:google_workspace.admin and event.provider:admin and
-event.category:iam and event.action:(ENFORCE_STRONG_AUTHENTICATION or
-ALLOW_STRONG_AUTHENTICATION) and
-google_workspace.admin.new_value:false
+[source, js]
 ----------------------------------
+event.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION) and google_workspace.admin.new_value:false
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,57 +116,3 @@ google_workspace.admin.new_value:false
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[mfa-disabled-for-google-workspace-organization-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 15 (8.4.0 release)::
-* Formatting only
-
-Version 13 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:(ENFORCE_STRONG_AUTHENTICATION or
-ALLOW_STRONG_AUTHENTICATION) and (gsuite.admin.new_value:false or
-google_workspace.admin.new_value:false)
-----------------------------------
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(gsuite.admin or google_workspace.admin) and
-event.provider:admin and event.category:iam and
-event.action:(ENFORCE_STRONG_AUTHENTICATION or
-ALLOW_STRONG_AUTHENTICATION) and gsuite.admin.new_value:false
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
index d8d37a3b7b..c098901fb1 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of an anti-phishing policy in Microsoft 365. By default,
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies the deletion of an anti-phishing policy in Microsoft 365. By default,
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-antiphishpolicy?view=exchange-ps
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-anti-phish-policy-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An anti-phishing policy may be deleted by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"Remove-AntiPhishPolicy" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Remove-AntiPhishPolicy" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +68,3 @@ event.outcome:success
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[microsoft-365-exchange-anti-phish-policy-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
index e29aaf213e..d51d280a0f 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies the modification of an anti-phishing rule in Microsoft 365. By defaul
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies the modification of an anti-phishing rule in Microsoft 365. By defaul
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-antiphishrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/powershell/module/exchange/disable-antiphishrule?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-anti-phish-rule-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-An anti-phishing rule may be deleted by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:("Remove-AntiPhishRule" or
-"Disable-AntiPhishRule") and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Remove-AntiPhishRule" or "Disable-AntiPhishRule") and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +68,3 @@ event.category:web and event.action:("Remove-AntiPhishRule" or
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[microsoft-365-exchange-anti-phish-rule-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
index ee1941f9cc..ea42c677f4 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is dis
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,47 @@ Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is dis
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/set-dkimsigningconfig?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Data Protection
-* Persistence
-
-*Version*: 101 (<<microsoft-365-exchange-dkim-signing-configuration-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Disabling a DKIM configuration may be done by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"Set-DkimSigningConfig" and
-o365.audit.Parameters.Enabled:False and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Set-DkimSigningConfig" and o365.audit.Parameters.Enabled:False and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,31 +66,3 @@ o365.audit.Parameters.Enabled:False and event.outcome:success
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[microsoft-365-exchange-dkim-signing-configuration-disabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
index 9dee46c467..949038eb11 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
@@ -5,7 +5,7 @@ Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-dlppolicy?view=exchange-ps
 * https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-dlp-policy-removed-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A DLP policy may be removed by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"Remove-DlpPolicy" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Remove-DlpPolicy" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +68,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[microsoft-365-exchange-dlp-policy-removed-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
index 4635cbb02e..69d56d7382 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies when a malware filter policy has been deleted in Microsoft 365. A mal
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,59 +14,48 @@ Identifies when a malware filter policy has been deleted in Microsoft 365. A mal
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterpolicy?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-malware-filter-policy-deletion-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A malware filter policy may be deleted by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"Remove-MalwareFilterPolicy" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Remove-MalwareFilterPolicy" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,28 +67,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[microsoft-365-exchange-malware-filter-policy-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
index 3cad8baef0..b1f37a4811 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when a malware filter rule has been deleted or disabled in Microsoft
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies when a malware filter rule has been deleted or disabled in Microsoft
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/powershell/module/exchange/disable-malwarefilterrule?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-malware-filter-rule-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A malware filter rule may be deleted by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:("Remove-MalwareFilterRule" or
-"Disable-MalwareFilterRule") and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Remove-MalwareFilterRule" or "Disable-MalwareFilterRule") and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +68,3 @@ event.category:web and event.action:("Remove-MalwareFilterRule" or
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[microsoft-365-exchange-malware-filter-rule-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
index e6577a99b2..9630309c83 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
@@ -5,7 +5,7 @@ Identifies when a new role is assigned to a management group in Microsoft 365. A
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies when a new role is assigned to a management group in Microsoft 365. A
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
 * https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<microsoft-365-exchange-management-group-role-assignment-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A new role may be assigned to a management group by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"New-ManagementRoleAssignment" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"New-ManagementRoleAssignment" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +68,3 @@ event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[microsoft-365-exchange-management-group-role-assignment-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
index f27d9fcbcd..95d5b855b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attach
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,59 +14,48 @@ Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attach
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safeattachmentrule?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-safe-attachment-rule-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A safe attachment rule may be disabled by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"Disable-SafeAttachmentRule" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Disable-SafeAttachmentRule" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,28 +67,3 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[microsoft-365-exchange-safe-attachment-rule-disabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
index 8b5cb245f1..e6f1cbbc17 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link polic
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link polic
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safelinksrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-safe-links?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<microsoft-365-exchange-safe-link-policy-disabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Disabling safe links may be done by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"Disable-SafeLinksRule" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Disable-SafeLinksRule" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +68,3 @@ event.outcome:success
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[microsoft-365-exchange-safe-link-policy-disabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
index 21d773e2eb..f4259ae208 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies a transport rule creation in Microsoft 365. As a best practice, Excha
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies a transport rule creation in Microsoft 365. As a best practice, Excha
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-transport-rule-creation-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Exfiltration
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A new transport rule may be created by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"New-TransportRule" and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"New-TransportRule" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,31 +68,3 @@ event.outcome:success
 ** Name: Transfer Data to Cloud Account
 ** ID: T1537
 ** Reference URL: https://attack.mitre.org/techniques/T1537/
-
-[[microsoft-365-exchange-transport-rule-creation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
index 2b0bd352c1..b1f7aa2c42 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies when a transport rule has been disabled or deleted in Microsoft 365.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,61 +14,50 @@ Identifies when a transport rule has been disabled or deleted in Microsoft 365.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-transportrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/powershell/module/exchange/disable-transportrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-exchange-transport-rule-modification-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Exfiltration
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A transport rule may be modified by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:("Remove-TransportRule" or
-"Disable-TransportRule") and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Remove-TransportRule" or "Disable-TransportRule") and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,28 +69,3 @@ event.category:web and event.action:("Remove-TransportRule" or
 ** Name: Transfer Data to Cloud Account
 ** ID: T1537
 ** Reference URL: https://attack.mitre.org/techniques/T1537/
-
-[[microsoft-365-exchange-transport-rule-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
index bf44ec9867..e8fd851fb0 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
@@ -5,7 +5,7 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,56 +14,49 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#global-administrator
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<microsoft-365-global-administrator-role-assigned-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.code:"AzureActiveDirectory" and
-event.action:"Add member to role." and
-o365.audit.ModifiedProperties.Role_DisplayName.NewValue:"Global
-Administrator"
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.code:"AzureActiveDirectory" and event.action:"Add member to role." and
+o365.audit.ModifiedProperties.Role_DisplayName.NewValue:"Global Administrator"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,19 +68,7 @@ Administrator"
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[microsoft-365-global-administrator-role-assigned-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Additional Cloud Roles
+** ID: T1098.003
+** Reference URL: https://attack.mitre.org/techniques/T1098/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc
new file mode 100644
index 0000000000..390bc634a2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc
@@ -0,0 +1,70 @@
+[[microsoft-365-impossible-travel-activity]]
+=== Microsoft 365 Impossible travel activity
+
+Identifies when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
+* https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Impossible travel activity" and event.outcome:success
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
index 65d5201dcb..5f7d1fdf59 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
@@ -5,7 +5,7 @@ Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox r
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,64 +14,60 @@ Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox r
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide
 * https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack?view=o365-worldwide
 * https://raw.githubusercontent.com/PwC-IR/Business-Email-Compromise-Guide/main/Extractor%20Cheat%20Sheet.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-inbox-forwarding-rule-created-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Collection
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Gary Blackwell, Austin Songer
+* Elastic
+* Gary Blackwell
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Users and Administrators can create inbox rules for legitimate purposes. Verify if it complies with the company policy and done with the user's consent. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:("New-InboxRule" or "Set-
-InboxRule") and ( o365.audit.Parameters.ForwardTo:* or
-o365.audit.Parameters.ForwardAsAttachmentTo:* or
-o365.audit.Parameters.RedirectTo:* ) and event.outcome:success
-----------------------------------
+event.category:web and event.action:("New-InboxRule" or "Set-InboxRule") and
+    (
+        o365.audit.Parameters.ForwardTo:* or
+        o365.audit.Parameters.ForwardAsAttachmentTo:* or
+        o365.audit.Parameters.RedirectTo:*
+    )
+    and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,62 +79,7 @@ o365.audit.Parameters.RedirectTo:* ) and event.outcome:success
 ** Name: Email Collection
 ** ID: T1114
 ** Reference URL: https://attack.mitre.org/techniques/T1114/
-
-[[microsoft-365-inbox-forwarding-rule-created-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"New-InboxRule" and (
-o365.audit.Parameters.ForwardTo:* or
-o365.audit.Parameters.ForwardAsAttachmentTo:* or
-o365.audit.Parameters.RedirectTo:* ) and event.outcome:success
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"New-InboxRule" and (
-o365.audit.Parameters.ForwardTo:* or
-o365.audit.Parameters.ForwardAsAttachmentTo:* or
-o365.audit.Parameters.RedirectTo:* ) and
-event.outcome:success
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"New-InboxRule" and (
-o365audit.Parameters.ForwardTo:* or
-o365audit.Parameters.ForwardAsAttachmentTo:* or
-o365audit.Parameters.RedirectTo:* ) and event.outcome:success
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Rule name changed from: Microsoft 365 New Inbox Rule Created
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:"New-InboxRule" and
-event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Email Forwarding Rule
+** ID: T1114.003
+** Reference URL: https://attack.mitre.org/techniques/T1114/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc
new file mode 100644
index 0000000000..129e35eb1b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc
@@ -0,0 +1,66 @@
+[[microsoft-365-mass-download-by-a-single-user]]
+=== Microsoft 365 Mass download by a single user
+
+Identifies when Microsoft Cloud App Security reports that a single user performs more than 50 downloads within 1 minute.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
+* https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Mass download by a single user" and event.outcome:success
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
index 05b3582ddd..6e6a08e29d 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
@@ -5,7 +5,7 @@ Identifies when Microsoft Cloud App Security reports that a user has uploaded fi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies when Microsoft Cloud App Security reports that a user has uploaded fi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
 * https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Impact
 
-*Version*: 101 (<<microsoft-365-potential-ransomware-activity-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-If Cloud App Security identifies, for example, a high rate of file uploads or file deletion activities it may represent an adverse encryption process.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:SecurityComplianceCenter
-and event.category:web and event.action:"Potential ransomware
-activity" and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Potential ransomware activity" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,22 +68,3 @@ activity" and event.outcome:success
 ** Name: Data Encrypted for Impact
 ** ID: T1486
 ** Reference URL: https://attack.mitre.org/techniques/T1486/
-
-[[microsoft-365-potential-ransomware-activity-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
index c24304ab39..8526d4f0ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
@@ -5,7 +5,7 @@ Identifies when custom applications are allowed in Microsoft Teams. If an organi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,61 +14,51 @@ Identifies when custom applications are allowed in Microsoft Teams. If an organi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/apps-upload
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-* Persistence
-
-*Version*: 101 (<<microsoft-365-teams-custom-application-interaction-allowed-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Custom applications may be allowed by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.dataset:o365.audit and event.provider:MicrosoftTeams and
 event.category:web and event.action:TeamsTenantSettingChanged and
 o365.audit.Name:"Allow sideloading and interaction of custom apps" and
 o365.audit.NewValue:True and event.outcome:success
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,28 +66,3 @@ o365.audit.NewValue:True and event.outcome:success
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[microsoft-365-teams-custom-application-interaction-allowed-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
index d0ed2eb9c1..8eb262a597 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when external access is enabled in Microsoft Teams. External access l
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,61 +14,50 @@ Identifies when external access is enabled in Microsoft Teams. External access l
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/microsoftteams/manage-external-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-teams-external-access-enabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Teams external access may be enabled by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(SkypeForBusiness or
-MicrosoftTeams) and event.category:web and event.action:"Set-
-CsTenantFederationConfiguration" and
-o365.audit.Parameters.AllowFederatedUsers:True and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:(SkypeForBusiness or MicrosoftTeams) and
+event.category:web and event.action:"Set-CsTenantFederationConfiguration" and
+o365.audit.Parameters.AllowFederatedUsers:True and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,28 +69,3 @@ event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[microsoft-365-teams-external-access-enabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
index 62391ca65f..4b30b8b6f1 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
@@ -5,7 +5,7 @@ Identifies when guest access is enabled in Microsoft Teams. Guest access in Team
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,50 @@ Identifies when guest access is enabled in Microsoft Teams. Guest access in Team
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/skype/get-csteamsclientconfiguration?view=skype-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<microsoft-365-teams-guest-access-enabled-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Teams guest access may be enabled by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-event.dataset:o365.audit and event.provider:(SkypeForBusiness or
-MicrosoftTeams) and event.category:web and event.action:"Set-
-CsTeamsClientConfiguration" and
+event.dataset:o365.audit and event.provider:(SkypeForBusiness or MicrosoftTeams) and
+event.category:web and event.action:"Set-CsTeamsClientConfiguration" and
 o365.audit.Parameters.AllowGuestUser:True and event.outcome:success
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,28 +69,3 @@ o365.audit.Parameters.AllowGuestUser:True and event.outcome:success
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[microsoft-365-teams-guest-access-enabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
index 2f471fa52d..9a0d3d39ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
@@ -5,7 +5,7 @@ Identifies that a user has deleted an unusually large volume of files as reporte
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies that a user has deleted an unusually large volume of files as reporte
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
 * https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Impact
 
-*Version*: 101 (<<microsoft-365-unusual-volume-of-file-deletion-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Users or System Administrator cleaning out folders.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:SecurityComplianceCenter
-and event.category:web and event.action:"Unusual volume of file
-deletion" and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Unusual volume of file deletion" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,19 +68,3 @@ deletion" and event.outcome:success
 ** Name: Data Destruction
 ** ID: T1485
 ** Reference URL: https://attack.mitre.org/techniques/T1485/
-
-[[microsoft-365-unusual-volume-of-file-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
index 6bab47e5ab..bd62a33794 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
@@ -5,7 +5,7 @@ Identifies when a user has been restricted from sending email due to exceeding s
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,60 +14,49 @@ Identifies when a user has been restricted from sending email due to exceeding s
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
 * https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Initial Access
 
-*Version*: 101 (<<microsoft-365-user-restricted-from-sending-email-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A user sending emails using personal distribution folders may trigger the event.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:SecurityComplianceCenter
-and event.category:web and event.action:"User restricted from sending
-email" and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"User restricted from sending email" and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,19 +68,3 @@ email" and event.outcome:success
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[microsoft-365-user-restricted-from-sending-email-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
index 7982dd9823..58887ad32c 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
@@ -5,7 +5,7 @@ An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,59 +16,51 @@ An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<microsoft-build-engine-started-an-unusual-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. If a build system triggers this rule it can be exempted by process, user or host name.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"MSBuild.exe" and process.name : ("csc.exe", "iexplore.exe",
-"powershell.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "MSBuild.exe" and
+  process.name : ("csc.exe", "iexplore.exe", "powershell.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,60 +72,7 @@ process where event.type == "start" and process.parent.name :
 ** Name: Obfuscated Files or Information
 ** ID: T1027
 ** Reference URL: https://attack.mitre.org/techniques/T1027/
-
-[[microsoft-build-engine-started-an-unusual-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "MSBuild.exe" and process.name : ("csc.exe",
-"iexplore.exe", "powershell.exe")
-----------------------------------
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.2.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:MSBuild.exe and process.name:(csc.exe or
-iexplore.exe or powershell.exe)
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.parent.name:MSBuild.exe and process.name:(csc.exe or
-iexplore.exe or powershell.exe)
-----------------------------------
-
+* Sub-technique:
+** Name: Compile After Delivery
+** ID: T1027.004
+** Reference URL: https://attack.mitre.org/techniques/T1027/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
index 3c7a4b4183..d1678bb1af 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
@@ -5,7 +5,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by a script or t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,49 @@ An instance of MSBuild, the Microsoft Build Engine, was started by a script or t
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<microsoft-build-engine-started-by-a-script-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe") and
-process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe",
-"powershell_ise.exe", "cscript.exe", "wscript.exe", "mshta.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe") and
+  process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "cscript.exe", "wscript.exe", "mshta.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,71 +70,11 @@ process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe",
 ** Name: Trusted Developer Utilities Proxy Execution
 ** ID: T1127
 ** Reference URL: https://attack.mitre.org/techniques/T1127/
-
-
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-[[microsoft-build-engine-started-by-a-script-process-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe") and
-process.parent.name : ("cmd.exe", "powershell.exe", "cscript.exe",
-"wscript.exe", "mshta.exe")
-----------------------------------
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type: start and
-process.name:MSBuild.exe and process.parent.name:(cmd.exe or
-powershell.exe or cscript.exe or wscript.exe)
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:MSBuild.exe and process.parent.name:(cmd.exe or
-powershell.exe or cscript.exe or wscript.exe) and
-event.action:"Process Create (rule: ProcessCreate)"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
index 99bc69557f..0e780ae3e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
@@ -5,7 +5,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,54 +16,49 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or t
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<microsoft-build-engine-started-by-a-system-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "MSBuild.exe"
-and process.parent.name : ("explorer.exe", "wmiprvse.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "MSBuild.exe" and
+  process.parent.name : ("explorer.exe", "wmiprvse.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,69 +70,11 @@ and process.parent.name : ("explorer.exe", "wmiprvse.exe")
 ** Name: Trusted Developer Utilities Proxy Execution
 ** ID: T1127
 ** Reference URL: https://attack.mitre.org/techniques/T1127/
-
-
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-[[microsoft-build-engine-started-by-a-system-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "MSBuild.exe" and process.parent.name :
-("explorer.exe", "wmiprvse.exe")
-----------------------------------
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:MSBuild.exe and process.parent.name:(explorer.exe or
-wmiprvse.exe)
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:MSBuild.exe and process.parent.name:(explorer.exe or
-wmiprvse.exe) and event.action:"Process Create (rule: ProcessCreate)"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
index 4d7a157821..06e793b0c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
@@ -5,7 +5,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,70 +16,55 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<microsoft-build-engine-started-by-an-office-application-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. It is quite unusual for this program to be started by an Office application like Word or Excel.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Microsoft Build Engine Started by an Office Application
 
-Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer.
-You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create
-presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted
-for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
 
-The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML
-schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy
-execution of code.
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
 
-This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. This is generally the result of the
-execution of malicious documents.
+This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. This is generally the result of the execution of malicious documents.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include,
-but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
 - Determine if the collected files are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -98,43 +83,40 @@ but are not limited to, the Downloads and Document folders and the folder config
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
   - If the malicious file was delivered via phishing:
     - Block the email sender from sending future emails.
     - Block the malicious web pages.
     - Remove emails from the sender from mailboxes.
     - Consider improvements to the security awareness program.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "MSBuild.exe"
-and process.parent.name : ("eqnedt32.exe",
-"excel.exe", "fltldr.exe",
-"msaccess.exe", "mspub.exe",
-"outlook.exe", "powerpnt.exe",
-"winword.exe" )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "MSBuild.exe" and
+  process.parent.name : ("eqnedt32.exe",
+                         "excel.exe",
+                         "fltldr.exe",
+                         "msaccess.exe",
+                         "mspub.exe",
+                         "outlook.exe",
+                         "powerpnt.exe",
+                         "winword.exe" )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -146,75 +128,11 @@ and process.parent.name : ("eqnedt32.exe",
 ** Name: Trusted Developer Utilities Proxy Execution
 ** ID: T1127
 ** Reference URL: https://attack.mitre.org/techniques/T1127/
-
-
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-[[microsoft-build-engine-started-by-an-office-application-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "MSBuild.exe" and process.parent.name :
-("eqnedt32.exe", "excel.exe",
-"fltldr.exe", "msaccess.exe",
-"mspub.exe", "outlook.exe",
-"powerpnt.exe", "winword.exe" )
-----------------------------------
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:MSBuild.exe and process.parent.name:(eqnedt32.exe or
-excel.exe or fltldr.exe or msaccess.exe or mspub.exe or outlook.exe or
-powerpnt.exe or winword.exe)
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:MSBuild.exe and process.parent.name:(eqnedt32.exe or
-excel.exe or fltldr.exe or msaccess.exe or mspub.exe or outlook.exe or
-powerpnt.exe or winword.exe) and event.action: "Process Create (rule:
-ProcessCreate)"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 259125a243..25f12de246 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -16,55 +16,98 @@ An instance of MSBuild, the Microsoft Build Engine, was started after being rena
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<microsoft-build-engine-using-an-alternate-name-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Microsoft Build Engine Using an Alternate Name
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
+
+This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-process.pe.original_file_name == "MSBuild.exe" and not process.name
-: "MSBuild.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name == "MSBuild.exe" and
+  not process.name : "MSBuild.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,80 +119,7 @@ process.pe.original_file_name == "MSBuild.exe" and not process.name
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[microsoft-build-engine-using-an-alternate-name-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name == "MSBuild.exe" and not process.name
-: "MSBuild.exe"
-----------------------------------
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.pe.original_file_name:MSBuild.exe and not process.name:
-MSBuild.exe
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.pe.original_file_name:MSBuild.exe or
-winlog.event_data.OriginalFileName:MSBuild.exe) and not process.name:
-MSBuild.exe
-----------------------------------
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(pe.original_file_name:MSBuild.exe or
-winlog.event_data.OriginalFileName:MSBuild.exe) and not process.name:
-MSBuild.exe
-----------------------------------
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-(pe.original_file_name:MSBuild.exe or
-winlog.event_data.OriginalFileName: MSBuild.exe) and not process.name:
-MSBuild.exe and event.action: "Process Create (rule: ProcessCreate)"
-----------------------------------
-
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
index c4c9089cea..3107748e44 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
@@ -5,74 +5,70 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server U
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
 * https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-
-*Version*: 100 (<<microsoft-exchange-server-um-spawning-suspicious-processes-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate processes may be spawned from the Microsoft Exchange Server Unified Messaging (UM) service. If known processes are causing false positives, they can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("UMService.exe", "UMWorkerProcess.exe") and not
-process.executable :
-("?:\\Windows\\System32\\werfault.exe",
-"?:\\Windows\\System32\\wermgr.exe", "?:\\Program
-Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
-"D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
-"E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("UMService.exe", "UMWorkerProcess.exe") and
+    not process.executable :
+              ("?:\\Windows\\System32\\werfault.exe",
+               "?:\\Windows\\System32\\wermgr.exe",
+               "?:\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
+               "D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
+               "E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,23 +80,3 @@ Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[microsoft-exchange-server-um-spawning-suspicious-processes-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("UMService.exe", "UMWorkerProcess.exe") and not process.name :
-("werfault.exe", "wermgr.exe")
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
index 59988980f8..0e8e5b3fab 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
@@ -5,54 +5,51 @@ Identifies suspicious files being written by the Microsoft Exchange Server Unifi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
 * https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-
-*Version*: 100 (<<microsoft-exchange-server-um-writing-suspicious-files-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Files generated during installation will generate a lot of noise, so the rule should only be enabled after the fact.
-This rule was tuned using the following baseline: https://raw.githubusercontent.com/microsoft/CSS-Exchange/main/Security/Baselines/baseline_15.2.792.5.csv from Microsoft. Depending on version, consult https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines to help determine normalcy.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -63,29 +60,27 @@ from existing intrusions. Other tools for detecting and mitigating can be found
 [repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "creation" and process.name :
-("UMWorkerProcess.exe", "umservice.exe") and file.extension :
-("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and (
-file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*" or
-(file.path : "?:\\*\\Microsoft\\Exchange
-Server*\\FrontEnd\\HttpProxy\\owa\\auth\\*" and not (file.path
-: "?:\\*\\Microsoft\\Exchange
-Server*\\FrontEnd\\HttpProxy\\owa\\auth\\version\\*" or
-file.name : ("errorFE.aspx", "expiredpassword.aspx", "frowny.aspx",
-"GetIdToken.htm", "logoff.aspx", "logon.aspx",
-"OutlookCN.aspx", "RedirSuiteServiceProxy.aspx", "signout.aspx"))) or
-(file.path : "?:\\*\\Microsoft\\Exchange
-Server*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
-"TimeoutLogoff.aspx") )
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+  process.name : ("UMWorkerProcess.exe", "umservice.exe") and
+  file.extension : ("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and
+  (
+    file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*" or
+
+    (file.path : "?:\\*\\Microsoft\\Exchange Server*\\FrontEnd\\HttpProxy\\owa\\auth\\*" and
+       not (file.path : "?:\\*\\Microsoft\\Exchange Server*\\FrontEnd\\HttpProxy\\owa\\auth\\version\\*" or
+            file.name : ("errorFE.aspx", "expiredpassword.aspx", "frowny.aspx", "GetIdToken.htm", "logoff.aspx",
+                        "logon.aspx", "OutlookCN.aspx", "RedirSuiteServiceProxy.aspx", "signout.aspx"))) or
 
-==== Threat mapping
+    (file.path : "?:\\*\\Microsoft\\Exchange Server*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and
+       not file.name : "TimeoutLogoff.aspx")
+  )
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -97,30 +92,3 @@ Server*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[microsoft-exchange-server-um-writing-suspicious-files-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "creation" and process.parent.name :
-("UMWorkerProcess.exe", "umservice.exe") and file.extension :
-("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and (
-file.path : ("C:\\inetpub\\wwwroot\\aspnet_client\\*",
-"C:\\*\\FrontEnd\\HttpProxy\\owa\\auth\\*") or (file.path :
-"C:\\*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
-"TimeoutLogoff.aspx") )
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
index 4e20123792..48a9b0c751 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
@@ -5,68 +5,65 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server w
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
 * https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
 * https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-
-*Version*: 100 (<<microsoft-exchange-worker-spawning-suspicious-processes-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"w3wp.exe" and process.parent.args : "MSExchange*AppPool" and
-(process.name : ("cmd.exe", "powershell.exe", "pwsh.exe",
-"powershell_ise.exe") or process.pe.original_file_name in
-("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "w3wp.exe" and process.parent.args : "MSExchange*AppPool" and
+  (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+  process.pe.original_file_name in ("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,28 +75,3 @@ process where event.type == "start" and process.parent.name :
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[microsoft-exchange-worker-spawning-suspicious-processes-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"w3wp.exe" and process.parent.args : "MSExchange*AppPool" and
-(process.name : ("cmd.exe", "powershell.exe", "pwsh.exe") or
-process.pe.original_file_name : ("cmd.exe", "powershell.exe",
-"pwsh.exe"))
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
index 59ab538c0e..e39b83c0c1 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
@@ -5,7 +5,7 @@ Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,57 +16,52 @@ Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*References*:
+*References*: 
 
 * https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/
 * https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 102 (<<microsoft-iis-connection-strings-decryption-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"aspnet_regiis.exe" or process.pe.original_file_name ==
-"aspnet_regiis.exe") and process.args : "connectionStrings" and
-process.args : "-pdf"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "aspnet_regiis.exe" or process.pe.original_file_name == "aspnet_regiis.exe") and
+  process.args : "connectionStrings" and process.args : "-pdf"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,45 +73,3 @@ process.args : "-pdf"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[microsoft-iis-connection-strings-decryption-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "aspnet_regiis.exe" or process.pe.original_file_name
-== "aspnet_regiis.exe") and process.args : "connectionStrings" and
-process.args : "-pdf"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:aspnet_regiis.exe or
-process.pe.original_file_name:aspnet_regiis.exe or
-winlog.event_data.OriginalFileName:aspnet_regiis.exe) and
-process.args:(connectionStrings and "-pdf")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
index b108f4bcaa..70f37b49f5 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
@@ -5,7 +5,7 @@ Identifies the Internet Information Services (IIS) command-line tool, AppCmd, be
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,55 +16,51 @@ Identifies the Internet Information Services (IIS) command-line tool, AppCmd, be
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*References*:
+*References*: 
 
 * https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 102 (<<microsoft-iis-service-account-password-dumped-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"appcmd.exe" or process.pe.original_file_name == "appcmd.exe") and
-process.args : "/list" and process.args : "/text*password"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+   (process.name : "appcmd.exe" or process.pe.original_file_name == "appcmd.exe") and
+   process.args : "/list" and process.args : "/text*password"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,53 +72,3 @@ process.args : "/list" and process.args : "/text*password"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[microsoft-iis-service-account-password-dumped-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "appcmd.exe" or process.pe.original_file_name ==
-"appcmd.exe") and process.args : "/list" and process.args :
-"/text*password"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "appcmd.exe" or process.pe.original_file_name ==
-"appcmd.exe") and process.args : "/list" and process.args :
-"/text*password"
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process AND event.type:(start OR process_started) AND
-(process.name:appcmd.exe OR process.pe.original_file_name:appcmd.exe
-or winlog.event_data.OriginalFileName:appcmd.exe) AND
-process.args:(/[lL][iI][sS][tT]/ AND
-/\/[tT][eE][xX][tT]\:[pP][aA][sS][sS][wW][oO][rR][dD]/)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
index 7c29913f50..bab3a5fb65 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
@@ -5,7 +5,7 @@ Identifies when one or more features on Microsoft Defender are disabled. Adversa
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,13 +15,13 @@ Identifies when one or more features on Microsoft Defender are disabled. Adversa
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 * https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
@@ -32,60 +32,48 @@ Identifies when one or more features on Microsoft Defender are disabled. Adversa
 * https://www.tenforums.com/tutorials/3569-turn-off-real-time-protection-microsoft-defender-antivirus.html
 * https://www.tenforums.com/tutorials/99576-how-schedule-scan-microsoft-defender-antivirus-windows-10-a.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Version*: 102 (<<microsoft-windows-defender-tampering-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 8.0.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate Windows Defender configuration changes
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Microsoft Windows Defender Tampering
 
-Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple
-environments. Disabling it is a common step in threat actor playbooks.
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
 
 This rule monitors the registry for modifications that disable Windows Defender features.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Examine which features have been disabled, and check if this operation is done under change management and approved
-according to the organization's policy.
+- Examine which features have been disabled, and check if this operation is done under change management and approved according to the organization's policy.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity,
-the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting),
-and no other suspicious activity has been observed.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
 
 ### Related rules
 
@@ -96,71 +84,50 @@ and no other suspicious activity has been observed.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Take actions to restore the appropriate Windows Defender antivirus configurations.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-(registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\PUAProtection" and registry.data.strings : ("0",
-"0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security
-Center\\App and Browser protection\\DisallowExploitProtectionOverride"
-and registry.data.strings : ("0", "0x00000000")) or (registry.path
-: "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" and registry.data.strings : ("1",
-"0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Features\\TamperProtection" and registry.data.strings :
-("0", "0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableRealtimeMonitoring" and registry.data.strings :
-("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableIntrusionPreventionSystem" and
-registry.data.strings : ("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableScriptScanning" and registry.data.strings : ("1",
-"0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows
-Defender Exploit Guard\\Controlled Folder
-Access\\EnableControlledFolderAccess" and registry.data.strings :
-("0", "0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableIOAVProtection" and registry.data.strings : ("1",
-"0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Reporting\\DisableEnhancedNotifications" and
-registry.data.strings : ("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\DisableBlockAtFirstSeen" and registry.data.strings
-: ("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\SpynetReporting" and registry.data.strings : ("0",
-"0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\SubmitSamplesConsent" and registry.data.strings :
-("0", "0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableBehaviorMonitoring" and registry.data.strings :
-("1", "0x00000001"))
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\PUAProtection" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\App and Browser protection\\DisallowExploitProtectionOverride" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features\\TamperProtection" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIntrusionPreventionSystem" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScriptScanning" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Reporting\\DisableEnhancedNotifications" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\DisableBlockAtFirstSeen" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SpynetReporting" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SubmitSamplesConsent" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" and
+  registry.data.strings : ("1", "0x00000001"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -172,117 +139,3 @@ Protection\\DisableBehaviorMonitoring" and registry.data.strings :
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[microsoft-windows-defender-tampering-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-(registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\PUAProtection" and registry.data.strings : ("0",
-"0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security
-Center\\App and Browser protection\\DisallowExploitProtectionOverride"
-and registry.data.strings : ("1", "0x00000001")) or (registry.path
-: "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" and registry.data.strings : ("1",
-"0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Features\\TamperProtection" and registry.data.strings :
-("0", "0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableRealtimeMonitoring" and registry.data.strings :
-("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableIntrusionPreventionSystem" and
-registry.data.strings : ("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableScriptScanning" and registry.data.strings : ("1",
-"0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows
-Defender Exploit Guard\\Controlled Folder
-Access\\EnableControlledFolderAccess" and registry.data.strings :
-("0", "0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableIOAVProtection" and registry.data.strings : ("1",
-"0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Reporting\\DisableEnhancedNotifications" and
-registry.data.strings : ("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\DisableBlockAtFirstSeen" and registry.data.strings
-: ("1", "0x00000001")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\SpynetReporting" and registry.data.strings : ("0",
-"0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\SubmitSamplesConsent" and registry.data.strings :
-("0", "0x00000000")) or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableBehaviorMonitoring" and registry.data.strings :
-("1", "0x00000001"))
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-(registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\PUAProtection" and registry.data.strings : "0") or
-(registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender Security Center\\App and Browser
-protection\\DisallowExploitProtectionOverride" and
-registry.data.strings : "1") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" and registry.data.strings : "1") or
-(registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Features\\TamperProtection" and registry.data.strings :
-"0") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableRealtimeMonitoring" and registry.data.strings :
-"1") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableIntrusionPreventionSystem" and
-registry.data.strings : "1") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableScriptScanning" and registry.data.strings : "1")
-or (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Windows Defender Exploit Guard\\Controlled Folder
-Access\\EnableControlledFolderAccess" and registry.data.strings :
-"0") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableIOAVProtection" and registry.data.strings : "1")
-or (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\Reporting\\DisableEnhancedNotifications" and
-registry.data.strings : "1") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\DisableBlockAtFirstSeen" and registry.data.strings
-: "1") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\SpynetReporting" and registry.data.strings : "0")
-or (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\SpyNet\\SubmitSamplesConsent" and registry.data.strings :
-"0") or (registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-Protection\\DisableBehaviorMonitoring" and registry.data.strings :
-"1")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
index a8bdc4e8d1..7200c5231a 100644
--- a/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
@@ -5,7 +5,7 @@ Identifies the password log file from the default Mimikatz memssp module.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,61 +16,52 @@ Identifies the password log file from the default Mimikatz memssp module.
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<mimikatz-memssp-log-file-detected-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Mimikatz Memssp Log File Detected
 
-[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached
-credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained
-an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects
-such as tokens/hashes/credentials that can then be used to laterally move and pivot across a network.
+[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to laterally move and pivot across a network.
 
-This rule looks for the creation of a file named `mimilsa.log`, which is generated when using the Mimikatz misc::memssp
-module, which injects a malicious Windows SSP to collect locally authenticated credentials, which includes the computer
-account password, running service credentials, and any accounts that logon.
+This rule looks for the creation of a file named `mimilsa.log`, which is generated when using the Mimikatz misc::memssp module, which injects a malicious Windows SSP to collect locally authenticated credentials, which includes the computer account password, running service credentials, and any accounts that logon.
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target
-host.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
 - Retrieve and inspect the log file contents.
 - Search for DLL files created in the same location as the log file, and retrieve unsigned DLLs.
   - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of these files.
@@ -91,30 +82,23 @@ host.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - If the host is a Domain Controller (DC):
   - Activate your incident response plan for total Active Directory compromise.
-  - Review the privileges assigned to users that can access the DCs to ensure that the least privilege principle is
-  being followed and reduce the attack surface.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+  - Review the privileges assigned to users that can access the DCs to ensure that the least privilege principle is being followed and reduce the attack surface.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Reboot the host to remove the injected SSP from memory.
 - Reimage the host operating system or restore compromised files to clean versions.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where file.name : "mimilsa.log" and process.name : "lsass.exe"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and file.name : "mimilsa.log" and process.name : "lsass.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -126,37 +110,3 @@ file where file.name : "mimilsa.log" and process.name : "lsass.exe"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[mimikatz-memssp-log-file-detected-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and file.name:mimilsa.log and
-process.name:lsass.exe
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
index 7e77f03ab6..ac5777b053 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications of the AmsiEnable registry key to 0, which disables the
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,60 +16,54 @@ Identifies modifications of the AmsiEnable registry key to 0, which disables the
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf
 * https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<modification-of-amsienable-registry-key-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Modification of AmsiEnable Registry Key
 
-The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and
-services to integrate with any antimalware product that's present on a machine. AMSI provides integration with multiple
-Windows components, ranging from User Account Control (UAC) to VBA Macros.
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
 
-Since AMSI is widely used across security products for increased visibility, attackers can disable it to evade
-detections that rely on it.
+Since AMSI is widely used across security products for increased visibility, attackers can disable it to evade detections that rely on it.
 
 This rule monitors the modifications to the Software\Microsoft\Windows Script\Settings\AmsiEnable registry key.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the execution of scripts and macros after the registry modification.
 - Retrieve scripts or Microsoft Office files and determine if they are malicious:
@@ -85,8 +79,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and
-monitored by the security team, as these modifications expose the host to malware infections.
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
 
 ### Related rules
 
@@ -100,33 +93,28 @@ monitored by the security team, as these modifications expose the host to malwar
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Delete or set the key to its default value.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path : ( "HKEY_USERS\\*\\Software\\Microsoft\\Windows
-Script\\Settings\\AmsiEnable",
-"HKU\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable",
-"\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows
-Script\\Settings\\AmsiEnable" ) and registry.data.strings: ("0",
-"0x00000000")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  registry.path : (
+    "HKEY_USERS\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable",
+    "HKU\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable",
+    "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable"
+  ) and
+  registry.data.strings: ("0", "0x00000000")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -138,44 +126,7 @@ Script\\Settings\\AmsiEnable" ) and registry.data.strings: ("0",
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[modification-of-amsienable-registry-key-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path : ( "HKEY_USERS\\*\\Software\\Microsoft\\Windows
-Script\\Settings\\AmsiEnable",
-"HKU\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable"
-) and registry.data.strings: ("0", "0x00000000")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path: "HKEY_USERS\\*\\Software\\Microsoft\\Windows
-Script\\Settings\\AmsiEnable" and registry.data.strings: "0"
-----------------------------------
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
index 2174a2663a..8e0d5b2b5b 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
@@ -5,53 +5,53 @@ Identifies use of bcdedit.exe to delete boot configuration data. This tactic is
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<modification-of-boot-configuration-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Modification of Boot Configuration
 
-Boot entry parameters, or boot parameters, are optional, system-specific settings that represent configuration options.
-These are stored in a boot configuration data (BCD) store, and administrators can use utilities like `bcdedit.exe` to
-configure these.
+Boot entry parameters, or boot parameters, are optional, system-specific settings that represent configuration options. These are stored in a boot configuration data (BCD) store, and administrators can use utilities like `bcdedit.exe` to configure these.
 
 This rule identifies the usage of `bcdedit.exe` to:
 
@@ -62,8 +62,7 @@ These are common steps in destructive attacks by adversaries leveraging ransomwa
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -72,8 +71,7 @@ prevalence, whether they are located in expected locations, and if they are sign
 
 ### False positive analysis
 
-- The usage of these options is not inherently malicious. Administrators can modify these configurations to force a
-machine to boot for troubleshooting or data recovery purposes.
+- The usage of these options is not inherently malicious. Administrators can modify these configurations to force a machine to boot for troubleshooting or data recovery purposes.
 
 ### Related rules
 
@@ -83,30 +81,25 @@ machine to boot for troubleshooting or data recovery purposes.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look
-for ransomware preparation and execution activities.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"bcdedit.exe" or process.pe.original_file_name == "bcdedit.exe") and
-( (process.args : "/set" and process.args : "bootstatuspolicy"
-and process.args : "ignoreallfailures") or (process.args : "no"
-and process.args : "recoveryenabled") )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "bcdedit.exe" or process.pe.original_file_name == "bcdedit.exe") and
+    (
+      (process.args : "/set" and process.args : "bootstatuspolicy" and process.args : "ignoreallfailures") or
+      (process.args : "no" and process.args : "recoveryenabled")
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,78 +111,3 @@ and process.args : "recoveryenabled") )
 ** Name: Inhibit System Recovery
 ** ID: T1490
 ** Reference URL: https://attack.mitre.org/techniques/T1490/
-
-[[modification-of-boot-configuration-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "bcdedit.exe" or process.pe.original_file_name ==
-"bcdedit.exe") and ( (process.args : "/set" and process.args
-: "bootstatuspolicy" and process.args : "ignoreallfailures") or
-(process.args : "no" and process.args : "recoveryenabled") )
-----------------------------------
-
-Version 13 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "bcdedit.exe" or process.pe.original_file_name ==
-"bcdedit.exe") and (process.args : "/set" and process.args :
-"bootstatuspolicy" and process.args : "ignoreallfailures") or
-(process.args : "no" and process.args : "recoveryenabled")
-----------------------------------
-
-Version 11 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:bcdedit.exe and process.args:(/set and (bootstatuspolicy
-and ignoreallfailures or no and recoveryenabled))
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:bcdedit.exe and process.args:(/set and (bootstatuspolicy
-and ignoreallfailures or no and recoveryenabled))
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object-inside-a-container.asciidoc
new file mode 100644
index 0000000000..e600c940a4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object-inside-a-container.asciidoc
@@ -0,0 +1,65 @@
+[[modification-of-dynamic-linker-preload-shared-object-inside-a-container]]
+=== Modification of Dynamic Linker Preload Shared Object Inside A Container
+
+This rule detects the creation or modification of the dynamic linker preload shared object (ld.so.preload) inside a container. The Linux dynamic linker is used to load libraries needed by a program at runtime. Adversaries may hijack the dynamic linker by modifying the /etc/ld.so.preload file to point to malicious libraries. This behavior can be used to grant unauthorized access to system resources and has been used to evade detection of malicious processes in container environments.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
+* https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang/
+* https://sysdig.com/blog/threat-detection-aws-cloud-containers/
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* Tactic: Defense Evasion
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where event.module== "cloud_defend" and event.type != "deletion" and file.path== "/etc/ld.so.preload"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc
index 10cc568e8f..547ce9ab5d 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc
@@ -5,53 +5,52 @@ Identifies modification of the dynamic linker preload shared object (ld.so.prelo
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<modification-of-dynamic-linker-preload-shared-object-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.path:/etc/ld.so.preload
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:linux and not event.type:deletion and file.path:/etc/ld.so.preload and
+event.action:(updated or renamed or rename)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,16 +62,7 @@ file.path:/etc/ld.so.preload
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[modification-of-dynamic-linker-preload-shared-object-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
index 3d705aa4ae..dc4f952adf 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to an environment variable using the built-in launchctl
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,53 @@ Identifies modifications to an environment variable using the built-in launchctl
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/rapid7/metasploit-framework/blob/master//modules/post/osx/escalate/tccbypass.rb
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<modification-of-environment-variable-via-launchctl-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and
-process.name:launchctl and process.args:(setenv and not (JAVA*_HOME
-or RUNTIME_JAVA_HOME or
-DBUS_LAUNCHD_SESSION_BUS_SOCKET or
-ANT_HOME or LG_WEBOS_TV_SDK_HOME or
-WEBOS_CLI_TV or EDEN_ENV)
-) and not process.parent.executable:("/Applications/NoMachine.app/Co
-ntents/Frameworks/bin/nxserver.bin" or
-"/usr/local/bin/kr" or
-"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin" or
-"/Applications/IntelliJ IDEA
-CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper") and not
-process.args : "*.vmoptions"
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:start and 
+  process.name:launchctl and 
+  process.args:(setenv and not (ANT_HOME or 
+                                DBUS_LAUNCHD_SESSION_BUS_SOCKET or 
+                                EDEN_ENV or 
+                                LG_WEBOS_TV_SDK_HOME or 
+                                RUNTIME_JAVA_HOME or 
+                                WEBOS_CLI_TV or 
+                                JAVA*_HOME) and 
+                not *.vmoptions) and 
+  not process.parent.executable:("/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper" or 
+                                  /Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin or 
+                                  /Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin or 
+                                  /usr/local/bin/kr)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,39 +72,7 @@ process.args : "*.vmoptions"
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[modification-of-environment-variable-via-launchctl-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:start and
-process.name:launchctl and process.args:(setenv and not (JAVA*_HOME
-or RUNTIME_JAVA_HOME or
-DBUS_LAUNCHD_SESSION_BUS_SOCKET or
-ANT_HOME or LG_WEBOS_TV_SDK_HOME or
-WEBOS_CLI_TV or EDEN_ENV)
-) and not process.parent.executable:("/Applications/NoMachine.app/Co
-ntents/Frameworks/bin/nxserver.bin" or
-"/usr/local/bin/kr" or
-"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin" or
-"/Applications/IntelliJ IDEA
-CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper")
-----------------------------------
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:start and process.name:launchctl
-and process.args:(setenv and not (JAVA*_HOME or RUNTIME_JAVA_HOME or
-DBUS_LAUNCHD_SESSION_BUS_SOCKET or ANT_HOME))
-----------------------------------
-
+* Sub-technique:
+** Name: Path Interception by PATH Environment Variable
+** ID: T1574.007
+** Reference URL: https://attack.mitre.org/techniques/T1574/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc
index ba5af86302..3b117b2427 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc
@@ -5,60 +5,59 @@ Adversaries may modify SSH related binaries for persistence or credential access
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.angelalonso.es/2016/09/anatomy-of-real-linux-intrusion-part-ii.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Credential Access
-* Persistence
-
-*Version*: 100 (<<modification-of-openssh-binaries-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Persistence
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted OpenSSH executable updates. It's recommended to verify the integrity of OpenSSH binary changes.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and event.type:change and process.name:* and
-(file.path:(/usr/sbin/sshd or /usr/bin/ssh or /usr/bin/sftp or
-/usr/bin/scp) or file.name:libkeyutils.so) and not
-process.name:("dpkg" or "yum" or "dnf" or "dnf-automatic")
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:linux and event.type:change and 
+  process.name:(* and not (dnf or dnf-automatic or dpkg or yum)) and 
+  (file.path:(/usr/bin/scp or 
+                /usr/bin/sftp or 
+                /usr/bin/ssh or 
+                /usr/sbin/sshd) or 
+  file.name:libkeyutils.so)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,8 +69,6 @@ process.name:("dpkg" or "yum" or "dnf" or "dnf-automatic")
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -80,21 +77,23 @@ process.name:("dpkg" or "yum" or "dnf" or "dnf-automatic")
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[modification-of-openssh-binaries-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:change and process.name:* and
-(file.path:(/usr/sbin/sshd or /usr/bin/ssh or /usr/bin/sftp or
-/usr/bin/scp) or file.name:libkeyutils.so) and not
-process.executable:/usr/bin/dpkg
-----------------------------------
-
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
+* Technique:
+** Name: Remote Service Session Hijacking
+** ID: T1563
+** Reference URL: https://attack.mitre.org/techniques/T1563/
+* Sub-technique:
+** Name: SSH Hijacking
+** ID: T1563.001
+** Reference URL: https://attack.mitre.org/techniques/T1563/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
index 9419262467..86730ab48f 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
@@ -5,7 +5,7 @@ Identifies changes to the Safari configuration using the built-in defaults comma
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,49 +14,50 @@ Identifies changes to the Safari configuration using the built-in defaults comma
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<modification-of-safari-settings-via-defaults-command-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and
-process.name:defaults and process.args: (com.apple.Safari and
-write and not ( UniversalSearchEnabled or
-SuppressSearchSuggestions or WebKitTabToLinksPreferenceKey or
-ShowFullURLInSmartSearchField or
-com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks )
-)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+  process.name:defaults and process.args:
+    (com.apple.Safari and write and not
+      (
+      UniversalSearchEnabled or
+      SuppressSearchSuggestions or
+      WebKitTabToLinksPreferenceKey or
+      ShowFullURLInSmartSearchField or
+      com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks
+      )
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,13 +69,7 @@ com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks )
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[modification-of-safari-settings-via-defaults-command-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-standard-authentication-module-or-configuration.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-standard-authentication-module-or-configuration.asciidoc
index 3ff17547e7..1ebb47228d 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-standard-authentication-module-or-configuration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-standard-authentication-module-or-configuration.asciidoc
@@ -5,7 +5,7 @@ Adversaries may modify the standard authentication module for persistence via pa
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,66 +14,73 @@ Adversaries may modify the standard authentication module for persistence via pa
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/zephrax/linux-pam-backdoor
 * https://github.com/eurialo/pambd
 * http://0x90909090.blogspot.com/2016/06/creating-backdoor-in-pam-in-5-line-of.html
 * https://www.trendmicro.com/en_us/research/19/i/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Linux
-* Threat Detection
-* Credential Access
-* Persistence
-
-*Version*: 100 (<<modification-of-standard-authentication-module-or-configuration-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted system module updates or allowed Pluggable Authentication Module (PAM) daemon configuration changes.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and event.type:change and (file.name:pam_*.so or
-file.path:(/etc/pam.d/* or /private/etc/pam.d/*)) and
-process.executable: (* and not ( /bin/yum or
-"/usr/sbin/pam-auth-update" or /usr/libexec/packagekitd or
-/usr/bin/dpkg or /usr/bin/vim or /usr/libexec/xpcproxy
-or /usr/bin/bsdtar or /usr/local/bin/brew or
-/usr/bin/rsync or /usr/bin/yum or
-/var/lib/docker/*/bin/yum or /var/lib/docker/*/bin/dpkg or
-./merged/var/lib/docker/*/bin/dpkg or "/System/Library/Private
-Frameworks/PackageKit.framework/Versions/A/XPCServices/package_script_
-service.xpc/Contents/MacOS/package_script_service" ) ) and
-not file.path: ( /tmp/snap.rootfs_*/pam_*.so or
-/tmp/newroot/lib/*/pam_*.so or /private/var/folders/*/T/com
-.apple.fileprovider.ArchiveService/TemporaryItems/*/lib/security/pam_*
-.so or /tmp/newroot/usr/lib64/security/pam_*.so )
+[source, js]
 ----------------------------------
+event.category:file and event.type:change and
+  (file.name:pam_*.so or file.path:(/etc/pam.d/* or /private/etc/pam.d/* or /usr/lib64/security/*)) and
+  process.executable:
+    (* and
+      not
+      (
+        /bin/yum or
+        "/usr/sbin/pam-auth-update" or
+        /usr/libexec/packagekitd or
+        /usr/bin/dpkg or
+        /usr/bin/vim or
+        /usr/libexec/xpcproxy or
+        /usr/bin/bsdtar or
+        /usr/local/bin/brew or
+        /usr/bin/rsync or
+        /usr/bin/yum or
+        /var/lib/docker/*/bin/yum or
+        /var/lib/docker/*/bin/dpkg or
+        ./merged/var/lib/docker/*/bin/dpkg or
+        "/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service"
+      )
+    ) and
+  not file.path:
+         (
+           /tmp/snap.rootfs_*/pam_*.so or
+           /tmp/newroot/lib/*/pam_*.so or
+           /private/var/folders/*/T/com.apple.fileprovider.ArchiveService/TemporaryItems/*/lib/security/pam_*.so or
+           /tmp/newroot/usr/lib64/security/pam_*.so
+         )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,8 +92,6 @@ not file.path: ( /tmp/snap.rootfs_*/pam_*.so or
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -95,45 +100,3 @@ not file.path: ( /tmp/snap.rootfs_*/pam_*.so or
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[modification-of-standard-authentication-module-or-configuration-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:change and (file.name:pam_*.so
-or file.path:(/etc/pam.d/* or /private/etc/pam.d/*)) and
-process.executable: (* and not ( /bin/yum or
-"/usr/sbin/pam-auth-update" or /usr/libexec/packagekitd or
-/usr/bin/dpkg or /usr/bin/vim or
-/usr/libexec/xpcproxy or /usr/bin/bsdtar or
-/usr/local/bin/brew or /usr/bin/rsync or /usr/bin/yum
-or /var/lib/docker/*/bin/yum or
-/var/lib/docker/*/bin/dpkg or
-./merged/var/lib/docker/*/bin/dpkg or "/System/Library/Private
-Frameworks/PackageKit.framework/Versions/A/XPCServices/package_script_
-service.xpc/Contents/MacOS/package_script_service" ) ) and
-not file.path: ( /tmp/snap.rootfs_*/pam_*.so or
-/tmp/newroot/lib/*/pam_*.so or /private/var/folders/*/T/com
-.apple.fileprovider.ArchiveService/TemporaryItems/*/lib/security/pam_*
-.so or /tmp/newroot/usr/lib64/security/pam_*.so )
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:change and (file.name:pam_*.so or
-file.path:(/etc/pam.d/* or /private/etc/pam.d/*)) and
-process.executable: (* and not ( /bin/yum or "/usr/sbin/pam-auth-
-update" or /usr/libexec/packagekitd or /usr/bin/dpkg or /usr/bin/vim
-or /usr/libexec/xpcproxy or /usr/bin/bsdtar or /usr/local/bin/brew ) )
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc
index 411e4f4b14..5180cb24a0 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc
@@ -5,65 +5,64 @@ Identify the modification of the msPKIAccountCredentials attribute in an Active
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming
 * https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx
 * https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Active Directory
-* Privilege Escalation
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Data Source: Active Directory
+* Tactic: Privilege Escalation
+* Use Case: Active Directory Monitoring
 
-*Version*: 1
+*Version*: 6
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.action:"Directory Service Changes" and event.code:"5136" and
-winlog.event_data.AttributeLDAPDisplayName:"msPKIAccountCredentials"
-and winlog.event_data.OperationType:"%%14674" and not
-winlog.event_data.SubjectUserSid : "S-1-5-18"
-----------------------------------
+  winlog.event_data.AttributeLDAPDisplayName:"msPKIAccountCredentials" and winlog.event_data.OperationType:"%%14674" and
+  not winlog.event_data.SubjectUserSid : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
index 72643e565b..41b1cbefab 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to modify the WDigest security provider in the registry to f
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,63 +16,54 @@ Identifies attempts to modify the WDigest security provider in the registry to f
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
 * https://www.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft?edition=2019
 * https://frsecure.com/compromised-credentials-response-playbook
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<modification-of-wdigest-security-provider-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Modification of WDigest Security Provider
 
-In Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send
-cleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications
-based on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default,
-which is no longer the case with newer Windows versions.
+In Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send cleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications based on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default, which is no longer the case with newer Windows versions.
 
-Still, attackers can force WDigest to store the passwords insecurely on the memory by modifying the
-`HKLM\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\UseLogonCredential` registry key. This activity is
-commonly related to the execution of credential dumping tools.
+Still, attackers can force WDigest to store the passwords insecurely on the memory by modifying the `HKLM\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\UseLogonCredential` registry key. This activity is commonly related to the execution of credential dumping tools.
 
 #### Possible investigation steps
 
-- It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should
-treat any activity triggered from this rule with high priority as it typically represents an active adversary.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should treat any activity triggered from this rule with high priority as it typically represents an active adversary.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Determine if credential dumping tools were run on the host, and retrieve and analyze suspicious executables:
   - Use a private sandboxed malware analysis system to perform analysis.
@@ -84,14 +75,11 @@ prevalence, whether they are located in expected locations, and if they are sign
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Use process name, command line, and file hash to search for occurrences on other hosts.
-- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target
-host after the registry modification.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and
-monitored by the security team, as these modifications expose the entire domain to credential compromises and
-consequently unauthorized access.
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team, as these modifications expose the entire domain to credential compromises and consequently unauthorized access.
 
 ### Related rules
 
@@ -101,33 +89,26 @@ consequently unauthorized access.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Reimage the host operating system and restore compromised files to clean versions.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type : ("creation", "change") and
-registry.path : ( "HKLM\\SYSTEM\\*ControlSet*\\Control\\Securi
-tyProviders\\WDigest\\UseLogonCredential", "\\REGISTRY\\MACHIN
-E\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogon
-Credential" ) and registry.data.strings : ("1", "0x00000001") and
-not (process.executable : "?:\\Windows\\System32\\svchost.exe" and
-user.id : "S-1-5-18")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type : ("creation", "change") and
+    registry.path : (
+        "HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential",
+        "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
+    ) and registry.data.strings : ("1", "0x00000001") and
+    not (process.executable : "?:\\Windows\\System32\\svchost.exe" and user.id : "S-1-5-18")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -139,49 +120,7 @@ user.id : "S-1-5-18")
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[modification-of-wdigest-security-provider-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type : ("creation", "change") and
-registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Control\\Security
-Providers\\WDigest\\UseLogonCredential" and registry.data.strings
-: ("1", "0x00000001") and not (process.executable :
-"?:\\Windows\\System32\\svchost.exe" and user.id : "S-1-5-18")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type : ("creation", "change") and
-registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Control\\Securit
-yProviders\\WDigest\\UseLogonCredential" and registry.data.strings
-: ("1", "0x00000001")
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and registry.pat
-h:"HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\Us
-eLogonCredential" and registry.data.strings:"1"
-----------------------------------
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc
index 6b9264999e..e673e885a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to modify or delete a sign on policy for an Okta application. A
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,63 +14,51 @@ Detects attempts to modify or delete a sign on policy for an Okta application. A
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://help.okta.com/en/prod/Content/Topics/Security/App_Based_Signon.htm
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Persistence
-
-*Version*: 102 (<<modification-or-removal-of-an-okta-application-sign-on-policy-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Consider adding exceptions to this rule to filter false positives if sign on policies for Okta applications are regularly modified or deleted in your organization.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:(application.policy.sign_on.update or
-application.policy.sign_on.rule.delete)
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:(application.policy.sign_on.update or application.policy.sign_on.rule.delete)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,38 +70,3 @@ application.policy.sign_on.rule.delete)
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[modification-or-removal-of-an-okta-application-sign-on-policy-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:(application.policy.sign_on.update or
-application.policy.sign_on.rule.delete)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
index 9df585c80d..8b9417d2b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
@@ -5,65 +5,66 @@ Identifies the use of net.exe to mount a WebDav or hidden remote share. This may
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-* Lateral Movement
+*Tags*: 
 
-*Version*: 102 (<<mounting-hidden-or-webdav-remote-shares-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ((process.name : "net.exe" or
-process.pe.original_file_name == "net.exe") or ((process.name :
-"net1.exe" or process.pe.original_file_name == "net1.exe") and not
-process.parent.name : "net.exe")) and process.args : "use" and /*
-including hidden and webdav based online shares such as onedrive */
-process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and /*
-excluding shares deletion operation */ not process.args : "/d*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ ((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and
+ not process.parent.name : "net.exe")) and
+ process.args : "use" and
+ /* including hidden and webdav based online shares such as onedrive  */
+ process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and
+ /* excluding shares deletion operation */
+ not process.args : "/d*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,8 +76,10 @@ excluding shares deletion operation */ not process.args : "/d*"
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -85,37 +88,23 @@ excluding shares deletion operation */ not process.args : "/d*"
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[mounting-hidden-or-webdav-remote-shares-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name : "net.exe" or process.pe.original_file_name ==
-"net.exe") or ((process.name : "net1.exe" or
-process.pe.original_file_name == "net1.exe") and not
-process.parent.name : "net.exe")) and process.args : "use" and /*
-including hidden and webdav based online shares such as onedrive */
-process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and /*
-excluding shares deletion operation */ not process.args : "/d*"
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc
index 7f418a7c08..5a4744684b 100644
--- a/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc
@@ -5,7 +5,7 @@ Microsoft Office Products offer options for users and developers to control the
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -15,65 +15,55 @@ Microsoft Office Products offer options for users and developers to control the
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<ms-office-macro-security-registry-modifications-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating MS Office Macro Security Registry Modifications
 
-Macros are small programs that are used to automate repetitive tasks in Microsoft Office applications.
-Historically, macros have been used for a variety of reasons -- from automating part of a job, to
-building entire processes and data flows. Macros are written in Visual Basic for Applications (VBA) and are saved as
-part of Microsoft Office files.
+Macros are small programs that are used to automate repetitive tasks in Microsoft Office applications. Historically, macros have been used for a variety of reasons -- from automating part of a job, to building entire processes and data flows. Macros are written in Visual Basic for Applications (VBA) and are saved as part of Microsoft Office files.
 
-Macros are often created for legitimate reasons, but they can also be written by attackers to gain access, harm a
-system, or bypass other security controls such as application allow listing. In fact, exploitation from malicious macros
-is one of the top ways that organizations are compromised today. These attacks are often conducted through phishing or
-spear phishing campaigns.
+Macros are often created for legitimate reasons, but they can also be written by attackers to gain access, harm a system, or bypass other security controls such as application allow listing. In fact, exploitation from malicious macros is one of the top ways that organizations are compromised today. These attacks are often conducted through phishing or spear phishing campaigns.
 
-Attackers can convince victims to modify Microsoft Office security settings, so their macros are trusted by default and
-no warnings are displayed when they are executed. These settings include:
+Attackers can convince victims to modify Microsoft Office security settings, so their macros are trusted by default and no warnings are displayed when they are executed. These settings include:
 
-* *Trust access to the VBA project object model* - When enabled, Microsoft Office will trust all macros and run any code
-without showing a security warning or requiring user permission.
-* *VbaWarnings* - When set to 1, Microsoft Office will trust all macros and run any code without showing a security
-warning or requiring user permission.
+- *Trust access to the VBA project object model* - When enabled, Microsoft Office will trust all macros and run any code without showing a security warning or requiring user permission.
+- *VbaWarnings* - When set to 1, Microsoft Office will trust all macros and run any code without showing a security warning or requiring user permission.
 
 This rule looks for registry changes affecting the conditions above.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user and check if the change was done manually.
 - Verify whether malicious macros were executed after the registry change.
@@ -90,48 +80,40 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This activity should not happen legitimately. The security team should address any potential benign true
-positives (B-TPs), as this configuration can put the user and the domain at risk.
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Reset the registry key value.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Explore using GPOs to manage security settings for Microsoft Office macros.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type == "change" and registry.path : (
-"HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM
-", "HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\
-\VbaWarnings", "HKU\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\
-*\\Security\\AccessVBOM", "HKU\\S-1-12-1-*\\SOFTWARE\\Microsof
-t\\Office\\*\\Security\\VbaWarnings", "\\REGISTRY\\USER\\S-1-5
--21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM", 
-"\\REGISTRY\\USER\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Securit
-y\\VbaWarnings", "\\REGISTRY\\USER\\S-1-12-1-*\\SOFTWARE\\Micr
-osoft\\Office\\*\\Security\\AccessVBOM", "\\REGISTRY\\USER\\S-
-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings"
-) and registry.data.strings : ("0x00000001", "1") and
-process.name : ("cscript.exe", "wscript.exe", "mshta.exe",
-"mshta.exe", "winword.exe", "excel.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+    registry.path : (
+        "HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM",
+        "HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings",
+        "HKU\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM",
+        "HKU\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings",
+        "\\REGISTRY\\USER\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM",
+        "\\REGISTRY\\USER\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings",
+        "\\REGISTRY\\USER\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM",
+        "\\REGISTRY\\USER\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings"
+        ) and
+    registry.data.strings : ("0x00000001", "1") and
+    process.name : ("cscript.exe", "wscript.exe", "mshta.exe", "mshta.exe", "winword.exe", "excel.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -143,8 +125,6 @@ process.name : ("cscript.exe", "wscript.exe", "mshta.exe",
 ** Name: Modify Registry
 ** ID: T1112
 ** Reference URL: https://attack.mitre.org/techniques/T1112/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -153,42 +133,7 @@ process.name : ("cscript.exe", "wscript.exe", "mshta.exe",
 ** Name: User Execution
 ** ID: T1204
 ** Reference URL: https://attack.mitre.org/techniques/T1204/
-
-[[ms-office-macro-security-registry-modifications-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type == "change" and registry.path : (
-"HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM
-", "HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\
-\VbaWarnings" ) and registry.data.strings == "0x00000001"
-and process.name : ("cscript.exe", "wscript.exe", "mshta.exe",
-"mshta.exe", "winword.exe", "excel.exe")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type == "change" and registry.path : (
-"HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM
-", "HKU\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\
-\VbaWarnings" ) and registry.data.strings == "0x00000001"
-and process.name : ("cscript.exe", "wscript.exe", "mshta.exe",
-"mshta.exe", "winword.exe", "excel.exe")
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
index d829248b2f..ab8ed2f99c 100644
--- a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
@@ -15,42 +15,104 @@ Identifies MsBuild.exe making outbound network connections. This may indicate ad
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
+*References*: None
+
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 104
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
 
-*Version*: 100 (<<msbuild-making-network-connections-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.6.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating MsBuild Making Network Connections
+
+By examining the specific traits of Windows binaries (such as process trees, command lines, network connections, registry modifications, and so on) it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
+
+The Microsoft Build Engine, also known as MSBuild, is a platform for building applications. This engine provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy code execution.
+
+This rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+  - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.
+- Investigate the target host that the signed binary is communicating with.
+  - Check if the domain is newly registered or unexpected.
+  - Check the reputation of the domain or IP address.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and command line conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"MSBuild.exe" and event.type == "start"] [network where process.name
-: "MSBuild.exe" and not cidrmatch(destination.ip, "127.0.0.1",
-"::1")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and process.name : "MSBuild.exe" and event.type == "start"]
+  [network where host.os.type == "windows" and process.name : "MSBuild.exe" and
+     not cidrmatch(destination.ip, "127.0.0.1", "::1")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -62,52 +124,7 @@ sequence by process.entity_id [process where process.name :
 ** Name: Trusted Developer Utilities Proxy Execution
 ** ID: T1127
 ** Reference URL: https://attack.mitre.org/techniques/T1127/
-
-[[msbuild-making-network-connections-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (7.16.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:MSBuild.exe and not destination.ip:(127.0.0.1 or "::1")
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Network connection detected (rule: NetworkConnect)" and
-process.name:MSBuild.exe and not destination.ip:(127.0.0.1 or "::1")
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Network connection detected (rule: NetworkConnect)" and
-process.name:MSBuild.exe and not destination.ip:("127.0.0.1" or "::1")
-----------------------------------
-
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-network-connection-sequence.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-network-connection-sequence.asciidoc
new file mode 100644
index 0000000000..8b9a3e3694
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-network-connection-sequence.asciidoc
@@ -0,0 +1,69 @@
+[[msbuild-network-connection-sequence]]
+=== MsBuild Network Connection Sequence
+
+Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* duplicate of MsBuild Making Network Connections - 0e79980b-4250-4a50-a509-69294c14e84b */
+
+sequence by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "MSBuild.exe"]
+  [network where host.os.type == "windows" and process.name : "MSBuild.exe" and
+     not (destination.ip == "127.0.0.1" and source.ip == "127.0.0.1")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/mshta-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/mshta-making-network-connections.asciidoc
index 4d0b33c43d..071c171b30 100644
--- a/docs/detections/prebuilt-rules/rule-details/mshta-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mshta-making-network-connections.asciidoc
@@ -5,7 +5,7 @@ Identifies Mshta.exe making outbound network connections. This may indicate adve
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,46 +15,44 @@ Identifies Mshta.exe making outbound network connections. This may indicate adve
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 101 (<<mshta-making-network-connections-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=10m [process where
-event.type == "start" and process.name : "mshta.exe" and not
-process.parent.name : "Microsoft.ConfigurationManagement.exe" and
-not (process.parent.executable : "C:\\Amazon\\Amazon
-Assistant\\amazonAssistantService.exe" or
-process.parent.executable : "C:\\TeamViewer\\TeamViewer.exe") and
-not process.args : "ADSelfService_Enroll.hta"] [network where
-process.name : "mshta.exe"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=10m
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "mshta.exe" and
+     not process.parent.name : "Microsoft.ConfigurationManagement.exe" and
+     not (process.parent.executable : "C:\\Amazon\\Amazon Assistant\\amazonAssistantService.exe" or
+          process.parent.executable : "C:\\TeamViewer\\TeamViewer.exe") and
+     not process.args : "ADSelfService_Enroll.hta"]
+  [network where host.os.type == "windows" and process.name : "mshta.exe"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,51 +64,7 @@ process.name : "mshta.exe"]
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[mshta-making-network-connections-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=10m [process where
-event.type in ("start", "process_started") and process.name :
-"mshta.exe" and not process.parent.name :
-"Microsoft.ConfigurationManagement.exe" and not
-(process.parent.executable : "C:\\Amazon\\Amazon
-Assistant\\amazonAssistantService.exe" or
-process.parent.executable : "C:\\TeamViewer\\TeamViewer.exe") and
-not process.args : "ADSelfService_Enroll.hta"] [network where
-process.name : "mshta.exe"]
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.15.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=2h [process where
-event.type in ("start", "process_started") and process.name :
-"mshta.exe" and not process.parent.name :
-"Microsoft.ConfigurationManagement.exe" and not
-(process.parent.executable : "C:\\Amazon\\Amazon
-Assistant\\amazonAssistantService.exe" or
-process.parent.executable : "C:\\TeamViewer\\TeamViewer.exe") and
-not process.args : "ADSelfService_Enroll.hta"] [network where
-process.name : "mshta.exe"]
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Mshta
+** ID: T1218.005
+** Reference URL: https://attack.mitre.org/techniques/T1218/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/msxsl-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msxsl-making-network-connections.asciidoc
new file mode 100644
index 0000000000..4330e06ccc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/msxsl-making-network-connections.asciidoc
@@ -0,0 +1,64 @@
+[[msxsl-making-network-connections]]
+=== MsXsl Making Network Connections
+
+Identifies MsXsl.exe making outbound network connections. This may indicate adversarial activity as MsXsl is often leveraged by adversaries to execute malicious scripts and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* duplicate of Network Connection via MsXsl - b86afe07-0d98-4738-b15d-8d7465f95ff5 */
+
+sequence by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "msxsl.exe"]
+  [network where host.os.type == "windows" and process.name : "msxsl.exe" and network.direction : ("outgoing", "egress")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: XSL Script Processing
+** ID: T1220
+** Reference URL: https://attack.mitre.org/techniques/T1220/
diff --git a/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc
index 9ac88afe67..9e8010496e 100644
--- a/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc
@@ -5,7 +5,7 @@ Identifies when multi-factor authentication (MFA) is disabled for an Azure user
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,52 +14,47 @@ Identifies when multi-factor authentication (MFA) is disabled for an Azure user
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
+*Tags*: 
 
-*Version*: 103 (<<multi-factor-authentication-disabled-for-an-azure-user-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Multi-Factor Authentication Disabled for an Azure User
 
-Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form
-of identification, such as a code on their cellphone or a fingerprint scan.
+Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form of identification, such as a code on their cellphone or a fingerprint scan.
 
-If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or
-has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication,
-security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
+If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
 
 For more information about using MFA in Azure AD, access the [official documentation](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#how-to-enable-and-use-azure-ad-multi-factor-authentication).
 
-This rule identifies the deactivation of MFA for an Azure user account. This modification weakens account security
-and can lead to the compromise of accounts and other assets.
+This rule identifies the deactivation of MFA for an Azure user account. This modification weakens account security and can lead to the compromise of accounts and other assets.
 
 #### Possible investigation steps
 
@@ -67,13 +62,11 @@ and can lead to the compromise of accounts and other assets.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Contact the account and resource owners and confirm whether they are aware of this activity.
 - Check if this operation was approved and performed according to the organization's change management policy.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- While this activity can be done by administrators, all users must use MFA. The security team should address any
-potential benign true positive (B-TP), as this configuration can risk the user and domain.
+- While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
 ### Response and remediation
 
@@ -85,29 +78,22 @@ potential benign true positive (B-TP), as this configuration can risk the user a
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security defaults [provided by Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults).
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Disable Strong Authentication" and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Disable Strong Authentication" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -119,35 +105,3 @@ event.outcome:(Success or success)
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[multi-factor-authentication-disabled-for-an-azure-user-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and
-azure.auditlogs.operation_name:"Disable Strong Authentication" and
-event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-host.asciidoc
index 4c6fc32ea7..f1d894420e 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-host.asciidoc
@@ -5,43 +5,41 @@ This rule uses alert data to determine when multiple alerts in different phases
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
-* .alerts-*
+* .alerts-security.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 1 hour
+*Runs every*: 1h
 
 *Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Threat Detection
-* Higher-Order Rules
+*Tags*: 
 
-*Version*: 1
+* Use Case: Threat Detection
+* Rule Type: Higher-Order Rule
 
-*Added ({stack} release)*: 8.6.0
+*Version*: 4
 
-*Rule authors*: Elastic
+*Rule authors*: 
 
-*Rule license*: Elastic License v2
+* Elastic
 
-==== Potential false positives
+*Rule license*: Elastic License v2
 
-False positives can occur because the rules may be mapped to a few MITRE ATT&CK tactics. Use the attached Timeline to determine which detections were triggered on the host.
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 signal.rule.name:* and kibana.alert.rule.threat.tactic.id:*
-----------------------------------
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-alerts-involving-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-alerts-involving-a-user.asciidoc
new file mode 100644
index 0000000000..3663fbcb11
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-alerts-involving-a-user.asciidoc
@@ -0,0 +1,45 @@
+[[multiple-alerts-involving-a-user]]
+=== Multiple Alerts Involving a User
+
+This rule uses alert data to determine when multiple different alerts involving the same user are triggered. Analysts can use this to prioritize triage and response, as these users are more likely to be compromised.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* .alerts-security.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 1h
+
+*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Rule Type: Higher-Order Rule
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+signal.rule.name:* and user.name:* and not user.id:("S-1-5-18" or "S-1-5-19" or "S-1-5-20")
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
index 20b70e40d3..5f49732cfc 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
@@ -9,12 +9,13 @@ Identifies multiple logon failures followed by a successful one from the same so
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -26,81 +27,101 @@ Identifies multiple logon failures followed by a successful one from the same so
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 7
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
+### Investigating Multiple Logon Failure Followed by Logon Success
+
+Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found [here](https://attack.mitre.org/techniques/T1110/001/).
+
+This rule identifies potential password guessing/brute force activity from a single address, followed by a successful logon, indicating that an attacker potentially successfully compromised the account.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
 #### Possible investigation steps
 
-- Investigate the logon failure reason code and the targeted user names.
+- Investigate the logon failure reason code and the targeted user name.
+  - Prioritize the investigation if the account is critical or has administrative privileges over the domain.
 - Investigate the source IP address of the failed Network Logon attempts.
-- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Identify whether these attempts are coming from the internet or are internal.
+- Investigate other alerts associated with the involved users and source host during the past 48 hours.
 - Identify the source and the target computer and their roles in the IT environment.
+- Check whether the involved credentials are used in automation or scheduled tasks.
+- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
+- Examine the source host for derived artifacts that indicate compromise:
+  - Observe and collect information about the following activities in the alert source host:
+    - Attempts to contact external domains and addresses.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the host which is the source of this activity.
 
 ### False positive analysis
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
-- Trust relationship between the primary domain and the trusted domain issue.
-- Infrastructure or availability issue.
+- Domain trust relationship issues.
+- Infrastructure or availability issues.
+
+### Related rules
+
+- Multiple Logon Failure from the same Source Address - 48b6edfc-079d-4907-b43c-baffa243270d
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- If the host is a domain controller (DC):
-  - Activate your incident response plan for total Active Directory compromise.
-  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is
-  being followed and to reduce the attack surface.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Isolate the source host to prevent further post-compromise behavior.
+- If the asset is exposed to the internet with RDP or other remote services available, take the necessary measures to restrict access to the asset. If not possible, limit the access via the firewall to only the needed IP addresses. Also, ensure the system uses robust authentication mechanisms and is patched regularly.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, source.ip with maxspan=5s [authentication where
-event.action == "logon-failed" and /* event 4625 need to be logged
-*/ winlog.logon.type : "Network" and source.ip != null and
-source.ip != "127.0.0.1" and source.ip != "::1" and not user.name
-: ("ANONYMOUS LOGON", "-", "*$") and not user.domain == "NT AUTHORITY"
-and /* noisy failure status codes often associated to
-authentication misconfiguration */ not winlog.event_data.Status :
-("0xC000015B", "0XC000005E", "0XC0000133", "0XC0000192")] with runs=5
-[authentication where event.action == "logged-in" and /* event
-4624 need to be logged */ winlog.logon.type : "Network" and
-source.ip != null and source.ip != "127.0.0.1" and source.ip != "::1"
-and not user.name : ("ANONYMOUS LOGON", "-", "*$") and not
-user.domain == "NT AUTHORITY"]
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name, source.ip with maxspan=5s
+  [authentication where event.action == "logon-failed" and
+    /* event 4625 need to be logged */
+    winlog.logon.type : "Network" and
+    source.ip != null and source.ip != "127.0.0.1" and source.ip != "::1" and
+    not user.name : ("ANONYMOUS LOGON", "-", "*$") and not user.domain == "NT AUTHORITY" and
+
+    /* noisy failure status codes often associated to authentication misconfiguration */
+    not winlog.event_data.Status : ("0xC000015B", "0XC000005E", "0XC0000133", "0XC0000192")] with runs=5
+  [authentication where event.action == "logged-in" and
+    /* event 4624 need to be logged */
+    winlog.logon.type : "Network" and
+    source.ip != null and source.ip != "127.0.0.1" and source.ip != "::1" and
+    not user.name : ("ANONYMOUS LOGON", "-", "*$") and not user.domain == "NT AUTHORITY"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -112,3 +133,11 @@ user.domain == "NT AUTHORITY"]
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
index 55e1518d53..9eb127bb96 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
@@ -9,12 +9,13 @@ Identifies multiple consecutive logon failures from the same source address and
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -23,43 +24,71 @@ Identifies multiple consecutive logon failures from the same source address and
 *References*:
 
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4624
+* https://social.technet.microsoft.com/Forums/ie/en-US/c82ac4f3-a235-472c-9fd3-53aa646cfcfd/network-information-missing-in-event-id-4624?forum=winserversecurity
+* https://serverfault.com/questions/379092/remote-desktop-failed-logon-event-4625-not-logging-ip-address-on-2008-terminal-s/403638#403638
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 7
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
+### Investigating Multiple Logon Failure from the same Source Address
+
+Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found [here](https://attack.mitre.org/techniques/T1110/001/).
+
+This rule identifies potential password guessing/brute force activity from a single address.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
 #### Possible investigation steps
 
 - Investigate the logon failure reason code and the targeted user names.
+  - Prioritize the investigation if the account is critical or has administrative privileges over the domain.
 - Investigate the source IP address of the failed Network Logon attempts.
-- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Identify whether these attempts are coming from the internet or are internal.
+- Investigate other alerts associated with the involved users and source host during the past 48 hours.
 - Identify the source and the target computer and their roles in the IT environment.
+- Check whether the involved credentials are used in automation or scheduled tasks.
+- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
+- Examine the source host for derived artifacts that indicate compromise:
+  - Observe and collect information about the following activities in the alert source host:
+    - Attempts to contact external domains and addresses.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the host which is the source of this activity
 
 ### False positive analysis
 
+- Understand the context of the authentications by contacting the asset owners. This activity can be related to a new or existing automation or business process that is in a failing state.
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
-- Trust relationship between the primary domain and the trusted domain issue.
-- Infrastructure or availability issue.
+- Domain trust relationship issues.
+- Infrastructure or availability issues.
 
 ### Related rules
 
@@ -68,44 +97,38 @@ Identifies multiple consecutive logon failures from the same source address and
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- If the host is a domain controller (DC):
-  - Activate your incident response plan for total Active Directory compromise.
-  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is
-  being followed and to reduce the attack surface.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Isolate the source host to prevent further post-compromise behavior.
+- If the asset is exposed to the internet with RDP or other remote services available, take the necessary measures to restrict access to the asset. If not possible, limit the access via the firewall to only the needed IP addresses. Also, ensure the system uses robust authentication mechanisms and is patched regularly.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
+-
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, source.ip with maxspan=10s [authentication
-where event.action == "logon-failed" and /* event 4625 need to be
-logged */ winlog.logon.type : "Network" and source.ip != null
-and source.ip != "127.0.0.1" and source.ip != "::1" and not
-user.name : ("ANONYMOUS LOGON", "-", "*$") and not user.domain == "NT
-AUTHORITY" and /* noisy failure status codes often
-associated to authentication misconfiguration : 0xC000015B - The
-user has not been granted the requested logon type (also called the
-logon right) at this machine. 0XC000005E - There are currently no
-logon servers available to service the logon request. 0XC0000133
-- Clocks between DC and other computer too far out of sync.
-0XC0000192 An attempt was made to logon, but the Netlogon service was
-not started. */ not winlog.event_data.Status : ("0xC000015B",
-"0XC000005E", "0XC0000133", "0XC0000192")] with runs=10
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name, source.ip with maxspan=10s
+  [authentication where event.action == "logon-failed" and
+    /* event 4625 need to be logged */
+    winlog.logon.type : "Network" and
+    source.ip != null and source.ip != "127.0.0.1" and source.ip != "::1" and
+    not user.name : ("ANONYMOUS LOGON", "-", "*$") and not user.domain == "NT AUTHORITY" and
+
+    /*
+    noisy failure status codes often associated to authentication misconfiguration :
+     0xC000015B - The user has not been granted the requested logon type (also called the logon right) at this machine.
+     0XC000005E	- There are currently no logon servers available to service the logon request.
+     0XC0000133	- Clocks between DC and other computer too far out of sync.
+     0XC0000192	An attempt was made to logon, but the Netlogon service was not started.
+    */
+    not winlog.event_data.Status : ("0xC000015B", "0XC000005E", "0XC0000133", "0XC0000192")] with runs=10
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -117,3 +140,11 @@ not started. */ not winlog.event_data.Status : ("0xC000015B",
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc
index 6119cfa5e8..3446d8a4e9 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc
@@ -5,69 +5,71 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-
-*Version*: 2 (<<multiple-vault-web-credentials-read-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 8
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, winlog.process.pid with maxspan=1s /* 2
-consecutive vault reads from same pid for web creds */ [any where
-event.code : "5382" and (winlog.event_data.SchemaFriendlyName :
-"Windows Web Password Credential" or winlog.event_data.Resource :
-"http*") and not winlog.event_data.SubjectLogonId : "0x3e7"] [any
-where event.code : "5382" and (winlog.event_data.SchemaFriendlyName
-: "Windows Web Password Credential" or winlog.event_data.Resource :
-"http*") and not winlog.event_data.SubjectLogonId : "0x3e7"]
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name, winlog.process.pid with maxspan=1s
+
+ /* 2 consecutive vault reads from same pid for web creds */
 
-==== Threat mapping
+ [any where event.code : "5382" and
+  (winlog.event_data.SchemaFriendlyName : "Windows Web Password Credential" and winlog.event_data.Resource : "http*") and
+  not winlog.event_data.SubjectLogonId : "0x3e7" and 
+  not winlog.event_data.Resource : "http://localhost/"]
+
+ [any where event.code : "5382" and
+  (winlog.event_data.SchemaFriendlyName : "Windows Web Password Credential" and winlog.event_data.Resource : "http*") and
+  not winlog.event_data.SubjectLogonId : "0x3e7" and 
+  not winlog.event_data.Resource : "http://localhost/"]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,10 +81,11 @@ where event.code : "5382" and (winlog.event_data.SchemaFriendlyName
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[multiple-vault-web-credentials-read-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Windows Credential Manager
+** ID: T1555.004
+** Reference URL: https://attack.mitre.org/techniques/T1555/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc
new file mode 100644
index 0000000000..076fad1cd6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc
@@ -0,0 +1,72 @@
+[[my-first-rule]]
+=== My First Rule
+
+This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* apm-*-transaction*
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* packetbeat-*
+* traces-apm*
+* winlogbeat-*
+* -*elastic-cloud-logs-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 24h
+
+*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 1
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
+
+*Tags*: 
+
+* Use Case: Guided Onboarding
+* Data Source: APM
+* OS: Windows
+* Data Source: Elastic Endgame
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+This is a test alert.
+
+This alert does not show threat activity. Elastic created this alert to help you understand how alerts work.
+
+For normal rules, the Investigation Guide will help analysts investigate alerts.
+
+This alert will show once every 24 hours for each host. It is safe to disable this rule.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.kind:event
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc b/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc
index a1335aafff..f4d00d98ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc
@@ -1,59 +1,59 @@
 [[namespace-manipulation-using-unshare]]
 === Namespace Manipulation Using Unshare
 
-Identifies  suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.
+Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://man7.org/linux/man-pages/man1/unshare.1.html
 * https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Privilege Escalation
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Version*: 1
+*Version*: 5
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and event.action == "exec" and
-process.executable: "/usr/bin/unshare" and not
-process.parent.executable: ("/usr/bin/udevadm",
-"*/lib/systemd/systemd-udevd", "/usr/bin/unshare") and not
-process.args : "/usr/bin/snap"
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action : ("exec", "exec_event") and
+process.executable: "/usr/bin/unshare" and
+not process.parent.executable: ("/usr/bin/udevadm", "*/lib/systemd/systemd-udevd", "/usr/bin/unshare") and
+not process.args : "/usr/bin/snap"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-inside-a-container.asciidoc
new file mode 100644
index 0000000000..9a8e259e72
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-inside-a-container.asciidoc
@@ -0,0 +1,74 @@
+[[netcat-listener-established-inside-a-container]]
+=== Netcat Listener Established Inside A Container
+
+This rule detects an established netcat listener running inside a container. Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence or exfiltrating data.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type== "start" 
+and event.action in ("fork", "exec") and 
+(
+process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") or
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
+process.args: ("nc","ncat","netcat","netcat.openbsd","netcat.traditional")
+) and (
+          /* bind shell to echo for command execution */
+          (process.args:("-*l*", "--listen", "-*p*", "--source-port") and process.args:("-c", "--sh-exec", "-e", "--exec", "echo","$*"))
+          /* bind shell to specific port */
+          or process.args:("-*l*", "--listen", "-*p*", "--source-port")
+          )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
index 954d524713..07e77eec91 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
@@ -15,7 +15,7 @@ Identifies certutil.exe making a network connection. Adversaries could abuse cer
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -28,71 +28,62 @@ Identifies certutil.exe making a network connection. Adversaries could abuse cer
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-
-*Version*: 102 (<<network-connection-via-certutil-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Network Connection via Certutil
 
-Attackers can abuse `certutil.exe` to download malware, offensive security tools, and certificates from external sources
-in order to take the next steps in a compromised environment.
+Attackers can abuse `certutil.exe` to download malware, offensive security tools, and certificates from external sources in order to take the next steps in a compromised environment.
 
-This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in
-[IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
+This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate if the downloaded file was executed.
 - Determine the context in which `certutil.exe` and the file were run.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the downloaded file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. If trusted software uses this command and the triage has not identified
-anything suspicious, this alert can be closed as a false positive.
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination
-of user and command line conditions.
+- This mechanism can be used legitimately. If trusted software uses this command and the triage has not identified anything suspicious, this alert can be closed as a false positive.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Response and remediation
 
@@ -102,37 +93,30 @@ of user and command line conditions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"certutil.exe" and event.type == "start"] [network where
-process.name : "certutil.exe" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
-"192.0.0.0/24", "192.0.0.0/29",
-"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
-"192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
-"192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
-"198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4",
-"::1", "FE80::/10", "FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and process.name : "certutil.exe" and event.type == "start"]
+  [network where host.os.type == "windows" and process.name : "certutil.exe" and
+    not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+                                  "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
+                                  "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
+                                  "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+                                  "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+                                  "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -144,59 +128,3 @@ process.name : "certutil.exe" and not cidrmatch(destination.ip,
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[network-connection-via-certutil-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"certutil.exe" and event.type == "start"] [network where
-process.name : "certutil.exe" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
-----------------------------------
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:certutil.exe and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:certutil.exe and event.action:"Network connection
-detected (rule: NetworkConnect)" and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
index a545bae483..a92a9f8001 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
@@ -15,7 +15,7 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,41 +27,104 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+
+*Version*: 104
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
 
-*Version*: 100 (<<network-connection-via-compiled-html-file-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.6.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Network Connection via Compiled HTML File
+
+CHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.
+
+When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
+
+This rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Examine the command lines for suspicious activities.
+  - Retrieve `.chm`, `.ps1`, and other files that were involved for further examination.
+  - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+  - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.
+- Investigate the target host that the signed binary is communicating with.
+  - Check if the domain is newly registered or unexpected.
+  - Check the reputation of the domain or IP address.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executables, scripts and help files retrieved from the system using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- If the malicious file was delivered via phishing:
+  - Block the email sender from sending future emails.
+  - Block the malicious web pages.
+  - Remove emails from the sender from mailboxes.
+  - Consider improvements to the security awareness program.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name : "hh.exe"
-and event.type == "start"] [network where process.name : "hh.exe"
-and not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
-"169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and process.name : "hh.exe" and event.type == "start"]
+  [network where host.os.type == "windows" and process.name : "hh.exe" and
+     not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+       "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,8 +136,10 @@ and not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
 ** Name: User Execution
 ** ID: T1204
 ** Reference URL: https://attack.mitre.org/techniques/T1204/
-
-
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -83,66 +148,7 @@ and not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[network-connection-via-compiled-html-file-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Formatting only
-
-Version 8 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name : "hh.exe"
-and event.type == "start"] [network where process.name : "hh.exe"
-and not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12",
-"192.168.0.0/16")]
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:hh.exe and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:hh.exe and event.action:"Network connection detected
-(rule: NetworkConnect)" and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:hh.exe and event.action:"Network connection detected
-(rule: NetworkConnect)" and not destination.ip:10.0.0.0/8 and not
-destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16
-----------------------------------
-
+* Sub-technique:
+** Name: Compiled HTML File
+** ID: T1218.001
+** Reference URL: https://attack.mitre.org/techniques/T1218/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-msxsl.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-msxsl.asciidoc
index 8effc9dc44..1ff45ee029 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-msxsl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-msxsl.asciidoc
@@ -5,7 +5,7 @@ Identifies msxsl.exe making a network connection. This may indicate adversarial
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,53 +15,47 @@ Identifies msxsl.exe making a network connection. This may indicate adversarial
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<network-connection-via-msxsl-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"msxsl.exe" and event.type == "start"] [network where process.name :
-"msxsl.exe" and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and process.name : "msxsl.exe" and event.type == "start"]
+  [network where host.os.type == "windows" and process.name : "msxsl.exe" and
+     not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+       "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,53 +67,3 @@ sequence by process.entity_id [process where process.name :
 ** Name: XSL Script Processing
 ** ID: T1220
 ** Reference URL: https://attack.mitre.org/techniques/T1220/
-
-[[network-connection-via-msxsl-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"msxsl.exe" and event.type == "start"] [network where process.name :
-"msxsl.exe" and not cidrmatch(destination.ip, "10.0.0.0/8",
-"172.16.0.0/12", "192.168.0.0/16")]
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:msxsl.exe and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:msxsl.exe and event.action:"Network connection detected
-(rule: NetworkConnect)" and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
index 386aa9d917..0423be3fd5 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
@@ -15,7 +15,7 @@ Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,195 +27,118 @@ Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-
-*Version*: 100 (<<network-connection-via-registration-utility-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
 
-Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual.
+==== Investigation guide
 
-==== Rule query
 
-
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")
-and not ( (?process.Ext.token.integrity_level_name :
-"System" or ?winlog.event_data.IntegrityLevel : "System") and
-(process.parent.name : "msiexec.exe" or process.parent.executable :
-("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
-) ] [network where process.name : ("regsvr32.exe", "RegAsm.exe",
-"RegSvcs.exe") and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8") and network.protocol != "dns"]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-==== Threat mapping
+### Investigating Network Connection via Registration Utility
 
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
+By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity such as masquerading, and deserve further investigation.
 
+This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: System Binary Proxy Execution
-** ID: T1218
-** Reference URL: https://attack.mitre.org/techniques/T1218/
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
-[[network-connection-via-registration-utility-history]]
-==== Rule version history
+#### Possible investigation steps
 
-Version 100 (8.5.0 release)::
-* Formatting only
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+  - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.
+- Investigate the target host that the signed binary is communicating with.
+  - Check if the domain is newly registered or unexpected.
+  - Check the reputation of the domain or IP address.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-Version 13 (8.4.0 release)::
-* Formatting only
+### False positive analysis
 
-Version 11 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")
-and not ( (process.Ext.token.integrity_level_name :
-"System" or winlog.event_data.IntegrityLevel : "System") and
-(process.parent.name : "msiexec.exe" or process.parent.executable :
-("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
-) ] [network where process.name : ("regsvr32.exe", "RegAsm.exe",
-"RegSvcs.exe") and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8") and network.protocol != "dns"]
-----------------------------------
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and command line conditions.
 
-Version 10 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")
-and not ( user.id == "S-1-5-18" and
-(process.parent.name : "msiexec.exe" or process.parent.executable :
-("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
-) ] [network where process.name : ("regsvr32.exe", "RegAsm.exe",
-"RegSvcs.exe") and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8") and network.protocol != "dns"]
-----------------------------------
+### Response and remediation
 
-Version 9 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")
-and not ( user.id == "S-1-5-18" and
-(process.parent.name : "msiexec.exe" or process.parent.executable :
-("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
-) ] [network where process.name : ("regsvr32.exe", "RegAsm.exe",
-"RegSvcs.exe") and not cidrmatch(destination.ip, "10.0.0.0/8",
-"169.254.169.254", "172.16.0.0/12", "192.168.0.0/16") and
-network.protocol != "dns"]
-----------------------------------
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where (process.name :
-"regsvr32.exe" or process.name : "regsvr64.exe" or
-process.name : "RegAsm.exe" or process.name : "RegSvcs.exe") and
-event.type == "start"] [network where (process.name : "regsvr32.exe"
-or process.name : "regsvr64.exe" or process.name :
-"RegAsm.exe" or process.name : "RegSvcs.exe") and not
-cidrmatch(destination.ip, "10.0.0.0/8", "169.254.169.254",
-"172.16.0.0/12", "192.168.0.0/16")]
 ----------------------------------
 
-Version 7 (7.12.0 release)::
-* Formatting only
+==== Rule query
 
-Version 6 (7.11.0 release)::
-* Formatting only
 
-Version 5 (7.10.0 release)::
-* Rule name changed from: Network Connection via Regsvr
-+
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:network and event.type:connection and
-process.name:(regsvr32.exe or regsvr64.exe) and not
-destination.ip:(10.0.0.0/8 or 169.254.169.254 or 172.16.0.0/12 or
-192.168.0.0/16)
-----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and
+   process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe") and
+   not (
+         (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System") and
+         (process.parent.name : "msiexec.exe" or process.parent.executable : ("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
+       )
+   ]
+  [network where host.os.type == "windows" and process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")  and
+   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+       "FE80::/10", "FF00::/8") and network.protocol != "dns"]
 
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:(regsvr32.exe or regsvr64.exe) and event.action:"Network
-connection detected (rule: NetworkConnect)" and not
-destination.ip:(10.0.0.0/8 or 169.254.169.254 or 172.16.0.0/12 or
-192.168.0.0/16)
 ----------------------------------
 
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-(process.name:regsvr32.exe or process.name:regsvr64.exe) and
-event.action:"Network connection detected (rule: NetworkConnect)" and
-not destination.ip:169.254.169.254/32 and not
-destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not
-destination.ip:192.168.0.0/16
-----------------------------------
+*Framework*: MITRE ATT&CK^TM^
 
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Regsvr32
+** ID: T1218.010
+** Reference URL: https://attack.mitre.org/techniques/T1218/010/
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
index 08f8b8e20a..6ee1d9106a 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
@@ -15,7 +15,7 @@ Binaries signed with trusted digital certificates can execute on Windows systems
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,44 +27,99 @@ Binaries signed with trusted digital certificates can execute on Windows systems
 
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 104
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
 
-*Version*: 100 (<<network-connection-via-signed-binary-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.6.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Network Connection via Signed Binary
+
+By examining the specific traits of Windows binaries (such as process trees, command lines, network connections, registry modifications, and so on) it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
+
+This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+  - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.
+- Investigate the target host that the signed binary is communicating with.
+  - Check if the domain is newly registered or unexpected.
+  - Check the reputation of the domain or IP address.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and command line conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where (process.name :
-"expand.exe" or process.name : "extrac32.exe" or
-process.name : "ieexec.exe" or process.name : "makecab.exe") and
-event.type == "start"] [network where (process.name : "expand.exe"
-or process.name : "extrac32.exe" or process.name :
-"ieexec.exe" or process.name : "makecab.exe") and not
-cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
-"169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
-"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
-"192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
-"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and (process.name : "expand.exe" or process.name : "extrac32.exe" or
+                 process.name : "ieexec.exe" or process.name : "makecab.exe") and
+                 event.type == "start"]
+  [network where host.os.type == "windows" and (process.name : "expand.exe" or process.name : "extrac32.exe" or
+                 process.name : "ieexec.exe" or process.name : "makecab.exe") and
+    not cidrmatch(destination.ip,
+      "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
+      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
+      "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,96 +131,7 @@ cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
 ** Reference URL: https://attack.mitre.org/tactics/TA0002/
-
-[[network-connection-via-signed-binary-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where (process.name :
-"expand.exe" or process.name : "extrac.exe" or
-process.name : "ieexec.exe" or process.name : "makecab.exe") and
-event.type == "start"] [network where (process.name : "expand.exe"
-or process.name : "extrac.exe" or process.name :
-"ieexec.exe" or process.name : "makecab.exe") and not
-cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
-"169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
-"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
-"192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
-"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
-----------------------------------
-
-Version 8 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where (process.name :
-"expand.exe" or process.name : "extrac.exe" or
-process.name : "ieexec.exe" or process.name : "makecab.exe") and
-event.type == "start"] [network where (process.name : "expand.exe"
-or process.name : "extrac.exe" or process.name :
-"ieexec.exe" or process.name : "makecab.exe") and not
-cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12",
-"192.168.0.0/16")]
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:(expand.exe or extrac.exe or ieexec.exe or makecab.exe)
-and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:(expand.exe or extrac.exe or ieexec.exe or makecab.exe)
-and event.action:"Network connection detected (rule: NetworkConnect)"
-and not destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-(process.name:expand.exe or process.name:extrac.exe or
-process.name:ieexec.exe or process.name:makecab.exe) and
-event.action:"Network connection detected (rule: NetworkConnect)" and
-not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and
-not destination.ip:192.168.0.0/16
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
index 8ae3cd7895..7bc5fdd2fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies the modification of the network logon provider registry. Adversaries
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * endgame-*
@@ -14,58 +14,54 @@ Identifies the modification of the network logon provider registry. Adversaries
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
 * https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Credential Access
-* Elastic Endgame
-
-*Version*: 101 (<<network-logon-provider-registry-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Authorized third party network logon providers.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.data.strings != null and registry.path : (
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPat
-h", "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Netwo
-rkProvider\\ProviderPath" ) and /* Excluding default
-NetworkProviders RDPNP, LanmanWorkstation and webclient. */ not (
-user.id : "S-1-5-18" and registry.data.strings in
-("%SystemRoot%\\System32\\ntlanman.dll",
-"%SystemRoot%\\System32\\drprov.dll",
-"%SystemRoot%\\System32\\davclnt.dll") )
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.data.strings != null and
+ registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath"
+ ) and
+ /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */
+ not ( user.id : "S-1-5-18" and
+       registry.data.strings in
+                ("%SystemRoot%\\System32\\ntlanman.dll",
+                 "%SystemRoot%\\System32\\drprov.dll",
+                 "%SystemRoot%\\System32\\davclnt.dll")
+      )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +73,6 @@ user.id : "S-1-5-18" and registry.data.strings in
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -87,34 +81,3 @@ user.id : "S-1-5-18" and registry.data.strings in
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[network-logon-provider-registry-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.data.strings != null and registry.path : "HKL
-M\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath"
-and /* Excluding default NetworkProviders RDPNP, LanmanWorkstation
-and webclient. */ not ( user.id : "S-1-5-18" and
-registry.data.strings in
-("%SystemRoot%\\System32\\ntlanman.dll",
-"%SystemRoot%\\System32\\drprov.dll",
-"%SystemRoot%\\System32\\davclnt.dll") )
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/network-traffic-to-rare-destination-country.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-traffic-to-rare-destination-country.asciidoc
index 091519e77a..4554ecd559 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-traffic-to-rare-destination-country.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-traffic-to-rare-destination-country.asciidoc
@@ -5,52 +5,33 @@ A machine learning job detected a rare destination country name in the network l
 
 *Rule type*: machine_learning
 
-*Machine learning job*: rare_destination_country
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* ML
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Version*: 100 (<<network-traffic-to-rare-destination-country-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.13.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Business workflows that occur very occasionally, and involve a business relationship with an organization in a country that does not routinely appear in network events, can trigger this alert. A new business workflow with an organization in a country with which no workflows previously existed may trigger this alert - although the model will learn that the new destination country is no longer anomalous as the activity becomes ongoing. Business travelers who roam to many countries for brief periods may trigger this alert.
-
-[[network-traffic-to-rare-destination-country-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (7.14.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
index 5761fb7c54..ddcb2a58c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
@@ -5,69 +5,62 @@ Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a n
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
 * https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 101 (<<new-activesyncalloweddeviceid-added-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate exchange system administration activity.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name:
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") and process.args
-: "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and process.args : "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,42 +72,7 @@ process where event.type == "start" and process.name:
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[new-activesyncalloweddeviceid-added-via-powershell-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
-process.args : "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*"
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name: ("powershell.exe", "pwsh.exe") and process.args : "Set-
-CASMailbox*ActiveSyncAllowedDeviceIDs*"
-----------------------------------
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Additional Email Delegate Permissions
+** ID: T1098.002
+** Reference URL: https://attack.mitre.org/techniques/T1098/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
index 8874ff8d55..f208aa691a 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
@@ -5,7 +5,7 @@ Identifies a new or modified federation domain, which can be used to create a tr
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,13 +14,13 @@ Identifies a new or modified federation domain, which can be used to create a tr
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-accepteddomain?view=exchange-ps
 * https://docs.microsoft.com/en-us/powershell/module/exchange/remove-federateddomain?view=exchange-ps
@@ -29,47 +29,40 @@ Identifies a new or modified federation domain, which can be used to create a tr
 * https://docs.microsoft.com/en-us/powershell/module/exchange/set-accepteddomain?view=exchange-ps
 * https://docs.microsoft.com/en-us/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Privilege Escalation
 
-*Version*: 101 (<<new-or-modified-federation-domain-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.16.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:("Set-AcceptedDomain" or "Set-
-MsolDomainFederationSettings" or "Add-FederatedDomain" or "New-
-AcceptedDomain" or "Remove-AcceptedDomain" or "Remove-
-FederatedDomain") and event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Set-AcceptedDomain" or
+"Set-MsolDomainFederationSettings" or "Add-FederatedDomain" or "New-AcceptedDomain" or "Remove-AcceptedDomain" or "Remove-FederatedDomain") and
+event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,28 +74,7 @@ FederatedDomain") and event.outcome:success
 ** Name: Domain Policy Modification
 ** ID: T1484
 ** Reference URL: https://attack.mitre.org/techniques/T1484/
-
-[[new-or-modified-federation-domain-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.category:web and event.action:("Set-AcceptedDomain" or "Set-
-MsolDomainFederationSettings" or "Add-FederatedDomain" or "New-
-AcceptedDomain" or "Remove-AcceptedDomain" or "Remove-
-FederatedDomain") and event.outcome:success
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Domain Trust Modification
+** ID: T1484.002
+** Reference URL: https://attack.mitre.org/techniques/T1484/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc
new file mode 100644
index 0000000000..290b19cb78
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc
@@ -0,0 +1,83 @@
+[[new-systemd-service-created-by-previously-unknown-process]]
+=== New Systemd Service Created by Previously Unknown Process
+
+Systemd service files are configuration files in Linux systems used to define and manage system services. Malicious actors can leverage systemd service files to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://opensource.com/article/20/7/systemd-timers
+* https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type : "linux" and event.action : ("creation" or "file_create_event") and
+file.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or 
+/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not 
+(process.name : ("dpkg" or "dockerd" or "rpm" or "snapd") or file.extension : "swp")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Systemd Service
+** ID: T1543.002
+** Reference URL: https://attack.mitre.org/techniques/T1543/002/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Systemd Service
+** ID: T1543.002
+** Reference URL: https://attack.mitre.org/techniques/T1543/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
new file mode 100644
index 0000000000..b250b4dfb6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -0,0 +1,137 @@
+[[new-systemd-timer-created]]
+=== New Systemd Timer Created
+
+Detects the creation of a systemd timer within any of the default systemd timer directories. Systemd timers can be used by an attacker to gain persistence, by scheduling the execution of a command or script. Similarly to cron/at, systemd timers can be set up to execute on boot time, or on a specific point in time, which allows attackers to regain access in case the connection to the infected asset was lost.
+
+*Rule type*: new_terms
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://opensource.com/article/20/7/systemd-timers
+* https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating New Systemd Timer Created
+
+Systemd timers are used for scheduling and automating recurring tasks or services on Linux systems.
+
+Attackers can leverage systemd timers to run scripts, commands, or malicious software at system boot or on a set time interval by creating a systemd timer and a corresponding systemd service file.
+
+This rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible Investigation Steps
+
+- Investigate the timer file that was created or modified.
+  - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
+- Investigate the currently enabled systemd timers through the following command `sudo systemctl list-timers`.
+- Search for the systemd service file named similarly to the timer that was created.
+- Investigate whether any other files in any of the available systemd directories have been altered through OSQuery.
+  - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE (\npath LIKE '/etc/systemd/system/%' OR \npath LIKE '/usr/local/lib/systemd/system/%' OR \npath LIKE '/lib/systemd/system/%' OR\npath LIKE '/usr/lib/systemd/system/%' OR\npath LIKE '/home/user/.config/systemd/user/%'\n)\n"}}
+  - !{osquery{"label":"Osquery - Retrieve Additional File Listing Information","query":"SELECT\n  f.path,\n  u.username AS file_owner,\n  g.groupname AS group_owner,\n  datetime(f.atime, 'unixepoch') AS file_last_access_time,\n  datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\n  datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\n  datetime(f.btime, 'unixepoch') AS file_created_time,\n  f.size AS size_bytes\nFROM\n  file f\n  LEFT JOIN users u ON f.uid = u.uid\n  LEFT JOIN groups g ON f.gid = g.gid\nWHERE (\npath LIKE '/etc/systemd/system/%' OR \npath LIKE '/usr/local/lib/systemd/system/%' OR \npath LIKE '/lib/systemd/system/%' OR\npath LIKE '/usr/lib/systemd/system/%' OR\npath LIKE '/home/{{user.name}}/.config/systemd/user/%'\n)\n"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+        - Cron jobs, services and other persistence mechanisms.
+            - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
+
+### False Positive Analysis
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If this activity is related to a system administrator who uses systemd timers for administrative purposes, consider adding exceptions for this specific administrator user account.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the service/timer or restore its original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type : "linux" and event.action : ("creation" or "file_create_event") and file.extension : "timer" and
+file.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or
+/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not
+process.executable : ("/usr/bin/dpkg" or "/usr/bin/dockerd" or "/bin/rpm")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Systemd Timers
+** ID: T1053.006
+** Reference URL: https://attack.mitre.org/techniques/T1053/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc
index 1fe1683ffd..b03262fdf5 100644
--- a/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc
@@ -5,57 +5,51 @@ Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the abil
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://en.wikipedia.org/wiki/Nmap
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Discovery
-
-*Version*: 100 (<<nping-process-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:nping
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:nping
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -67,41 +61,3 @@ process.name:nping
 ** Name: Network Service Discovery
 ** ID: T1046
 ** Reference URL: https://attack.mitre.org/techniques/T1046/
-
-[[nping-process-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:nping and event.action:executed
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name: nping and event.action:executed
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc b/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
index 97535857c7..3e7db515dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
@@ -5,7 +5,7 @@ Identifies a copy operation of the Active Directory Domain Database (ntds.dit) o
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,62 +16,59 @@ Identifies a copy operation of the Active Directory Domain Database (ntds.dit) o
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*References*:
+*References*: 
 
 * https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
 * https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 102 (<<ntds-or-sam-database-file-copied-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (
-(process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",
-"XCOPY.EXE") and process.args : ("copy", "xcopy", "Copy-Item",
-"move", "cp", "mv") ) or (process.pe.original_file_name :
-"esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*")) ) and
-process.args : ("*\\ntds.dit", "*\\config\\SAM",
-"\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*",
-"*/system32/config/SAM*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    (process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE") and
+       process.args : ("copy", "xcopy", "Copy-Item", "move", "cp", "mv")
+    ) or
+    (process.pe.original_file_name : "esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*"))
+  ) and
+  process.args : ("*\\ntds.dit", "*\\config\\SAM", "\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*", "*/system32/config/SAM*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,53 +80,7 @@ process.args : ("*\\ntds.dit", "*\\config\\SAM",
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[ntds-or-sam-database-file-copied-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-(process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",
-"XCOPY.EXE") and process.args : ("copy", "xcopy", "Copy-Item",
-"move", "cp", "mv") ) or (process.pe.original_file_name :
-"esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*")) ) and
-process.args : ("*\\ntds.dit", "*\\config\\SAM",
-"\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*",
-"*/system32/config/SAM*")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",
-"XCOPY.EXE") and process.args : ("copy", "xcopy", "Copy-Item",
-"move", "cp", "mv") and process.args : ("*\\ntds.dit",
-"*\\config\\SAM",
-"\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc
index 39c5322711..eb2531024b 100644
--- a/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc
@@ -5,54 +5,55 @@ Identifies NullSessionPipe registry modifications that specify which pipes can b
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 101 (<<nullsessionpipe-registry-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and registry.path
-: "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\Nul
-lSessionPipes" and length(registry.data.strings) > 0
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes"
+) and length(registry.data.strings) > 0
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,26 +65,7 @@ lSessionPipes" and length(registry.data.strings) > 0
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[nullsessionpipe-registry-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\services\\
-LanmanServer\\Parameters\\NullSessionPipes" and registry.data.strings
-!= null
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
index 9b141d1b34..76b61db1c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
@@ -5,7 +5,7 @@ Detects the occurrence of emails reported as Phishing or Malware by Users. Secur
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,59 +14,47 @@ Detects the occurrence of emails reported as Phishing or Malware by Users. Secur
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.microsoft.com/en-us/office/use-the-report-message-add-in-b5caa9f1-cdf3-4443-af8c-ff724ea719d2?ui=en-us&rs=en-us&ad=us
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Initial Access
-
-*Version*: 101 (<<o365-email-reported-by-user-as-malware-or-phish-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate files reported by the users
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:SecurityComplianceCenter
-and event.action:AlertTriggered and rule.name:"Email reported by user
-as malware or phish"
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.action:AlertTriggered and rule.name:"Email reported by user as malware or phish"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,16 +66,11 @@ as malware or phish"
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[o365-email-reported-by-user-as-malware-or-phish-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
index 6df1447d85..a0adae461e 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
@@ -5,7 +5,7 @@ Identifies accounts with a high number of single sign-on (SSO) logon errors. Exc
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,55 +14,47 @@ Identifies accounts with a high number of single sign-on (SSO) logon errors. Exc
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+*Tags*: 
 
-*Version*: 101 (<<o365-excessive-single-sign-on-logon-errors-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:AzureActiveDirectory and
-event.category:authentication and
-o365.audit.LogonError:"SsoArtifactInvalidOrExpired"
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:authentication and o365.audit.LogonError:"SsoArtifactInvalidOrExpired"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,32 +66,3 @@ o365.audit.LogonError:"SsoArtifactInvalidOrExpired"
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[o365-excessive-single-sign-on-logon-errors-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:AzureActiveDirectory and
-event.category:web and
-o365.audit.LogonError:"SsoArtifactInvalidOrExpired"
-----------------------------------
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
index 7227e1a302..6a213ab097 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
@@ -5,7 +5,7 @@ Identifies the assignment of rights to access content from another mailbox. An a
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,57 +14,49 @@ Identifies the assignment of rights to access content from another mailbox. An a
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
+*Tags*: 
 
-*Version*: 101 (<<o365-exchange-suspicious-mailbox-right-delegation-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Assignment of rights to a service account.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.action:Add-MailboxPermission and
-o365.audit.Parameters.AccessRights:(FullAccess or SendAs or
-SendOnBehalf) and event.outcome:success and not user.id : "NT
-AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)"
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.action:Add-MailboxPermission and
+o365.audit.Parameters.AccessRights:(FullAccess or SendAs or SendOnBehalf) and event.outcome:success and
+not user.id : "NT AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,36 +68,7 @@ AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)"
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[o365-exchange-suspicious-mailbox-right-delegation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.action:Add-MailboxPermission and
-o365.audit.Parameters.AccessRights:(FullAccess or SendAs or
-SendOnBehalf) and event.outcome:success and not user.id : "NT
-AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)"
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.action:Add-MailboxPermission and
-o365.audit.Parameters.AccessRights:(FullAccess or SendAs or
-SendOnBehalf) and event.outcome:success
-----------------------------------
-
+* Sub-technique:
+** Name: Additional Email Delegate Permissions
+** ID: T1098.002
+** Reference URL: https://attack.mitre.org/techniques/T1098/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
index c6d206b69e..f7971d947f 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
@@ -5,7 +5,7 @@ Detects the occurrence of mailbox audit bypass associations. The mailbox audit i
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,59 +14,48 @@ Detects the occurrence of mailbox audit bypass associations. The mailbox audit i
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://twitter.com/misconfig/status/1476144066807140355
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Initial Access
-
-*Version*: 101 (<<o365-mailbox-audit-logging-bypass-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Tactic: Initial Access
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate allowlisting of noisy accounts
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:Exchange and
-event.action:Set-MailboxAuditBypassAssociation and
-event.outcome:success
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.action:Set-MailboxAuditBypassAssociation and event.outcome:success
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,19 +67,7 @@ event.outcome:success
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[o365-mailbox-audit-logging-bypass-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc
index cdb53df530..00c0bf0956 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc
@@ -5,7 +5,7 @@ Identifies a high number of failed Okta user authentication attempts from a sing
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,60 +14,77 @@ Identifies a high number of failed Okta user authentication attempts from a sing
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<okta-brute-force-or-password-spraying-attack-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Okta Brute Force or Password Spraying Attack
 
+This rule alerts when a high number of failed Okta user authentication attempts occur from a single IP address. This could be indicative of a brute force or password spraying attack, where an adversary may attempt to gain unauthorized access to user accounts by guessing the passwords.
 
-==== Rule query
+#### Possible investigation steps:
+
+- Review the `source.ip` field to identify the IP address from which the high volume of failed login attempts originated.
+- Look into the `event.outcome` field to verify that these are indeed failed authentication attempts.
+- Determine the `user.name` or `user.email` related to these failed login attempts. If the attempts are spread across multiple accounts, it might indicate a password spraying attack.
+- Check the timeline of the events. Are the failed attempts spread out evenly, or are there burst periods, which might indicate an automated tool?
+- Determine the geographical location of the source IP. Is this location consistent with the user's typical login location?
+- Analyze any previous successful logins from this IP. Was this IP previously associated with successful logins?
 
+### False positive analysis:
 
-[source,js]
+- A single user or automated process that attempts to authenticate using expired or wrong credentials multiple times may trigger a false positive.
+- Analyze the behavior of the source IP. If the IP is associated with legitimate users or services, it may be a false positive.
+
+### Response and remediation:
+
+- If you identify unauthorized access attempts, consider blocking the source IP at the firewall level.
+- Notify the users who are targeted by the attack. Ask them to change their passwords and ensure they use unique, complex passwords.
+- Enhance monitoring on the affected user accounts for any suspicious activity.
+- If the attack is persistent, consider implementing CAPTCHA or account lockouts after a certain number of failed login attempts.
+- If the attack is persistent, consider implementing multi-factor authentication (MFA) for the affected user accounts.
+- Review and update your security policies based on the findings from the incident.
 ----------------------------------
-event.dataset:okta.system and event.category:authentication and
-event.outcome:failure
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.category:authentication and event.outcome:failure
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,34 +96,3 @@ event.outcome:failure
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[okta-brute-force-or-password-spraying-attack-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.category:authentication and event.outcome:failure
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc
new file mode 100644
index 0000000000..2c8ba5a299
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc
@@ -0,0 +1,62 @@
+[[okta-threatinsight-threat-suspected-promotion]]
+=== Okta ThreatInsight Threat Suspected Promotion
+
+Okta ThreatInsight is a feature that provides valuable debug data regarding authentication and authorization processes, which is logged in the system. Within this data, there is a specific field called threat_suspected, which represents Okta's internal evaluation of the authentication or authorization workflow. When this field is set to True, it suggests the presence of potential credential access techniques, such as password-spraying, brute-forcing, replay attacks, and other similar threats.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.html
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+This is a promotion rule for Okta ThreatInsight suspected threat events, which are alertable events per the vendor.
+Consult vendor documentation on interpreting specific events.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and (event.action:security.threat.detected or okta.debug_context.debug_data.threat_suspected: true)
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc
index 28b724dbd1..eac1b3fa85 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc
@@ -5,7 +5,7 @@ A user has initiated a session impersonation granting them access to the environ
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,56 +14,75 @@ A user has initiated a session impersonation granting them access to the environ
 
 *Risk score*: 73
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Credential Access
-
-*Version*: 102 (<<okta-user-session-impersonation-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Okta User Session Impersonation
 
+The detection of an Okta User Session Impersonation indicates that a user has initiated a session impersonation which grants them access with the permissions of the user they are impersonating. This type of activity typically indicates Okta administrative access and should only ever occur if requested and expected.
 
-==== Rule query
+#### Possible investigation steps
+
+- Identify the actor associated with the impersonation event by checking the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
+- Review the `event.action` field to confirm the initiation of the impersonation event.
+- Check the `event.time` field to understand the timing of the event.
+- Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the user who was impersonated.
+- Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.
+
+### False positive analysis
 
+- Verify if the session impersonation was part of an approved activity. Check if it was associated with any documented administrative tasks or troubleshooting efforts.
+- Ensure that the impersonation session was initiated by an authorized individual. You can check this by verifying the `okta.actor.id` or `okta.actor.display_name` against the list of approved administrators.
 
-[source,js]
+### Response and remediation
+
+- If the impersonation was not authorized, consider it as a breach. Suspend the user account of the impersonator immediately.
+- Reset the user session and invalidate any active sessions related to the impersonated user.
+- If a specific impersonation technique was used, ensure that systems are patched or configured to prevent such techniques.
+- Conduct a thorough investigation to understand the extent of the breach and the potential impact on the systems and data.
+- Review and update your security policies to prevent such incidents in the future.
+- Implement additional monitoring and logging of Okta events to improve visibility of user actions.
 ----------------------------------
-event.dataset:okta.system and
-event.action:user.session.impersonation.initiate
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:user.session.impersonation.initiate
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -71,16 +90,3 @@ event.action:user.session.impersonation.initiate
 ** Name: Credential Access
 ** ID: TA0006
 ** Reference URL: https://attack.mitre.org/tactics/TA0006/
-
-[[okta-user-session-impersonation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc b/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
index e2722498e1..32c8337f39 100644
--- a/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
@@ -5,7 +5,7 @@ Identifies the occurence of files uploaded to OneDrive being detected as Malware
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,59 +14,47 @@ Identifies the occurence of files uploaded to OneDrive being detected as Malware
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Lateral Movement
-
-*Version*: 101 (<<onedrive-malware-file-upload-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Benign files can trigger signatures in the built-in virus protection
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:OneDrive and
-event.code:SharePointFileOperation and
-event.action:FileMalwareDetected
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:OneDrive and event.code:SharePointFileOperation and event.action:FileMalwareDetected
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,16 +66,3 @@ event.action:FileMalwareDetected
 ** Name: Taint Shared Content
 ** ID: T1080
 ** Reference URL: https://attack.mitre.org/techniques/T1080/
-
-[[onedrive-malware-file-upload-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc
index 47c8a7f4f3..f207f47554 100644
--- a/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc
@@ -5,7 +5,7 @@ Identifies the PowerShell process loading the Task Scheduler COM DLL followed by
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,54 +15,43 @@ Identifies the PowerShell process loading the Task Scheduler COM DLL followed by
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-
-*Version*: 100 (<<outbound-scheduled-task-activity-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks may be created during installation of new software.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 5s [any where
-(event.category == "library" or (event.category == "process" and
-event.action : "Image loaded*")) and (dll.name : "taskschd.dll" or
-file.name : "taskschd.dll") and process.name : ("powershell.exe",
-"pwsh.exe", "powershell_ise.exe")] [network where process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
-destination.port == 135 and not destination.address in ("127.0.0.1",
-"::1")]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id with maxspan = 5s
+ [any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  (dll.name : "taskschd.dll" or file.name : "taskschd.dll") and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")]
+ [network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not destination.address in ("127.0.0.1", "::1")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,47 +63,7 @@ destination.port == 135 and not destination.address in ("127.0.0.1",
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[outbound-scheduled-task-activity-via-powershell-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 5s [library
-where dll.name : "taskschd.dll" and process.name : ("powershell.exe",
-"pwsh.exe", "powershell_ise.exe")] [network where process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
-destination.port == 135 and not destination.address in ("127.0.0.1",
-"::1")]
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 5s [library
-where dll.name : "taskschd.dll" and process.name : ("powershell.exe",
-"pwsh.exe")] [network where process.name : ("powershell.exe",
-"pwsh.exe") and destination.port == 135 and not destination.address in
-("127.0.0.1", "::1")]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 5s [library
-where file.name: "taskschd.dll" and process.name: ("powershell.exe",
-"pwsh.exe")] [network where process.name : ("powershell.exe",
-"pwsh.exe") and destination.port == 135 and not destination.address in
-("127.0.0.1", "::1")]
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc
index 33e01aa5e9..12149bd1ab 100644
--- a/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc
@@ -5,7 +5,7 @@ Identifies parent process spoofing used to thwart detection. Adversaries may spo
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,61 +13,78 @@ Identifies parent process spoofing used to thwart detection. Adversaries may spo
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.didierstevens.com/2017/03/20/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<parent-process-pid-spoofing-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* This rule is compatible with Elastic Endpoint only */ sequence by
-host.id, user.id with maxspan=5m [process where event.type == "start"
-and process.Ext.token.integrity_level_name != "system" and (
-process.pe.original_file_name : ("winword.exe", "excel.exe",
-"outlook.exe", "powerpnt.exe", "eqnedt32.exe",
-"fltldr.exe", "mspub.exe", "msaccess.exe", "powershell.exe",
-"pwsh.exe", "cscript.exe",
-"wscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe",
-"mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or
-process.executable : ("?:\\Users\\*.exe",
-"?:\\ProgramData\\*.exe",
-"?:\\Windows\\Microsoft.NET\\*.exe",
-"?:\\Windows\\Temp\\*.exe",
-"?:\\Windows\\Tasks\\*") or process.code_signature.trusted != true
-) ] by process.pid [process where event.type == "start" and
-process.parent.Ext.real.pid > 0 and /* process.parent.Ext.real.pid
-is only populated if the parent process pid doesn't match */ not
-(process.name : "msedge.exe" and process.parent.name : "sihost.exe")
-] by process.parent.Ext.real.pid
+[source, js]
 ----------------------------------
+/* This rule is compatible with Elastic Endpoint only */
+
+sequence by host.id, user.id with maxspan=3m 
+
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.Ext.token.integrity_level_name != "system" and 
+  (
+    process.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe",
+                                     "fltldr.exe", "mspub.exe", "msaccess.exe", "powershell.exe", "pwsh.exe",
+                                     "cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe",
+                                     "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or 
+                                     
+    (process.executable : ("?:\\Users\\*.exe",
+                           "?:\\ProgramData\\*.exe",
+                           "?:\\Windows\\Temp\\*.exe",
+                           "?:\\Windows\\Tasks\\*") and 
+      (process.code_signature.exists == false or process.code_signature.status : "errorBadDigest")) or 
+                          
+    process.executable : "?:\\Windows\\Microsoft.NET\\*.exe"                      
+  ) and 
+  
+  not process.executable : 
+             ("?:\\Windows\\System32\\WerFaultSecure.exe", 
+              "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
+              "?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe")
+  ] by process.pid
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.parent.Ext.real.pid > 0 and 
+ 
+  /* process.parent.Ext.real.pid is only populated if the parent process pid doesn't match */
+  not (process.name : "msedge.exe" and process.parent.name : "sihost.exe") and 
+  
+   not process.executable : 
+             ("?:\\Windows\\System32\\WerFaultSecure.exe", 
+              "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
+              "?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe")
+ ] by process.parent.Ext.real.pid
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,36 +96,7 @@ is only populated if the parent process pid doesn't match */ not
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[parent-process-pid-spoofing-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* This rule is compatible with Elastic Endpoint only */ sequence by
-host.id, user.id with maxspan=5m [process where event.type == "start"
-and process.Ext.token.integrity_level_name != "system" and (
-process.pe.original_file_name : ("winword.exe", "excel.exe",
-"outlook.exe", "powerpnt.exe", "eqnedt32.exe",
-"fltldr.exe", "mspub.exe", "msaccess.exe", "powershell.exe",
-"pwsh.exe", "cscript.exe",
-"wscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe",
-"mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or
-process.executable : ("?:\\Users\\*.exe",
-"?:\\ProgramData\\*.exe",
-"?:\\Windows\\Microsoft.NET\\*.exe",
-"?:\\Windows\\Temp\\*.exe",
-"?:\\Windows\\Tasks\\*") or process.code_signature.trusted != true
-) ] by process.pid [process where event.type == "start" and
-process.parent.Ext.real.pid > 0 and /* process.parent.Ext.real.pid
-is only populated if the parent process pid doesn't match */ not
-(process.name : "msedge.exe" and process.parent.name : "sihost.exe")
-] by process.parent.Ext.real.pid
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Parent PID Spoofing
+** ID: T1134.004
+** Reference URL: https://attack.mitre.org/techniques/T1134/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
index c3687dc4a0..1dd3cd6772 100644
--- a/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the Windows file system utility (fsutil.exe) to gather informa
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,91 +16,77 @@ Identifies use of the Windows file system utility (fsutil.exe) to gather informa
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<peripheral-device-discovery-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Peripheral Device Discovery
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `fsutil` utility with the `fsinfo` subcommand to enumerate drives attached to
-the computer, which can be used to identify secondary drives used for backups, mapped network drives, and removable
-media. These devices can contain valuable information for attackers.
+This rule looks for the execution of the `fsutil` utility with the `fsinfo` subcommand to enumerate drives attached to the computer, which can be used to identify secondary drives used for backups, mapped network drives, and removable media. These devices can contain valuable information for attackers.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Determine whether this activity was followed by suspicious file access/copy operations or uploads to file storage
-services.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Determine whether this activity was followed by suspicious file access/copy operations or uploads to file storage services.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "fsutil.exe"
-or process.pe.original_file_name == "fsutil.exe") and process.args :
-"fsinfo" and process.args : "drives"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "fsutil.exe" or process.pe.original_file_name == "fsutil.exe") and
+  process.args : "fsinfo" and process.args : "drives"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -112,44 +98,3 @@ or process.pe.original_file_name == "fsutil.exe") and process.args :
 ** Name: Peripheral Device Discovery
 ** ID: T1120
 ** Reference URL: https://attack.mitre.org/techniques/T1120/
-
-[[peripheral-device-discovery-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "fsutil.exe" or process.pe.original_file_name ==
-"fsutil.exe") and process.args : "fsinfo" and process.args :
-"drives"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "fsutil.exe" or process.pe.original_file_name ==
-"fsutil.exe") and process.args : "fsinfo" and process.args :
-"drives"
-----------------------------------
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/permission-theft-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/permission-theft-detected-elastic-endgame.asciidoc
index eac825819e..1b4fdc12ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/permission-theft-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/permission-theft-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected Permission Theft. Click the Elastic Endgame icon in the
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,37 @@ Elastic Endgame detected Permission Theft. Click the Elastic Endgame icon in the
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<permission-theft-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and
-(event.action:token_protection_event or
-endgame.event_subtype_full:token_protection_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,35 +55,3 @@ endgame.event_subtype_full:token_protection_event)
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[permission-theft-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Permission Theft - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Permission Theft - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Permission Theft - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:token_protection_event and
-endgame.metadata.type:detection
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/permission-theft-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/permission-theft-prevented-elastic-endgame.asciidoc
index 53d68054c5..124a43c8b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/permission-theft-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/permission-theft-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented Permission Theft. Click the Elastic Endgame icon in th
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,37 @@ Elastic Endgame prevented Permission Theft. Click the Elastic Endgame icon in th
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<permission-theft-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and
-(event.action:token_protection_event or
-endgame.event_subtype_full:token_protection_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,35 +55,3 @@ endgame.event_subtype_full:token_protection_event)
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[permission-theft-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Permission Theft - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Permission Theft - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Permission Theft - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:token_protection_event and
-endgame.metadata.type:prevention
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
index f35560ea03..25a8464f39 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
@@ -5,71 +5,69 @@ An adversary can use the Background Intelligent Transfer Service (BITS) SetNotif
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://pentestlab.blog/2019/10/30/persistence-bits-jobs/
 * https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline
 * https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-setnotifycmdline
 * https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-bits-job-notify-cmdline-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"svchost.exe" and process.parent.args : "BITS" and not
-process.executable :
-("?:\\Windows\\System32\\WerFaultSecure.exe",
-"?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\System32\\wermgr.exe",
-"?:\\WINDOWS\\system32\\directxdatabaseupdater.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "svchost.exe" and process.parent.args : "BITS" and
+  not process.executable :
+              ("?:\\Windows\\System32\\WerFaultSecure.exe",
+               "?:\\Windows\\System32\\WerFault.exe",
+               "?:\\Windows\\System32\\wermgr.exe",
+               "?:\\WINDOWS\\system32\\directxdatabaseupdater.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,16 +79,3 @@ process.executable :
 ** Name: BITS Jobs
 ** ID: T1197
 ** Reference URL: https://attack.mitre.org/techniques/T1197/
-
-[[persistence-via-bits-job-notify-cmdline-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
index d39226539a..e79b6c0cef 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of a DirectoryService PlugIns (dsplug) f
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,44 +14,41 @@ Identifies the creation or modification of a DirectoryService PlugIns (dsplug) f
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.chichou.me/2019/11/21/two-macos-persistence-tricks-abusing-plugins/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-directoryservice-plugin-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.path:/Library/DirectoryServices/PlugIns/*.dsplug
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and not event.type:deletion and
+  file.path:/Library/DirectoryServices/PlugIns/*.dsplug
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,13 +60,3 @@ file.path:/Library/DirectoryServices/PlugIns/*.dsplug
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[persistence-via-directoryservice-plugin-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
index f73ae68e91..55f27715dd 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
@@ -5,7 +5,7 @@ An adversary can establish persistence by modifying an existing macOS dock prope
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ An adversary can establish persistence by modifying an existing macOS dock prope
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-docker-shortcut-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category : file and event.action : modification and file.path :
-/Users/*/Library/Preferences/com.apple.dock.plist and not
-process.name : (xpcproxy or cfprefsd or plutil or jamf or PlistBuddy
-or InstallerRemotePluginService)
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and event.action:modification and
+ file.path:/Users/*/Library/Preferences/com.apple.dock.plist and
+ not process.name:(xpcproxy or cfprefsd or plutil or jamf or PlistBuddy or InstallerRemotePluginService)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,24 +61,3 @@ or InstallerRemotePluginService)
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[persistence-via-docker-shortcut-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category : file and event.action : modification and file.path
-: /Users/*/Library/Preferences/com.apple.dock.plist and not
-process.name : (xpcproxy or cfprefsd or plutil or jamf or PlistBuddy
-or InstallerRemotePluginService)
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
index 772c60a87c..d7713ec92f 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
@@ -5,7 +5,7 @@ Detects modification of a Folder Action script. A Folder Action script is execut
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,45 @@ Detects modification of a Folder Action script. A Folder Action script is execut
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Execution
-* Persistence
-
-*Version*: 100 (<<persistence-via-folder-action-script-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name ==
-"com.apple.foundation.UserScriptService"] by process.pid [process
-where event.type in ("start", "process_started") and process.name in
-("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash",
-"csh", "zsh", "sh") and not process.args :
-"/Users/*/Library/Application
-Support/iTerm2/Scripts/AutoLaunch/*.scpt" ] by process.parent.pid
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=5s
+ [process where host.os.type == "macos" and event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh") and
+  not process.args : "/Users/*/Library/Application Support/iTerm2/Scripts/AutoLaunch/*.scpt"
+ ] by process.parent.pid
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,8 +64,6 @@ Support/iTerm2/Scripts/AutoLaunch/*.scpt" ] by process.parent.pid
 ** Name: Boot or Logon Initialization Scripts
 ** ID: T1037
 ** Reference URL: https://attack.mitre.org/techniques/T1037/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -80,53 +72,3 @@ Support/iTerm2/Scripts/AutoLaunch/*.scpt" ] by process.parent.pid
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[persistence-via-folder-action-script-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name ==
-"com.apple.foundation.UserScriptService"] by process.pid [process
-where event.type in ("start", "process_started") and process.name in
-("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash",
-"csh", "zsh", "sh")] by process.parent.pid
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name ==
-"com.apple.foundation.UserScriptService"] by process.pid [process
-where event.type in ("start", "process_started") and process.name in
-("osascript", "sh")] by process.parent.pid
-----------------------------------
-
-Version 3 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name ==
-"com.apple.foundation.UserScriptService"] by process.pid [process
-where event.type in ("start", "process_started") and process.name in
-("osascript", "sh")] by process.ppid
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
index 457c24c29d..8efdbbf250 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
@@ -5,73 +5,74 @@ Identifies a persistence mechanism that utilizes the NtSetValueKey native API to
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/outflanknl/SharpHide
 * https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-hidden-run-key-detected-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* Registry Path ends with backslash */ registry where /*
-length(registry.data.strings) > 0 and */ registry.path :
-("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\
-\", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\Cu
-rrentVersion\\Policies\\Explorer\\Run\\", "HKU\\*\\S
-oftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\
-", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersi
-on\\Policies\\Explorer\\Run\\")
+[source, js]
 ----------------------------------
+/* Registry Path ends with backslash */
+registry where host.os.type == "windows" and /* length(registry.data.strings) > 0 and */
+ registry.path : ("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -83,53 +84,7 @@ on\\Policies\\Explorer\\Run\\")
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[persistence-via-hidden-run-key-detected-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Registry Path ends with backslash */ registry where /*
-length(registry.data.strings) > 0 and */ registry.path :
-("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\
-\", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\Policies\\Explorer\\Run\\", "HKU\\*\\
-Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\
-\", "HKLM\\Software\\Microsoft\\Windows\\CurrentVers
-ion\\Policies\\Explorer\\Run\\")
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Registry Path ends with backslash */ registry where /*
-length(registry.data.strings) > 0 and */ registry.path :
-("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
-"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\
-\", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\Policies\\Explorer\\Run\\", "HKLM\\S
-oftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\
-")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
index 5dbe1e7718..debf7c72eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
@@ -5,74 +5,74 @@ Identifies the creation or modification of a K Desktop Environment (KDE) AutoSta
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://userbase.kde.org/System_Settings/Autostart
 * https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/
 * https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-kde-autostart-script-or-desktop-file-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.extension in ("sh",
-"desktop") and file.path : (
-"/home/*/.config/autostart/*", "/root/.config/autostart/*",
-"/home/*/.kde/Autostart/*", "/root/.kde/Autostart/*",
-"/home/*/.kde4/Autostart/*", "/root/.kde4/Autostart/*",
-"/home/*/.kde/share/autostart/*", "/root/.kde/share/autostart/*",
-"/home/*/.kde4/share/autostart/*", "/root/.kde4/share/autostart/*",
-"/home/*/.local/share/autostart/*", "/root/.local/share/autostart/*",
-"/home/*/.config/autostart-scripts/*", "/root/.config/autostart-
-scripts/*", "/etc/xdg/autostart/*", "/usr/share/autostart/*"
-) and not process.name in ("yum", "dpkg", "install", "dnf",
-"teams", "yum-cron", "dnf-automatic")
+[source, js]
 ----------------------------------
+file where host.os.type == "linux" and event.type != "deletion" and
+  file.extension in ("sh", "desktop") and
+  file.path :
+    (
+      "/home/*/.config/autostart/*", "/root/.config/autostart/*",
+      "/home/*/.kde/Autostart/*", "/root/.kde/Autostart/*",
+      "/home/*/.kde4/Autostart/*", "/root/.kde4/Autostart/*",
+      "/home/*/.kde/share/autostart/*", "/root/.kde/share/autostart/*",
+      "/home/*/.kde4/share/autostart/*", "/root/.kde4/share/autostart/*",
+      "/home/*/.local/share/autostart/*", "/root/.local/share/autostart/*",
+      "/home/*/.config/autostart-scripts/*", "/root/.config/autostart-scripts/*",
+      "/etc/xdg/autostart/*", "/usr/share/autostart/*"
+    ) and
+    not process.name in ("yum", "dpkg", "install", "dnf", "teams", "yum-cron", "dnf-automatic")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,31 +84,3 @@ scripts/*", "/etc/xdg/autostart/*", "/usr/share/autostart/*"
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[persistence-via-kde-autostart-script-or-desktop-file-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and file.extension in ("sh",
-"desktop") and file.path : (
-"/home/*/.config/autostart/*", "/root/.config/autostart/*",
-"/home/*/.kde/Autostart/*", "/root/.kde/Autostart/*",
-"/home/*/.kde4/Autostart/*", "/root/.kde4/Autostart/*",
-"/home/*/.kde/share/autostart/*", "/root/.kde/share/autostart/*",
-"/home/*/.kde4/share/autostart/*", "/root/.kde4/share/autostart/*",
-"/home/*/.local/share/autostart/*", "/root/.local/share/autostart/*",
-"/home/*/.config/autostart-scripts/*", "/root/.config/autostart-
-scripts/*", "/etc/xdg/autostart/*", "/usr/share/autostart/*"
-)
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
index 4add0902fd..9715acec83 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the Defaults command to install a login or logoff hook in MacO
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,61 +14,57 @@ Identifies use of the Defaults command to install a login or logoff hook in MacO
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.virusbulletin.com/uploads/pdf/conference_slides/2014/Wardle-VB2014.pdf
 * https://www.manpagez.com/man/1/defaults/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-login-or-logout-hook-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name == "defaults"
-and process.args == "write" and process.args in ("LoginHook",
-"LogoutHook") and not process.args : (
-"Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
-"Support/JAMF/ManagementFrameworkScripts/loginhook.sh",
-"/Library/Application
-Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
-"/Library/Application
-Support/JAMF/ManagementFrameworkScripts/loginhook.sh" )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type == "start" and
+ process.name == "defaults" and process.args == "write" and process.args : ("LoginHook", "LogoutHook") and
+ not process.args :
+       (
+         "Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
+         "Support/JAMF/ManagementFrameworkScripts/loginhook.sh",
+         "/Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
+         "/Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh"
+       )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,32 +76,3 @@ Support/JAMF/ManagementFrameworkScripts/loginhook.sh" )
 ** Name: Boot or Logon Initialization Scripts
 ** ID: T1037
 ** Reference URL: https://attack.mitre.org/techniques/T1037/
-
-[[persistence-via-login-or-logout-hook-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name == "defaults" and process.args == "write" and
-process.args in ("LoginHook", "LogoutHook")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
index 859da722cb..e6b5b96048 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
@@ -5,66 +5,67 @@ Detects attempts to establish persistence on an endpoint by abusing Microsoft Of
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-microsoft-office-addins-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.extension :
-("wll","xll","ppa","ppam","xla","xlam") and file.path : (
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" )
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+ file.extension : ("wll","xll","ppa","ppam","xla","xlam") and
+ file.path :
+    (
+    "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
+    "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
+    "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,32 +77,3 @@ file where event.type != "deletion" and file.extension :
 ** Name: Office Application Startup
 ** ID: T1137
 ** Reference URL: https://attack.mitre.org/techniques/T1137/
-
-[[persistence-via-microsoft-office-addins-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and
-wildcard(file.extension,"wll","xll","ppa","ppam","xla","xlam") and
-wildcard(file.path,
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
index 3aa3c2b542..2f72470674 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
@@ -5,68 +5,62 @@ Detects attempts to establish persistence on an endpoint by installing a rogue M
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
 * https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<persistence-via-microsoft-outlook-vba-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A legitimate VBA for Outlook is usually configured interactively via OUTLOOK.EXE.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.path :
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+ file.path : "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,28 +72,3 @@ file where event.type != "deletion" and file.path :
 ** Name: Office Application Startup
 ** ID: T1137
 ** Reference URL: https://attack.mitre.org/techniques/T1137/
-
-[[persistence-via-microsoft-outlook-vba-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and wildcard(file.path,
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
index 6e4ac7163f..087d5c6061 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
@@ -5,56 +5,57 @@ Identifies the creation or modification of a PowerShell profile. PowerShell prof
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles
 * https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Version*: 1
+*Version*: 4
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.path :
-("?:\\Users\\*\\Documents\\WindowsPowerShell\\*",
-"?:\\Users\\*\\Documents\\PowerShell\\*",
-"?:\\Windows\\System32\\WindowsPowerShell\\*") and file.name :
-("profile.ps1", "Microsoft.Powershell_profile.ps1")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.path : ("?:\\Users\\*\\Documents\\WindowsPowerShell\\*",
+               "?:\\Users\\*\\Documents\\PowerShell\\*",
+               "?:\\Windows\\System32\\WindowsPowerShell\\*") and
+  file.name : ("profile.ps1", "Microsoft.Powershell_profile.ps1")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,3 +67,7 @@ file where event.type != "deletion" and file.path :
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: PowerShell Profile
+** ID: T1546.013
+** Reference URL: https://attack.mitre.org/techniques/T1546/013/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
index b03c750d44..12c23c21eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
@@ -5,63 +5,59 @@ A job can be used to schedule programs or scripts to be executed at a specified
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<persistence-via-scheduled-job-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled jobs may be created during installation of new software.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.path :
-"?:\\Windows\\Tasks\\*" and file.extension : "job"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+ file.path : "?:\\Windows\\Tasks\\*" and file.extension : "job"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,19 +69,7 @@ file where event.type != "deletion" and file.path :
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[persistence-via-scheduled-job-creation-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
index 100752b7ff..330d6401fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
@@ -5,66 +5,67 @@ Detects the successful hijack of Microsoft Compatibility Appraiser scheduled tas
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
-* https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/?utm_content=131234033&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306
+* https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 101 (<<persistence-via-telemetrycontroller-scheduled-task-hijack-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"CompatTelRunner.exe" and process.args : "-cv*" and not process.name
-: ("conhost.exe", "DeviceCensus.exe",
-"CompatTelRunner.exe", "DismHost.exe",
-"rundll32.exe", "powershell.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "CompatTelRunner.exe" and process.args : "-cv*" and
+  not process.name : ("conhost.exe",
+                      "DeviceCensus.exe",
+                      "CompatTelRunner.exe",
+                      "DismHost.exe",
+                      "rundll32.exe",
+                      "powershell.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,60 +77,7 @@ process where event.type == "start" and process.parent.name :
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[persistence-via-telemetrycontroller-scheduled-task-hijack-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "CompatTelRunner.exe" and process.args : "-cv*"
-and not process.name : ("conhost.exe",
-"DeviceCensus.exe", "CompatTelRunner.exe",
-"DismHost.exe", "rundll32.exe",
-"powershell.exe")
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.16.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:(CompatTelRunner.exe or compattelrunner.exe) and
-process.args:-cv* and not process.name:(conhost.exe or
-DeviceCensus.exe or devicecensus.exe or CompatTelRunner.exe or
-compattelrunner.exe or DismHost.exe or dismhost.exe or rundll32.exe or
-powershell.exe)
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:(CompatTelRunner.exe or compattelrunner.exe) and
-not process.name:(conhost.exe or DeviceCensus.exe or devicecensus.exe
-or CompatTelRunner.exe or compattelrunner.exe or DismHost.exe or
-dismhost.exe or rundll32.exe)
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index d3322c6bce..ef23555641 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -10,12 +10,13 @@ Identifies potential hijacking of the Microsoft Update Orchestrator Service to e
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,68 +28,59 @@ Identifies potential hijacking of the Microsoft Update Orchestrator Service to e
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* CVE-2020-1313
-* Investigation Guide
-
-*Version*: 102 (<<persistence-via-update-orchestrator-service-hijack-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Use Case: Vulnerability
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Persistence via Update Orchestrator Service Hijack
 
-Windows Update Orchestrator Service is a DCOM service used by other components to install Windows updates that are
-already downloaded. Windows Update Orchestrator Service was vulnerable to elevation of privileges (any user to local
-system) due to an improper authorization of the callers. The vulnerability affected the Windows 10 and Windows Server
-Core products. Fixed by Microsoft on Patch Tuesday June 2020.
+Windows Update Orchestrator Service is a DCOM service used by other components to install Windows updates that are already downloaded. Windows Update Orchestrator Service was vulnerable to elevation of privileges (any user to local system) due to an improper authorization of the callers. The vulnerability affected the Windows 10 and Windows Server Core products. Fixed by Microsoft on Patch Tuesday June 2020.
 
-This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters.
-Attackers can leverage this technique to elevate privileges or maintain persistence.
+This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
@@ -103,45 +95,38 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.executable :
-"C:\\Windows\\System32\\svchost.exe" and process.parent.args :
-"UsoSvc" and not process.executable : ("?:\\ProgramData\\M
-icrosoft\\Windows\\UUS\\Packages\\*\\amd64\\MoUsoCoreWorker.exe",
-"?:\\Windows\\System32\\UsoClient.exe",
-"?:\\Windows\\System32\\MusNotification.exe",
-"?:\\Windows\\System32\\MusNotificationUx.exe",
-"?:\\Windows\\System32\\MusNotifyIcon.exe",
-"?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\System32\\WerMgr.exe",
-"?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
-"?:\\Windows\\System32\\MoUsoCoreWorker.exe",
-"?:\\Windows\\UUS\\amd64\\UsoCoreWorker.exe",
-"?:\\Windows\\System32\\UsoCoreWorker.exe", "?:\\Program
-Files\\Common Files\\microsoft
-shared\\ClickToRun\\OfficeC2RClient.exe") and not process.name :
-("MoUsoCoreWorker.exe", "OfficeC2RClient.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
+  process.parent.args : "UsoSvc" and
+  not process.executable :
+          ("?:\\ProgramData\\Microsoft\\Windows\\UUS\\Packages\\*\\amd64\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\System32\\UsoClient.exe",
+          "?:\\Windows\\System32\\MusNotification.exe",
+          "?:\\Windows\\System32\\MusNotificationUx.exe",
+          "?:\\Windows\\System32\\MusNotifyIcon.exe",
+          "?:\\Windows\\System32\\WerFault.exe",
+          "?:\\Windows\\System32\\WerMgr.exe",
+          "?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\System32\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\UUS\\amd64\\UsoCoreWorker.exe",
+          "?:\\Windows\\System32\\UsoCoreWorker.exe",
+          "?:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") and
+  not process.name : ("MoUsoCoreWorker.exe", "OfficeC2RClient.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -153,70 +138,7 @@ shared\\ClickToRun\\OfficeC2RClient.exe") and not process.name :
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[persistence-via-update-orchestrator-service-hijack-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.executable :
-"C:\\Windows\\System32\\svchost.exe" and process.parent.args :
-"UsoSvc" and not process.executable : ("?:\\ProgramData\\M
-icrosoft\\Windows\\UUS\\Packages\\*\\amd64\\MoUsoCoreWorker.exe",
-"?:\\Windows\\System32\\UsoClient.exe",
-"?:\\Windows\\System32\\MusNotification.exe",
-"?:\\Windows\\System32\\MusNotificationUx.exe",
-"?:\\Windows\\System32\\MusNotifyIcon.exe",
-"?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\System32\\WerMgr.exe",
-"?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
-"?:\\Windows\\System32\\MoUsoCoreWorker.exe",
-"?:\\Windows\\UUS\\amd64\\UsoCoreWorker.exe",
-"?:\\Windows\\System32\\UsoCoreWorker.exe", "?:\\Program
-Files\\Common Files\\microsoft
-shared\\ClickToRun\\OfficeC2RClient.exe")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.executable :
-"C:\\Windows\\System32\\svchost.exe" and process.parent.args :
-"UsoSvc" and not process.executable : (
-"C:\\Windows\\System32\\UsoClient.exe",
-"C:\\Windows\\System32\\MusNotification.exe",
-"C:\\Windows\\System32\\MusNotificationUx.exe",
-"C:\\Windows\\System32\\MusNotifyIcon.exe",
-"C:\\Windows\\System32\\WerFault.exe",
-"C:\\Windows\\System32\\WerMgr.exe" )
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:svchost.exe and process.parent.args:(UsoSvc or
-usosvc) and not process.name:(UsoClient.exe or usoclient.exe or
-MusNotification.exe or musnotification.exe or MusNotificationUx.exe or
-musnotificationux.exe)
-----------------------------------
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
index e6bd47162e..ca8edfd456 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
@@ -5,65 +5,63 @@ An adversary can use Windows Management Instrumentation (WMI) to install event f
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 102 (<<persistence-via-wmi-event-subscription-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "wmic.exe"
-or process.pe.original_file_name == "wmic.exe") and process.args :
-"create" and process.args : ("ActiveScriptEventConsumer",
-"CommandLineEventConsumer")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and
+  process.args : "create" and
+  process.args : ("ActiveScriptEventConsumer", "CommandLineEventConsumer")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,44 +73,7 @@ or process.pe.original_file_name == "wmic.exe") and process.args :
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[persistence-via-wmi-event-subscription-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "wmic.exe" or process.pe.original_file_name ==
-"wmic.exe") and process.args : "create" and process.args :
-("ActiveScriptEventConsumer", "CommandLineEventConsumer")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "wmic.exe" or process.pe.original_file_name ==
-"wmic.exe") and process.args : "create" and process.args :
-("ActiveScriptEventConsumer", "CommandLineEventConsumer")
-----------------------------------
-
+* Sub-technique:
+** Name: Windows Management Instrumentation Event Subscription
+** ID: T1546.003
+** Reference URL: https://attack.mitre.org/techniques/T1546/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
index 41661c5db7..7353230dee 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
@@ -5,89 +5,102 @@ Identifies use of the Windows Management Instrumentation StdRegProv (registry pr
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
 * https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 101 (<<persistence-via-wmi-standard-registry-provider-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.data.strings != null and process.name :
-"WmiPrvSe.exe" and registry.path : (
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\Policies\\Explorer\\Run\\*", "HKLM\\S
-oftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\
-*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\RunOnceEx\\*",
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ServiceDLL",
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*",
-"HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\Load",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell", "HKEY_USERS\\*
-\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shel
-l", "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\W
-indows\\System\\Scripts\\Logoff\\Script", "HKEY_USER
-S\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\
-Script", "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microso
-ft\\Windows\\System\\Scripts\\Shutdown\\Script", "HK
-EY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\
-Startup\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Exec",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun"
-)
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+ registry.data.strings != null and process.name : "WmiPrvSe.exe" and
+ registry.path : (
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ServiceDLL",
+                  "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+                  "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\ServiceDLL",
+                  "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+                  "\\REGISTRY\\USER\\*\\Environment\\UserInitMprLogonScript",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun"
+                  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -96,11 +109,21 @@ Explorer\\Extensions\\*\\Script",
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
 * Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Technique:
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -109,61 +132,3 @@ Explorer\\Extensions\\*\\Script",
 ** Name: Windows Management Instrumentation
 ** ID: T1047
 ** Reference URL: https://attack.mitre.org/techniques/T1047/
-
-[[persistence-via-wmi-standard-registry-provider-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.data.strings != null and process.name :
-"WmiPrvSe.exe" and registry.path : (
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\Policies\\Explorer\\Run\\*", "HKLM\\S
-oftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\
-*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\RunOnceEx\\*",
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ServiceDLL",
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*",
-"HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\Load",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell", "HKEY_USERS\\
-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\She
-ll", "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\
-\Windows\\System\\Scripts\\Logoff\\Script", "HKEY_U
-SERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logo
-n\\Script", "HKEY_USERS\\*\\SOFTWARE\\Policies\\Mic
-rosoft\\Windows\\System\\Scripts\\Shutdown\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Script
-s\\Startup\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Exec",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun"
-)
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index 6c84e1de2b..e72e9f75eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -10,77 +10,74 @@ Identifies script engines creating files in the Startup folder, or the creation
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<persistent-scripts-in-the-startup-directory-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Persistent Scripts in the Startup Directory
 
-The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account
-logon, without user interaction, providing an excellent way for attackers to maintain persistence.
+The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
 
 This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -99,38 +96,33 @@ software installations.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and user.domain != "NT AUTHORITY"
-and /* detect shortcuts created by wscript.exe or cscript.exe */
-(file.path : "C:\\*\\Programs\\Startup\\*.lnk" and process.name :
-("wscript.exe", "cscript.exe")) or /* detect vbs or js files
-created by any process */ file.path :
-("C:\\*\\Programs\\Startup\\*.vbs",
-"C:\\*\\Programs\\Startup\\*.vbe",
-"C:\\*\\Programs\\Startup\\*.wsh",
-"C:\\*\\Programs\\Startup\\*.wsf",
-"C:\\*\\Programs\\Startup\\*.js")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and user.domain != "NT AUTHORITY" and
+
+  /* detect shortcuts created by wscript.exe or cscript.exe */
+  (file.path : "C:\\*\\Programs\\Startup\\*.lnk" and
+     process.name : ("wscript.exe", "cscript.exe")) or
 
-==== Threat mapping
+  /* detect vbs or js files created by any process */
+  file.path : ("C:\\*\\Programs\\Startup\\*.vbs",
+               "C:\\*\\Programs\\Startup\\*.vbe",
+               "C:\\*\\Programs\\Startup\\*.wsh",
+               "C:\\*\\Programs\\Startup\\*.wsf",
+               "C:\\*\\Programs\\Startup\\*.js")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -142,42 +134,7 @@ created by any process */ file.path :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[persistent-scripts-in-the-startup-directory-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and user.domain != "NT AUTHORITY"
-and /* detect shortcuts created by wscript.exe or cscript.exe */
-(file.path : "C:\\*\\Programs\\Startup\\*.lnk" and process.name :
-("wscript.exe", "cscript.exe")) or /* detect vbs or js files
-created by any process */ file.path :
-("C:\\*\\Programs\\Startup\\*.vbs",
-"C:\\*\\Programs\\Startup\\*.vbe",
-"C:\\*\\Programs\\Startup\\*.wsh",
-"C:\\*\\Programs\\Startup\\*.wsf",
-"C:\\*\\Programs\\Startup\\*.js")
-----------------------------------
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
index 0f9082eb50..5e610aa505 100644
--- a/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,71 +16,63 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<port-forwarding-rule-addition-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Port Forwarding Rule Addition
 
-Network port forwarding is a mechanism to redirect incoming TCP connections (IPv4 or IPv6) from the local TCP port to
-any other port number, or even to a port on a remote computer.
+Network port forwarding is a mechanism to redirect incoming TCP connections (IPv4 or IPv6) from the local TCP port to any other port number, or even to a port on a remote computer.
 
-Attackers may configure port forwarding rules to bypass network segmentation restrictions, using the host as a jump box
-to access previously unreachable systems.
+Attackers may configure port forwarding rules to bypass network segmentation restrictions, using the host as a jump box to access previously unreachable systems.
 
 This rule monitors the modifications to the `HKLM\SYSTEM\*ControlSet*\Services\PortProxy\v4tov4\` subkeys.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Identify the target host IP address, check the connections originating from the host where the modification occurred,
-and inspect the credentials used.
+- Identify the target host IP address, check the connections originating from the host where the modification occurred, and inspect the credentials used.
   - Investigate suspicious login activity, such as unauthorized access and logins from outside working hours and unusual locations.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity
-and there are justifications for this configuration.
-- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination
-of user and command line conditions.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Response and remediation
 
@@ -91,32 +83,25 @@ of user and command line conditions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
-registry where registry.path : (
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*", "\\REG
-ISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
+registry where host.os.type == "windows" and registry.path : (
+  "HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*",
+  "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
 )
-----------------------------------
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -128,46 +113,3 @@ ISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
 ** Name: Protocol Tunneling
 ** ID: T1572
 ** Reference URL: https://attack.mitre.org/techniques/T1572/
-
-[[port-forwarding-rule-addition-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\ControlSet*\\Services\\PortProxy\\v4tov4\\*"
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
index 445da42ba8..1ec4714a0d 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
@@ -5,63 +5,56 @@ Detects when a user grants permissions to an Azure-registered application or whe
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
+* logs-o365*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide
 * https://www.cloud-architekt.net/detection-and-mitigation-consent-grant-attacks-azuread/
 * https://docs.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth#how-to-detect-risky-oauth-apps
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Investigation Guide
-
-*Version*: 103 (<<possible-consent-grant-attack-via-azure-registered-application-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Possible Consent Grant Attack via Azure-Registered Application
 
-In an illicit consent grant attack, the attacker creates an Azure-registered application that requests access to data
-such as contact information, email, or documents. The attacker then tricks an end user into granting that application
-consent to access their data either through a phishing attack, or by injecting illicit code into a trusted website.
-After the illicit application has been granted consent, it has account-level access to data without the need for an
-organizational account. Normal remediation steps like resetting passwords for breached accounts or requiring multi-factor
-authentication (MFA) on accounts are not effective against this type of attack, since these are third-party applications
-and are external to the organization.
+In an illicit consent grant attack, the attacker creates an Azure-registered application that requests access to data such as contact information, email, or documents. The attacker then tricks an end user into granting that application consent to access their data either through a phishing attack, or by injecting illicit code into a trusted website. After the illicit application has been granted consent, it has account-level access to data without the need for an organizational account. Normal remediation steps like resetting passwords for breached accounts or requiring multi-factor authentication (MFA) on accounts are not effective against this type of attack, since these are third-party applications and are external to the organization.
 
 Official Microsoft guidance for detecting and remediating this attack can be found [here](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants).
 
@@ -80,8 +73,7 @@ Official Microsoft guidance for detecting and remediating this attack can be fou
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Malicious applications abuse the same workflow used by legitimate apps.
-Thus, analysts must review each app consent to ensure that only desired apps are granted access.
+- This mechanism can be used legitimately. Malicious applications abuse the same workflow used by legitimate apps. Thus, analysts must review each app consent to ensure that only desired apps are granted access.
 
 ### Response and remediation
 
@@ -93,37 +85,31 @@ Thus, analysts must review each app consent to ensure that only desired apps are
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
 - Disable the malicious application to stop user access and the application access to your data.
-- Revoke the application Oauth consent grant. The `Remove-AzureADOAuth2PermissionGrant` cmdlet can be used to complete
-this task.
-- Remove the service principal application role assignment. The `Remove-AzureADServiceAppRoleAssignment` cmdlet can be
-used to complete this task.
+- Revoke the application Oauth consent grant. The `Remove-AzureADOAuth2PermissionGrant` cmdlet can be used to complete this task.
+- Remove the service principal application role assignment. The `Remove-AzureADServiceAppRoleAssignment` cmdlet can be used to complete this task.
 - Revoke the refresh token for all users assigned to the application. Azure provides a [playbook](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Revoke-AADSignInSessions) for this task.
 - [Report](https://docs.microsoft.com/en-us/defender-cloud-apps/manage-app-permissions#send-feedback) the application as malicious to Microsoft.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Investigate the potential for data compromise from the user's email and file sharing services. Activate your Data Loss
-incident response playbook.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Investigate the potential for data compromise from the user's email and file sharing services. Activate your Data Loss incident response playbook.
 - Disable the permission for a user to set consent permission on their behalf.
   - Enable the [Admin consent request](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow) feature.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:(azure.activitylogs or azure.auditlogs or o365.audit)
-and ( azure.activitylogs.operation_name:"Consent to application"
-or azure.auditlogs.operation_name:"Consent to application" or
-o365.audit.Operation:"Consent to application." ) and
-event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:(azure.activitylogs or azure.auditlogs or o365.audit) and
+  (
+    azure.activitylogs.operation_name:"Consent to application" or
+    azure.auditlogs.operation_name:"Consent to application" or
+    o365.audit.Operation:"Consent to application."
+  ) and
+  event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,8 +121,10 @@ event.outcome:(Success or success)
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -145,45 +133,3 @@ event.outcome:(Success or success)
 ** Name: Steal Application Access Token
 ** ID: T1528
 ** Reference URL: https://attack.mitre.org/techniques/T1528/
-
-[[possible-consent-grant-attack-via-azure-registered-application-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(azure.activitylogs or azure.auditlogs or o365.audit)
-and ( azure.activitylogs.operation_name:"Consent to
-application" or azure.auditlogs.operation_name:"Consent to
-application" or o365.audit.Operation:"Consent to application." )
-and event.outcome:(Success or success)
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:(azure.activitylogs or azure.auditlogs) and (
-azure.activitylogs.operation_name:"Consent to application" or
-azure.auditlogs.operation_name:"Consent to application" ) and
-event.outcome:success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc
index c3162ec5f3..ecaacedd0f 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc
@@ -5,72 +5,59 @@ This rule detects a known command and control pattern in network events. The FIN
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<possible-fin7-dga-command-and-control-behavior-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This rule could identify benign domains that are formatted similarly to FIN7's command and control algorithm. Alerts should be investigated by an analyst to assess the validity of the individual observations.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 In the event this rule identifies benign domains in your environment, the `destination.domain` field in the rule can be modified to include those domains. Example: `...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)`.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network OR network_traffic) AND type:(tls OR http) AND
-network.transport:tcp AND
-destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT
-destination.domain:zoom.us
+[source, js]
 ----------------------------------
+event.dataset: (network_traffic.tls or network_traffic.http) AND
+destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,33 +69,11 @@ destination.domain:zoom.us
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[possible-fin7-dga-command-and-control-behavior-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network OR network_traffic) AND type:(tls OR http) AND
-network.transport:tcp AND
-destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT
-destination.domain:zoom.us
-----------------------------------
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc
index efd781a0b9..39d0905fd9 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc
@@ -5,7 +5,7 @@ Detects possible Denial of Service (DoS) attacks against an Okta organization. A
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,58 +14,49 @@ Detects possible Denial of Service (DoS) attacks against an Okta organization. A
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<possible-okta-dos-attack-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Impact
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:(application.integration.rate_limit_exceeded or
-system.org.rate_limit.warning or system.org.rate_limit.violation or
-core.concurrency.org.limit.violation)
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:(application.integration.rate_limit_exceeded or system.org.rate_limit.warning or system.org.rate_limit.violation or core.concurrency.org.limit.violation)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,39 +68,7 @@ core.concurrency.org.limit.violation)
 ** Name: Network Denial of Service
 ** ID: T1498
 ** Reference URL: https://attack.mitre.org/techniques/T1498/
-
-[[possible-okta-dos-attack-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:(application.integration.rate_limit_exceeded or
-system.org.rate_limit.warning or system.org.rate_limit.violation or
-core.concurrency.org.limit.violation)
-----------------------------------
-
+* Technique:
+** Name: Endpoint Denial of Service
+** ID: T1499
+** Reference URL: https://attack.mitre.org/techniques/T1499/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-abuse-of-repeated-mfa-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-abuse-of-repeated-mfa-push-notifications.asciidoc
index 9600702ba8..267762a2e0 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-abuse-of-repeated-mfa-push-notifications.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-abuse-of-repeated-mfa-push-notifications.asciidoc
@@ -5,7 +5,7 @@ Detects when an attacker abuses the Multi-Factor authentication mechanism by rep
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,58 +14,84 @@ Detects when an attacker abuses the Multi-Factor authentication mechanism by rep
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.mandiant.com/resources/russian-targeting-gov-business
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 101 (<<potential-abuse-of-repeated-mfa-push-notifications-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Potential Abuse of Repeated MFA Push Notifications
 
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
 
-==== Rule query
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
 
+#### Possible investigation steps:
 
-[source,js]
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+### False positive analysis:
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+### Response and remediation:
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
 ----------------------------------
-sequence by user.email with maxspan=10m [any where event.module ==
-"okta" and event.action == "user.mfa.okta_verify.deny_push"] [any
-where event.module == "okta" and event.action ==
-"user.mfa.okta_verify.deny_push"] [any where event.module == "okta"
-and event.action == "user.authentication.sso"]
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+sequence by user.email with maxspan=10m
+  [any where event.dataset == "okta.system" and event.module == "okta" and event.action == "user.mfa.okta_verify.deny_push"]
+  [any where event.dataset == "okta.system" and event.module == "okta" and event.action == "user.mfa.okta_verify.deny_push"]
+  [any where event.dataset == "okta.system" and event.module == "okta" and event.action == "user.authentication.sso"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,19 +103,3 @@ and event.action == "user.authentication.sso"]
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[potential-abuse-of-repeated-mfa-push-notifications-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
index bf489abc23..4be1a4dc68 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to add an account to the admin group via the command line. T
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,45 +14,41 @@ Identifies attempts to add an account to the admin group via the command line. T
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-command-line-3-0/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<potential-admin-group-account-addition-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(dscl or dseditgroup) and process.args:(("/Groups/admin"
-or admin) and ("-a" or "-append"))
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:(dscl or dseditgroup) and process.args:(("/Groups/admin" or admin) and ("-a" or "-append"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,13 +60,7 @@ or admin) and ("-a" or "-append"))
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[potential-admin-group-account-addition-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
new file mode 100644
index 0000000000..70dc77de13
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
@@ -0,0 +1,158 @@
+[[potential-antimalware-scan-interface-bypass-via-powershell]]
+=== Potential Antimalware Scan Interface Bypass via PowerShell
+
+Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection.
+
+*Rule type*: query
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Antimalware Scan Interface Bypass via PowerShell
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
+
+This rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Determine whether the script was executed and capture relevant information, such as arguments that reveal intent or are indicators of compromise (IoCs).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate commands and scripts executed after this activity was observed.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"process" and host.os.type:windows and
+ (powershell.file.script_block_text :
+        ("System.Management.Automation.AmsiUtils" or
+				 amsiInitFailed or
+				 "Invoke-AmsiBypass" or
+				 "Bypass.AMSI" or
+				 "amsi.dll" or
+				 AntimalwareProvider  or
+				 amsiSession or
+				 amsiContext or
+				 AmsiInitialize or
+				 unloadobfuscated or
+				 unloadsilent or
+				 AmsiX64 or
+				 AmsiX32 or
+				 FindAmsiFun) or
+  powershell.file.script_block_text:("[System.Runtime.InteropServices.Marshal]::Copy" and "VirtualProtect") or
+  powershell.file.script_block_text:("[Ref].Assembly.GetType(('System.Management.Automation" and ".SetValue(")
+ )
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
index da9eedb104..2c0aed5684 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
@@ -5,60 +5,60 @@ The Application Shim was created to allow for backward compatibility of software
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 102 (<<potential-application-shimming-via-sdbinst-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "sdbinst.exe"
-and not (process.args : "-m" and process.args : "-bg") and not
-process.args : "-mm"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name : "sdbinst.exe" and
+  not (process.args : "-m" and process.args : "-bg") and
+  not process.args : "-mm"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,8 +70,10 @@ process.args : "-mm"
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-
+* Sub-technique:
+** Name: Application Shimming
+** ID: T1546.011
+** Reference URL: https://attack.mitre.org/techniques/T1546/011/
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -80,62 +82,7 @@ process.args : "-mm"
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[potential-application-shimming-via-sdbinst-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.name : "sdbinst.exe"
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "sdbinst.exe"
-----------------------------------
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.2.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:sdbinst.exe
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:1 and process.name:sdbinst.exe
-----------------------------------
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Application Shimming
+** ID: T1546.011
+** Reference URL: https://attack.mitre.org/techniques/T1546/011/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc
new file mode 100644
index 0000000000..56966de6bf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc
@@ -0,0 +1,65 @@
+[[potential-code-execution-via-postgresql]]
+=== Potential Code Execution via Postgresql
+
+This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks, which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for unauthorized access and malicious actions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "fork", "fork_event") and 
+event.type == "start" and user.name == "postgres" and (process.parent.args : "*sh" or process.args : "*sh")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-command-and-control-via-internet-explorer.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-command-and-control-via-internet-explorer.asciidoc
index bad4d1632f..d9c932d2b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-command-and-control-via-internet-explorer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-command-and-control-via-internet-explorer.asciidoc
@@ -5,7 +5,7 @@ Identifies instances of Internet Explorer (iexplore.exe) being started via the C
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,54 +15,55 @@ Identifies instances of Internet Explorer (iexplore.exe) being started via the C
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
+*Tags*: 
 
-*Version*: 100 (<<potential-command-and-control-via-internet-explorer-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Processes such as MS Office using IEproxy to render HTML content.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, user.name with maxspan = 5s [library where
-dll.name : "IEProxy.dll" and process.name : ("rundll32.exe",
-"regsvr32.exe")] [process where event.type == "start" and
-process.parent.name : "iexplore.exe" and process.parent.args :
-"-Embedding"] /* IE started via COM in normal conditions makes few
-connections, mainly to Microsoft and OCSP related domains, add FPs
-here */ [network where network.protocol == "dns" and process.name :
-"iexplore.exe" and not dns.question.name : (
-"*.microsoft.com", "*.digicert.com", "*.msocsp.com",
-"*.windowsupdate.com", "*.bing.com", "*.identrust.com",
-"*.sharepoint.com", "*.office365.com", "*.office.com" )
-] /* with runs=5 */
+[source, js]
 ----------------------------------
+sequence by host.id, user.name with maxspan = 5s
+  [library where host.os.type == "windows" and dll.name : "IEProxy.dll" and process.name : ("rundll32.exe", "regsvr32.exe")]
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"]
+  /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */
+  [network where host.os.type == "windows" and network.protocol == "dns" and process.name : "iexplore.exe" and
+   not dns.question.name :
+   (
+    "*.microsoft.com",
+    "*.digicert.com",
+    "*.msocsp.com",
+    "*.windowsupdate.com",
+    "*.bing.com",
+    "*.identrust.com",
+    "*.sharepoint.com",
+    "*.office365.com",
+    "*.office.com"
+    )
+  ] /* with runs=5 */
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,8 +75,6 @@ here */ [network where network.protocol == "dns" and process.name :
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -84,69 +83,7 @@ here */ [network where network.protocol == "dns" and process.name :
 ** Name: Inter-Process Communication
 ** ID: T1559
 ** Reference URL: https://attack.mitre.org/techniques/T1559/
-
-[[potential-command-and-control-via-internet-explorer-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, user.id with maxspan = 5s [library where
-dll.name : "IEProxy.dll" and process.name : ("rundll32.exe",
-"regsvr32.exe")] [process where event.type == "start" and
-process.parent.name : "iexplore.exe" and process.parent.args :
-"-Embedding"] /* IE started via COM in normal conditions makes few
-connections, mainly to Microsoft and OCSP related domains, add FPs
-here */ [network where network.protocol == "dns" and process.name :
-"iexplore.exe" and not dns.question.name : (
-"*.microsoft.com", "*.digicert.com", "*.msocsp.com",
-"*.windowsupdate.com", "*.bing.com", "*.identrust.com",
-"*.sharepoint.com", "*.office365.com", "*.office.com" )
-]
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 1s [process
-where event.type == "start" and process.parent.name : "iexplore.exe"
-and process.parent.args : "-Embedding"] /* IE started via COM in
-normal conditions makes few connections, mainly to Microsoft and OCSP
-related domains, add FPs here */ [network where network.protocol ==
-"dns" and process.name : "iexplore.exe" and not dns.question.name :
-( "*.microsoft.com", "*.digicert.com", "*.msocsp.com",
-"*.windowsupdate.com", "*.bing.com", "*.identrust.com" )
-]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 1s [process
-where event.type:"start" and process.parent.name:"iexplore.exe" and
-process.parent.args:"-Embedding"] /* IE started via COM in normal
-conditions makes few connections, mainly to Microsoft and OCSP related
-domains, add FPs here */ [network where network.protocol : "dns" and
-process.name:"iexplore.exe" and not wildcard(dns.question.name,
-"*.microsoft.com",
-"*.digicert.com", "*.msocsp.com",
-"*.windowsupdate.com",
-"*.bing.com", "*.identrust.com")
-]
-----------------------------------
-
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc
index e6ee377bf2..67daeed3d7 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a Chromium based browser with the debugging process
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * winlogbeat-*
@@ -16,69 +16,65 @@ Identifies the execution of a Chromium based browser with the debugging process
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*References*:
+*References*: 
 
 * https://github.com/defaultnamehere/cookie_crimes
 * https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/
 * https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/chrome_cookies.md
 * https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Windows
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<potential-cookies-theft-via-browser-debugging-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: Windows
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Developers performing browsers plugin or extension debugging.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 process where event.type in ("start", "process_started", "info") and
-process.name in ( "Microsoft Edge",
-"chrome.exe", "Google Chrome", "google-
-chrome-stable", "google-chrome-beta",
-"google-chrome", "msedge.exe") and process.args : ("--
-remote-debugging-port=*", "--remote-debugging-
-targets=*", "--remote-debugging-pipe=*") and
-process.args : "--user-data-dir=*" and not process.args:"--remote-
-debugging-port=0"
-----------------------------------
+  process.name in (
+             "Microsoft Edge",
+             "chrome.exe",
+             "Google Chrome",
+             "google-chrome-stable",
+             "google-chrome-beta",
+             "google-chrome",
+             "msedge.exe") and
+   process.args : ("--remote-debugging-port=*",
+                   "--remote-debugging-targets=*",
+                   "--remote-debugging-pipe=*") and
+   process.args : "--user-data-dir=*" and not process.args:"--remote-debugging-port=0"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -90,29 +86,3 @@ debugging-port=0"
 ** Name: Steal Web Session Cookie
 ** ID: T1539
 ** Reference URL: https://attack.mitre.org/techniques/T1539/
-
-[[potential-cookies-theft-via-browser-debugging-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name in ( "Microsoft Edge",
-"chrome.exe", "Google Chrome", "google-
-chrome-stable", "google-chrome-beta",
-"google-chrome", "msedge.exe") and process.args : ("--
-remote-debugging-port=*", "--remote-debugging-
-targets=*", "--remote-debugging-pipe=*") and
-process.args : "--user-data-dir=*" and not process.args:"--remote-
-debugging-port=0"
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
index bdc3555d05..d6604b8ee5 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
@@ -5,22 +5,23 @@ This rule identifies when a User Account starts the Active Directory Replication
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html
 * https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing
@@ -29,111 +30,96 @@ This rule identifies when a User Account starts the Active Directory Replication
 * https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync
 * https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<potential-credential-access-via-dcsync-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 108
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Credential Access via DCSync
 
-Active Directory replication is the process by which the changes that originate on one domain controller are
-automatically transferred to other domain controllers that store the same data.
+Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.
 
-Active Directory data consists of objects that have properties, or attributes. Each object is an instance of an object
-class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are
-defined by the values of their attributes, and changes to attribute values must be transferred from the domain
-controller on which they occur to every other domain controller that stores a replica of an affected object.
+Active Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.
 
-Adversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process
-from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used
-legitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges
-to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of
-the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused
-to grant controlled objects the right to DCsync/Replicate.
+Adversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used legitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.
 
 More details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).
 
-This rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that
-use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent:
-Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set).
-It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).
+This rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller
-(DC) that received the replication request. This will tell you where the AD replication request came from, and if it
-came from another DC or not.
+- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.
 - Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).
 
 ### False positive analysis
 
-- This activity should not happen legitimately, since replication should be done by Domain Controllers only. Any
-potential benign true positive (B-TP) should be mapped and monitored by the security team. Any account that performs
-this activity can put the domain at risk for not having the same security standards as computer accounts (which have
-long, complex, random passwords that change frequently), exposing it to credential cracking attacks (Kerberoasting,
-brute force, etc.).
+- Administrators may use custom accounts on Azure AD Connect, investigate if it is the case, and if it is properly secured. If noisy in your environment due to expected activity, consider adding the corresponding account as a exception.
+- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. If this rule is noisy in your environment due to expected activity, consider adding the corresponding account as a exception.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- If specific credentials were compromised:
-  - Reset the password for these accounts and other potentially compromised credentials, like email, business systems,
-  and web services.
-- If the entire domain or the `krbtgt` user were compromised:
-  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited
-  to, a password reset (twice) of the `krbtgt` user.
-- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this
-information to scope ways that the attacker could use to regain access to the environment.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the entire domain or the `krbtgt` user was compromised:
+  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.
+- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where event.action == "Directory Service Access" and event.code
-== "4662" and winlog.event_data.Properties : ( /* Control Access
-Rights/Permissions Symbol */ "*DS-Replication-Get-Changes*",
-"*DS-Replication-Get-Changes-All*", "*DS-Replication-Get-Changes-
-In-Filtered-Set*", /* Identifying GUID used in ACE */
-"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
-"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
-"*89e95b76-444d-4c62-991a-0facbeda640c*") /* The right to perform
-an operation controlled by an extended access right. */ and
-winlog.event_data.AccessMask : "0x100" and not
-winlog.event_data.SubjectUserName : ("*$", "MSOL_*")
+[source, js]
 ----------------------------------
+any where event.action == "Directory Service Access" and
+  event.code == "4662" and winlog.event_data.Properties : (
+
+    /* Control Access Rights/Permissions Symbol */
+
+    "*DS-Replication-Get-Changes*",
+    "*DS-Replication-Get-Changes-All*",
+    "*DS-Replication-Get-Changes-In-Filtered-Set*",
+
+    /* Identifying GUID used in ACE */
+
+    "*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
+    "*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
+    "*89e95b76-444d-4c62-991a-0facbeda640c*")
+
+    /* The right to perform an operation controlled by an extended access right. */
+
+    and winlog.event_data.AccessMask : "0x100" and
+    not winlog.event_data.SubjectUserName : ("*$", "MSOL_*", "OpenDNS_Connector")
 
-==== Threat mapping
+    /* The Umbrella AD Connector uses the OpenDNS_Connector account to perform replication */
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -145,37 +131,7 @@ winlog.event_data.SubjectUserName : ("*$", "MSOL_*")
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-credential-access-via-dcsync-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-any where event.action == "Directory Service Access" and event.code
-== "4662" and winlog.event_data.Properties : ( /* Control Access
-Rights/Permissions Symbol */ "*DS-Replication-Get-Changes*",
-"*DS-Replication-Get-Changes-All*", "*DS-Replication-Get-Changes-
-In-Filtered-Set*", /* Identifying GUID used in ACE */
-"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
-"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
-"*89e95b76-444d-4c62-991a-0facbeda640c*") /* The right to
-perform an operation controlled by an extended access right. */
-and winlog.event_data.AccessMask : "0x100" and not
-winlog.event_data.SubjectUserName : ("*$", "MSOL_*")
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: DCSync
+** ID: T1003.006
+** Reference URL: https://attack.mitre.org/techniques/T1003/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc
index 459f54a3f2..ca9affd001 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious access to an LSASS handle via DuplicateHandle from an unkn
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,57 +14,55 @@ Identifies suspicious access to an LSASS handle via DuplicateHandle from an unkn
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/CCob/MirrorDump
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Sysmon Only
-
-*Version*: 101 (<<potential-credential-access-via-duplicatehandle-in-lsass-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 206
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.code == "10" and /* LSASS requesting
-DuplicateHandle access right to another process */ process.name :
-"lsass.exe" and winlog.event_data.GrantedAccess == "0x40" and /*
-call is coming from an unknown executable region */
-winlog.event_data.CallTrace : "*UNKNOWN*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.code == "10" and
+
+ /* LSASS requesting DuplicateHandle access right to another process */
+ process.name : "lsass.exe" and winlog.event_data.GrantedAccess == "0x40" and
 
-==== Threat mapping
+ /* call is coming from an unknown executable region */
+ winlog.event_data.CallTrace : "*UNKNOWN*"
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,31 +74,7 @@ winlog.event_data.CallTrace : "*UNKNOWN*"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-credential-access-via-duplicatehandle-in-lsass-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.code == "10" and /* LSASS requesting
-DuplicateHandle access right to another process */ process.name :
-"lsass.exe" and winlog.event_data.GrantedAccess == "0x40" and /*
-call is coming from an unknown executable region */
-winlog.event_data.CallTrace : "*UNKNOWN*"
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
index a3c5d9d76b..aefe7c74ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious access to LSASS handle from a call trace pointing to DBGHe
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,60 +14,57 @@ Identifies suspicious access to LSASS handle from a call trace pointing to DBGHe
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Sysmon Only
-
-*Version*: 101 (<<potential-credential-access-via-lsass-memory-dump-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 206
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.code == "10" and winlog.event_data.TargetImage :
-"?:\\WINDOWS\\system32\\lsass.exe" and /* DLLs exporting
-MiniDumpWriteDump API to create an lsass mdmp*/
-winlog.event_data.CallTrace : ("*dbghelp*", "*dbgcore*") and /*
-case of lsass crashing */ not process.executable :
-("?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\System32\\WerFaultSecure.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.code == "10" and
+  winlog.event_data.TargetImage : "?:\\WINDOWS\\system32\\lsass.exe" and
+
+   /* DLLs exporting MiniDumpWriteDump API to create an lsass mdmp*/
+  winlog.event_data.CallTrace : ("*dbghelp*", "*dbgcore*") and
+
+   /* case of lsass crashing */
+  not process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\System32\\WerFaultSecure.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,44 +76,7 @@ case of lsass crashing */ not process.executable :
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-credential-access-via-lsass-memory-dump-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.code == "10" and winlog.event_data.TargetImage :
-"?:\\WINDOWS\\system32\\lsass.exe" and /* DLLs exporting
-MiniDumpWriteDump API to create an lsass mdmp*/
-winlog.event_data.CallTrace : ("*dbghelp*", "*dbgcore*") and /*
-case of lsass crashing */ not process.executable :
-("?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\System32\\WerFaultSecure.exe")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.code == "10" and winlog.event_data.TargetImage :
-"?:\\WINDOWS\\system32\\lsass.exe" and /* DLLs exporting
-MiniDumpWriteDump API to create an lsass mdmp*/
-winlog.event_data.CallTrace : ("*dbhelp*", "*dbgcore*") and /*
-case of lsass crashing */ not process.executable :
-("?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\System32\\WerFaultSecure.exe")
-----------------------------------
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc
index e248a037b7..07beff23d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,59 +14,55 @@ Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Sysmon Only
-
-*Version*: 101 (<<potential-credential-access-via-renamed-com-services-dll-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [process where
-event.category == "process" and process.name : "rundll32.exe"]
-[process where event.category == "process" and event.dataset :
-"windows.sysmon_operational" and event.code == "7" and
-(file.pe.original_file_name : "COMSVCS.DLL" or file.pe.imphash :
-"EADBCCBB324829ACB5F2BBE87E5549A8") and /* renamed COMSVCS */
-not file.name : "COMSVCS.DLL"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=1m
+ [process where host.os.type == "windows" and event.category == "process" and
+    process.name : "rundll32.exe"]
+ [process where host.os.type == "windows" and event.category == "process" and event.dataset : "windows.sysmon_operational" and event.code == "7" and
+   (file.pe.original_file_name : "COMSVCS.DLL" or file.pe.imphash : "EADBCCBB324829ACB5F2BBE87E5549A8") and
+    /* renamed COMSVCS */
+    not file.name : "COMSVCS.DLL"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,22 +74,7 @@ not file.name : "COMSVCS.DLL"]
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-credential-access-via-renamed-com-services-dll-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
index 7a2ca30634..08e791bf86 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
@@ -15,84 +15,69 @@ An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically lin
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<potential-credential-access-via-trusted-developer-utility-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Credential Access via Trusted Developer Utility
 
-The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML
-schema for a project file that controls how the build platform processes and builds software.
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software.
 
-Adversaries can abuse MSBuild to proxy the execution of malicious code. The inline task capability of MSBuild that was
-introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will
-compile and execute the inline task. `MSBuild.exe` is a signed Microsoft binary, and the execution of code using it can bypass
-application control defenses that are configured to allow `MSBuild.exe` execution.
+Adversaries can abuse MSBuild to proxy the execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. `MSBuild.exe` is a signed Microsoft binary, and the execution of code using it can bypass application control defenses that are configured to allow `MSBuild.exe` execution.
 
-This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of
-credential access activities.
+This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine the command line to identify the `.csproj` file location.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
-- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target
-host after the registry modification.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -106,35 +91,26 @@ host after the registry modification.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and (process.name : "MSBuild.exe" or process.pe.original_file_name ==
-"MSBuild.exe")] [any where (event.category == "library" or
-(event.category == "process" and event.action : "Image loaded*")) and
-(dll.name : ("vaultcli.dll", "SAMLib.DLL") or file.name :
-("vaultcli.dll", "SAMLib.DLL"))]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+ [process where host.os.type == "windows" and event.type == "start" and (process.name : "MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe")]
+ [any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  (dll.name : ("vaultcli.dll", "SAMLib.DLL") or file.name : ("vaultcli.dll", "SAMLib.DLL"))]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -146,71 +122,3 @@ and (process.name : "MSBuild.exe" or process.pe.original_file_name ==
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-credential-access-via-trusted-developer-utility-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Rule name changed from: Microsoft Build Engine Loading Windows Credential Libraries
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where event.type == "start"
-and (process.name : "MSBuild.exe" or process.pe.original_file_name ==
-"MSBuild.exe")] [library where dll.name : ("vaultcli.dll",
-"SAMLib.DLL")]
-----------------------------------
-
-Version 9 (8.2.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:change and
-(process.pe.original_file_name:(vaultcli.dll or SAMLib.DLL) or
-dll.name:(vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:change and
-(winlog.event_data.OriginalFileName:(vaultcli.dll or SAMLib.DLL) or
-dll.name:(vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe
-----------------------------------
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-(winlog.event_data.OriginalFileName: (vaultcli.dll or SAMLib.DLL) or
-dll.name: (vaultcli.dll or SAMLib.DLL)) and process.name: MSBuild.exe
-and event.action: "Image loaded (rule: ImageLoad)"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
index 424c673162..d936a5419f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
@@ -5,125 +5,125 @@ Identifies the execution of known Windows utilities often abused to dump LSASS m
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
 * endgame-*
+* logs-system.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://lolbas-project.github.io/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<potential-credential-access-via-windows-utilities-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Credential Access via Windows Utilities
 
-Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible
-for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles
-password changes, and creates access tokens.
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
 
-The `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and
-group membership.
+The `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and group membership.
 
-This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active
-Directory `Ntds.dit` file.
+This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine the command line to identify what information was targeted.
 - Identify the target computer and its role in the IT environment.
 
 ### False positive analysis
 
-- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious
-must be monitored by the security team.
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - If the host is a domain controller (DC):
   - Activate your incident response plan for total Active Directory compromise.
-  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is
-  being followed and to reduce the attack surface.
+  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and /* update here with any new
-lolbas with dump capability */ (process.pe.original_file_name ==
-"procdump" and process.args : "-ma") or (process.name :
-"ProcessDump.exe" and not process.parent.executable regex~
-"""C:\\Program Files( \(x86\))?\\Cisco Systems\\.*""") or
-(process.pe.original_file_name == "WriteMiniDump.exe" and not
-process.parent.executable regex~ """C:\\Program Files(
-\(x86\))?\\Steam\\.*""") or (process.pe.original_file_name ==
-"RUNDLL32.EXE" and (process.args : "MiniDump*" or process.command_line
-: "*comsvcs.dll*#24*")) or (process.pe.original_file_name ==
-"RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
-(process.pe.original_file_name == "SqlDumper.exe" and process.args :
-"0x01100*") or (process.pe.original_file_name == "TTTracer.exe" and
-process.args : "-dumpFull" and process.args : "-attach") or
-(process.pe.original_file_name == "ntdsutil.exe" and process.args :
-"create*full*") or (process.pe.original_file_name == "diskshadow.exe"
-and process.args : "/s")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (process.pe.original_file_name : "procdump" or process.name : "procdump.exe") and process.args : "-ma"
+  ) or
+  (
+    process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*"""
+  ) or
+  (
+    (process.pe.original_file_name : "WriteMiniDump.exe" or process.name : "WriteMiniDump.exe") and
+      not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*"""
+  ) or
+  (
+    (process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
+      (process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")
+  ) or
+  (
+    (process.pe.original_file_name : "RdrLeakDiag.exe" or process.name : "RdrLeakDiag.exe") and
+      process.args : "/fullmemdmp"
+  ) or
+  (
+    (process.pe.original_file_name : "SqlDumper.exe" or process.name : "SqlDumper.exe") and
+      process.args : "0x01100*") or
+  (
+    (process.pe.original_file_name : "TTTracer.exe" or process.name : "TTTracer.exe") and
+      process.args : "-dumpFull" and process.args : "-attach") or
+  (
+    (process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
+      process.args : "create*full*") or
+  (
+    (process.pe.original_file_name : "diskshadow.exe" or process.name : "diskshadow.exe") and process.args : "/s")
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,72 +135,11 @@ and process.args : "/s")
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-credential-access-via-windows-utilities-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and /* update
-here with any new lolbas with dump capability */
-(process.pe.original_file_name == "procdump" and process.args : "-ma")
-or (process.name : "ProcessDump.exe" and not process.parent.executable
-regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*""") or
-(process.pe.original_file_name == "WriteMiniDump.exe" and not
-process.parent.executable regex~ """C:\\Program Files(
-\(x86\))?\\Steam\\.*""") or (process.pe.original_file_name ==
-"RUNDLL32.EXE" and (process.args : "MiniDump*" or process.command_line
-: "*comsvcs.dll*#24*")) or (process.pe.original_file_name ==
-"RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
-(process.pe.original_file_name == "SqlDumper.exe" and process.args :
-"0x01100*") or (process.pe.original_file_name == "TTTracer.exe" and
-process.args : "-dumpFull" and process.args : "-attach") or
-(process.pe.original_file_name == "ntdsutil.exe" and process.args :
-"create*full*") or (process.pe.original_file_name == "diskshadow.exe"
-and process.args : "/s")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and /* update
-here with any new lolbas with dump capability */
-(process.pe.original_file_name == "procdump" and process.args : "-ma")
-or (process.name : "ProcessDump.exe" and not process.parent.executable
-: "C:\\Program Files*\\Cisco Systems\\*.exe") or
-(process.pe.original_file_name == "WriteMiniDump.exe" and not
-process.parent.executable : "C:\\Program Files*\\Steam\\*.exe") or
-(process.pe.original_file_name == "RUNDLL32.EXE" and (process.args :
-"MiniDump*" or process.command_line : "*comsvcs.dll*#24*")) or
-(process.pe.original_file_name == "RdrLeakDiag.exe" and process.args :
-"/fullmemdmp") or (process.pe.original_file_name == "SqlDumper.exe"
-and process.args : "0x01100*") or (process.pe.original_file_name ==
-"TTTracer.exe" and process.args : "-dumpFull" and process.args :
-"-attach") or (process.pe.original_file_name == "ntdsutil.exe" and
-process.args : "create*full*") or (process.pe.original_file_name ==
-"diskshadow.exe" and process.args : "/s")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
+* Sub-technique:
+** Name: NTDS
+** ID: T1003.003
+** Reference URL: https://attack.mitre.org/techniques/T1003/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-cross-site-scripting-xss.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-cross-site-scripting-xss.asciidoc
new file mode 100644
index 0000000000..5a7707beba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-cross-site-scripting-xss.asciidoc
@@ -0,0 +1,62 @@
+[[potential-cross-site-scripting-xss]]
+=== Potential Cross Site Scripting (XSS)
+
+Cross-Site Scripting (XSS) is a type of attack in which malicious scripts are injected into trusted websites. In XSS attacks, an attacker uses a benign web application to send malicious code, generally in the form of a browser-side script. This detection rule identifies the potential malicious executions of such browser-side scripts.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* apm-*-transaction*
+* traces-apm*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/payloadbox/xss-payload-list
+
+*Tags*: 
+
+* Data Source: APM
+* Use Case: Threat Detection
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where processor.name == "transaction" and
+url.fragment : ("<iframe*", "*prompt(*)*", "<script*>", "<svg*>", "*onerror=*", "*javascript*alert*", "*eval*(*)*", "*onclick=*",
+"*alert(document.cookie)*", "*alert(document.domain)*","*onresize=*","*onload=*","*onmouseover=*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Drive-by Compromise
+** ID: T1189
+** Reference URL: https://attack.mitre.org/techniques/T1189/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc
new file mode 100644
index 0000000000..73bc866263
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc
@@ -0,0 +1,60 @@
+[[potential-defense-evasion-via-proot]]
+=== Potential Defense Evasion via PRoot
+
+Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://proot-me.github.io/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where  event.action == "exec" and process.parent.name =="proot" and host.os.type == "linux"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Exploitation for Defense Evasion
+** ID: T1211
+** Reference URL: https://attack.mitre.org/techniques/T1211/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc
index cd38e354bd..d0aa37d624 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc
@@ -5,49 +5,49 @@ Identifies potential attempts to disable Security-Enhanced Linux (SELinux), whic
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<potential-disabling-of-selinux-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:setenforce and process.args:0
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:setenforce and process.args:0
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,36 +59,7 @@ process.name:setenforce and process.args:0
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[potential-disabling-of-selinux-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and process.name:setenforce and process.args:0
-----------------------------------
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
index cabd350f77..6748a6dc13 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
@@ -5,7 +5,7 @@ Identifies a Windows trusted program that is known to be vulnerable to DLL Searc
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,65 +16,59 @@ Identifies a Windows trusted program that is known to be vulnerable to DLL Searc
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 101 (<<potential-dll-side-loading-via-microsoft-antimalware-service-executable-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Dennis Perto
+* Elastic
+* Dennis Perto
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Microsoft Antimalware Service Executable installed on non default installation path.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-(process.pe.original_file_name == "MsMpEng.exe" and not process.name :
-"MsMpEng.exe") or (process.name : "MsMpEng.exe" and not
-process.executable : ("?:\\ProgramData\\Microsoft\\Windows
-Defender\\*.exe", "?:\\Program
-Files\\Windows Defender\\*.exe",
-"?:\\Program Files (x86)\\Windows Defender\\*.exe",
-"?:\\Program Files\\Microsoft Security Client\\*.exe",
-"?:\\Program Files (x86)\\Microsoft Security Client\\*.exe"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or
+  (process.name : "MsMpEng.exe" and not
+        process.executable : ("?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+                              "?:\\Program Files\\Windows Defender\\*.exe",
+                              "?:\\Program Files (x86)\\Windows Defender\\*.exe",
+                              "?:\\Program Files\\Microsoft Security Client\\*.exe",
+                              "?:\\Program Files (x86)\\Microsoft Security Client\\*.exe"))
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -86,33 +80,7 @@ Files\\Windows Defender\\*.exe",
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[potential-dll-side-loading-via-microsoft-antimalware-service-executable-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and
-(process.pe.original_file_name == "MsMpEng.exe" and not process.name :
-"MsMpEng.exe") or (process.name : "MsMpEng.exe" and not
-process.executable : ("?:\\ProgramData\\Microsoft\\Windows
-Defender\\*.exe", "?:\\Program
-Files\\Windows Defender\\*.exe",
-"?:\\Program Files (x86)\\Windows Defender\\*.exe"))
-----------------------------------
-
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc
index b620ae5ed2..a1ca4f7303 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc
@@ -5,7 +5,7 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,59 +16,56 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<potential-dll-sideloading-via-trusted-microsoft-programs-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE",
-"w3wp.exe", "DISM.EXE") and not (process.name : ("winword.exe",
-"explorer.exe", "w3wp.exe", "Dism.exe") or process.executable
-: ("?:\\Windows\\explorer.exe",
-"?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
-"?:\\Program Files?(x86)\\Microsoft
-Office\\root\\Office*\\WINWORD.EXE",
-"?:\\Windows\\System32\\Dism.exe",
-"?:\\Windows\\SysWOW64\\Dism.exe",
-"?:\\Windows\\System32\\inetsrv\\w3wp.exe") )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and
+  not (process.name : ("winword.exe", "explorer.exe", "w3wp.exe", "Dism.exe") or
+         process.executable : ("?:\\Windows\\explorer.exe",
+                               "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
+                               "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
+                               "?:\\Windows\\System32\\Dism.exe",
+                               "?:\\Windows\\SysWOW64\\Dism.exe",
+                               "?:\\Windows\\System32\\inetsrv\\w3wp.exe")
+         )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,59 +77,3 @@ Office\\root\\Office*\\WINWORD.EXE",
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[potential-dll-sideloading-via-trusted-microsoft-programs-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.pe.original_file_name:(WinWord.exe or EXPLORER.EXE or w3wp.exe
-or DISM.EXE) and not (process.name:(winword.exe or WINWORD.EXE or
-explorer.exe or w3wp.exe or Dism.exe) or
-process.executable:("C:\Windows\explorer.exe" or
-C\:\\Program?Files\\Microsoft?Office\\root\\Office*\\WINWORD.EXE or C\
-:\\Program?Files?\(x86\)\\Microsoft?Office\\root\\Office*\\WINWORD.EXE
-or "C:\Windows\System32\Dism.exe" or "C:\Windows\SysWOW64\Dism.exe" or
-"C:\Windows\System32\inetsrv\w3wp.exe"))
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.pe.original_file_name:(WinWord.exe or EXPLORER.EXE or
-w3wp.exe or DISM.EXE) or
-winlog.event_data.OriginalFileName:(WinWord.exe or EXPLORER.EXE or
-w3wp.exe or DISM.EXE)) and not (process.name:(winword.exe or
-WINWORD.EXE or explorer.exe or w3wp.exe or Dism.exe) or
-process.executable:("C:\Windows\explorer.exe" or
-C\:\\Program?Files\\Microsoft?Office\\root\\Office*\\WINWORD.EXE or C\
-:\\Program?Files?\(x86\)\\Microsoft?Office\\root\\Office*\\WINWORD.EXE
-or "C:\Windows\System32\Dism.exe" or "C:\Windows\SysWOW64\Dism.exe" or
-"C:\Windows\System32\inetsrv\w3wp.exe"))
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-iodine.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-iodine.asciidoc
index cc6f644b8a..6692bb83c0 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-iodine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-iodine.asciidoc
@@ -5,57 +5,51 @@ Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://code.kryo.se/iodine/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Command and Control
-
-*Version*: 100 (<<potential-dns-tunneling-via-iodine-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(iodine or iodined)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(iodine or iodined)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -67,41 +61,3 @@ process.name:(iodine or iodined)
 ** Name: Protocol Tunneling
 ** ID: T1572
 ** Reference URL: https://attack.mitre.org/techniques/T1572/
-
-[[potential-dns-tunneling-via-iodine-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:(iodine or iodined) and event.action:executed
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name: (iodine or iodined) and event.action:executed
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
index 527ec8272a..73accc393d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
@@ -5,7 +5,7 @@ This rule identifies a large number (15) of nslookup.exe executions with an expl
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,67 +16,59 @@ This rule identifies a large number (15) of nslookup.exe executions with an expl
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<potential-dns-tunneling-via-nslookup-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential DNS Tunneling via NsLookup
 
-Attackers can abuse existing network rules that allow DNS communication with external resources to use the protocol as
-their command and control and/or exfiltration channel.
+Attackers can abuse existing network rules that allow DNS communication with external resources to use the protocol as their command and control and/or exfiltration channel.
 
-DNS queries can be used to infiltrate data such as commands to be run, malicious files, etc., and also for exfiltration,
-since queries can be used to send data to the attacker-controlled DNS server. This process is commonly known as DNS tunneling.
+DNS queries can be used to infiltrate data such as commands to be run, malicious files, etc., and also for exfiltration, since queries can be used to send data to the attacker-controlled DNS server. This process is commonly known as DNS tunneling.
 
-More information on how tunneling works and how it can be abused can be found on
-[Palo Alto Unit42 Research](https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors).
+More information on how tunneling works and how it can be abused can be found on [Palo Alto Unit42 Research](https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors).
 
 #### Possible investigation steps
 
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the DNS query and identify the information sent.
-- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially
-compromised hosts.
+- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. If the parent process is trusted and the data sent is not sensitive nor
-command and control related, this alert can be closed.
+- This mechanism can be used legitimately. If the parent process is trusted and the data sent is not sensitive nor command and control related, this alert can be closed.
 
 ### Response and remediation
 
@@ -84,31 +76,23 @@ command and control related, this alert can be closed.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Immediately block the identified indicators of compromise (IoCs).
 - Implement any temporary network rules, procedures, and segmentation required to contain the attack.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Update firewall rules to be more restrictive.
 - Reimage the host operating system or restore the compromised files to clean versions.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and
-process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or
--q=* or -type=*)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -120,28 +104,7 @@ process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[potential-dns-tunneling-via-nslookup-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: DNS
+** ID: T1071.004
+** Reference URL: https://attack.mitre.org/techniques/T1071/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index 5b92c09045..e8a4b188e9 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -16,50 +16,100 @@ The Filter Manager Control Program (fltMC.exe) binary may be abused by adversari
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<potential-evasion-via-filter-manager-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
+
+### Investigating Potential Evasion via Filter Manager
+
+A file system filter driver, or minifilter, is a specialized type of filter driver designed to intercept and modify I/O requests sent to a file system or another filter driver. Minifilters are used by a wide range of security software, including EDR, antivirus, backup agents, encryption products, etc.
+
+Attackers may try to unload minifilters to avoid protections such as malware detection, file system monitoring, and behavior-based detections.
+
+This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Examine the command line event to identify the target driver.
+  - Identify the minifilter's role in the environment and if it is security-related. Microsoft provides a [list](https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes) of allocated altitudes that may provide more context, such as the manufacturer.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+### False positive analysis
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for the action.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "fltMC.exe"
-and process.args : "unload"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.name : "fltMC.exe" and process.args : "unload"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -71,63 +121,7 @@ and process.args : "unload"
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[potential-evasion-via-filter-manager-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "fltMC.exe" and process.args : "unload"
-----------------------------------
-
-Version 11 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "fltMC.exe" and process.args : "unload"
-----------------------------------
-
-Version 9 (8.2.0 release)::
-* Formatting only
-
-Version 8 (7.16.0 release)::
-* Formatting only
-
-Version 7 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:fltMC.exe
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:1 and process.name:fltMC.exe
-----------------------------------
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-exfiltration-via-certreq.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-exfiltration-via-certreq.asciidoc
new file mode 100644
index 0000000000..8dcb808546
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-exfiltration-via-certreq.asciidoc
@@ -0,0 +1,74 @@
+[[potential-exfiltration-via-certreq]]
+=== Potential Exfiltration via Certreq
+
+Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to exfiltrate data to a remote URL.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lolbas-project.github.io/lolbas/Binaries/Certreq/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "CertReq.exe" or process.pe.original_file_name == "CertReq.exe") and process.args : "-Post"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
new file mode 100644
index 0000000000..aae8d73d26
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
@@ -0,0 +1,118 @@
+[[potential-external-linux-ssh-brute-force-detected]]
+=== Potential External Linux SSH Brute Force Detected
+
+Identifies multiple external consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-system.auth-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential External Linux SSH Brute Force Detected
+
+The rule identifies consecutive SSH login failures targeting a user account from the same source IP address to the same target host indicating brute force login attempts.
+
+This rule will generate a lot of noise for systems with a front-facing SSH service, as adversaries scan the internet for remotely accessible SSH services and try to brute force them to gain unauthorized access. 
+
+In case this rule generates too much noise and external brute forcing is of not much interest, consider turning this rule off and enabling "Potential Internal Linux SSH Brute Force Detected" to detect internal brute force attempts.
+
+#### Possible investigation steps
+
+- Investigate the login failure user name(s).
+- Investigate the source IP address of the failed ssh login attempt(s).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the source and the target computer and their roles in the IT environment.
+
+### False positive analysis
+
+- Authentication misconfiguration or obsolete credentials.
+- Service account password expired.
+- Infrastructure or availability issue.
+
+### Related Rules
+
+- Potential Internal Linux SSH Brute Force Detected - 1c27fa22-7727-4dd3-81c0-de6da5555feb
+- Potential SSH Password Guessing - 8cb84371-d053-4f4f-bce0-c74990e28f28
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, source.ip, user.name with maxspan=5s
+  [ authentication where host.os.type == "linux" and 
+   event.action in ("ssh_login", "user_login") and event.outcome == "failure" and
+   not cidrmatch(source.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", 
+       "::1", "FE80::/10", "FF00::/8") ] with runs = 10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
index 45682a096f..37bdc8b8b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to create a local account that will be hidden from the macOS
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,45 +14,41 @@ Identifies attempts to create a local account that will be hidden from the macOS
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.apple.com/en-us/HT203998
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<potential-hidden-local-user-account-creation-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:dscl and process.args:(IsHidden and create and (true or 1
-or yes))
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:dscl and process.args:(IsHidden and create and (true or 1 or yes))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,13 +60,7 @@ or yes))
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[potential-hidden-local-user-account-creation-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc
new file mode 100644
index 0000000000..1468248434
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc
@@ -0,0 +1,62 @@
+[[potential-hidden-process-via-mount-hidepid]]
+=== Potential Hidden Process via Mount Hidepid
+
+Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where process.name=="mount" and event.action =="exec" and
+    process.args: ( "/proc") and process.args: ("-o") and process.args:("*hidepid=2*") and
+    host.os.type == "linux"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
new file mode 100644
index 0000000000..1bd9361db4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
@@ -0,0 +1,114 @@
+[[potential-internal-linux-ssh-brute-force-detected]]
+=== Potential Internal Linux SSH Brute Force Detected
+
+Identifies multiple internal consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-system.auth-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Internal Linux SSH Brute Force Detected
+
+The rule identifies consecutive internal SSH login failures targeting a user account from the same source IP address to the same target host indicating brute force login attempts.
+
+#### Possible investigation steps
+
+- Investigate the login failure user name(s).
+- Investigate the source IP address of the failed ssh login attempt(s).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the source and the target computer and their roles in the IT environment.
+
+### False positive analysis
+
+- Authentication misconfiguration or obsolete credentials.
+- Service account password expired.
+- Infrastructure or availability issue.
+
+### Related Rules
+
+- Potential External Linux SSH Brute Force Detected - fa210b61-b627-4e5e-86f4-17e8270656ab
+- Potential SSH Password Guessing - 8cb84371-d053-4f4f-bce0-c74990e28f28
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, source.ip, user.name with maxspan=5s
+  [ authentication where host.os.type == "linux" and 
+   event.action in ("ssh_login", "user_login") and event.outcome == "failure" and
+   cidrmatch(source.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", 
+       "::1", "FE80::/10", "FF00::/8") ] with runs = 10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc
index e23d226c09..74dd9c5225 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc
@@ -5,7 +5,7 @@ Mimikatz is a credential dumper capable of obtaining plaintext Windows account l
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,70 +14,60 @@ Mimikatz is a credential dumper capable of obtaining plaintext Windows account l
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://attack.mitre.org/software/S0002/
 * https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<potential-invoke-mimikatz-powershell-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Mimikatz PowerShell Activity
 
-[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached
-credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained
-an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects
-such as tokens/hashes/credentials that can then be used to move laterally and pivot across a network.
+[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to move laterally and pivot across a network.
 
-This rule looks for PowerShell scripts that load mimikatz in memory, like Invoke-Mimikataz, which are used to dump
-credentials from the Local Security Authority Subsystem Service (LSASS). Any activity triggered from this rule should be
-treated with high priority as it typically represents an active adversary.
+This rule looks for PowerShell scripts that load mimikatz in memory, like Invoke-Mimikataz, which are used to dump credentials from the Local Security Authority Subsystem Service (LSASS). Any activity triggered from this rule should be treated with high priority as it typically represents an active adversary.
 
 More information about Mimikatz components and how to detect/prevent them can be found on [ADSecurity](https://adsecurity.org/?page_id=1821).
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-  - Invoke-Mimitakz and alike scripts heavily use other capabilities covered by other detections described in the
-  "Related Rules" section.
+  - Invoke-Mimitakz and alike scripts heavily use other capabilities covered by other detections described in the "Related Rules" section.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
-- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the
-target host.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host.
   - Examine network and security events in the environment to identify potential lateral movement using compromised credentials.
 
 ### False positive analysis
@@ -97,32 +87,30 @@ target host.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
 - Validate that cleartext passwords are disabled in memory for use with `WDigest`.
-- Look into preventing access to `LSASS` using capabilities such as LSA protection or antivirus/EDR tools that provide
-this capability.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Look into preventing access to `LSASS` using capabilities such as LSA protection or antivirus/EDR tools that provide this capability.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text:(
-(DumpCreds and DumpCerts) or "sekurlsa::logonpasswords" or
-("crypto::certificates" and "CERT_SYSTEM_STORE_LOCAL_MACHINE") )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+powershell.file.script_block_text:(
+  (DumpCreds and
+  DumpCerts) or
+  "sekurlsa::logonpasswords" or
+  ("crypto::certificates" and
+  "CERT_SYSTEM_STORE_LOCAL_MACHINE")
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -134,16 +122,7 @@ event.category:process and powershell.file.script_block_text:(
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-invoke-mimikatz-powershell-script-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-java-jndi-exploitation-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-java-jndi-exploitation-attempt.asciidoc
index 449e262dbf..d3a72a0568 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-java-jndi-exploitation-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-java-jndi-exploitation-attempt.asciidoc
@@ -5,7 +5,7 @@ Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard p
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,13 +14,13 @@ Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard p
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.lunasec.io/docs/blog/log4j-zero-day/
 * https://github.com/christophetd/log4shell-vulnerable-app
@@ -28,44 +28,56 @@ Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard p
 * https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security
 * https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Execution
-
-*Version*: 101 (<<potential-java-jndi-exploitation-attempt-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=1m [network where event.action ==
-"connection_attempted" and process.name : "java" and /*
-outbound connection attempt to LDAP, RMI or DNS standard ports
-by JAVA process */ destination.port in (1389, 389, 1099, 53,
-5353)] by process.pid [process where event.type == "start" and /*
-Suspicious JAVA child process */ process.parent.name : "java" and
-process.name : ("sh", "bash",
-"dash", "ksh", "tcsh",
-"zsh", "curl", "perl*",
-"python*", "ruby*", "php*",
-"wget")] by process.parent.pid
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=1m
+ [network where event.action == "connection_attempted" and
+  process.name : "java" and
+  /*
+     outbound connection attempt to
+     LDAP, RMI or DNS standard ports
+     by JAVA process
+   */
+  destination.port in (1389, 389, 1099, 53, 5353)] by process.pid
+ [process where event.type == "start" and
+
+  /* Suspicious JAVA child process */
+  process.parent.name : "java" and
+   process.name : ("sh",
+                   "bash",
+                   "dash",
+                   "ksh",
+                   "tcsh",
+                   "zsh",
+                   "curl",
+                   "perl*",
+                   "python*",
+                   "ruby*",
+                   "php*",
+                   "wget")] by process.parent.pid
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,19 +89,11 @@ process.name : ("sh", "bash",
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[potential-java-jndi-exploitation-attempt-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: JavaScript
+** ID: T1059.007
+** Reference URL: https://attack.mitre.org/techniques/T1059/007/
+* Technique:
+** Name: Exploitation for Client Execution
+** ID: T1203
+** Reference URL: https://attack.mitre.org/techniques/T1203/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
index f257e59601..db37da6a7d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
@@ -5,7 +5,7 @@ Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,47 +14,42 @@ Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/its-a-feature/bifrost
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-* Lateral Movement
-
-*Version*: 100 (<<potential-kerberos-attack-via-bifrost-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and
-process.args:("-action" and ("-kerberoast" or askhash or asktgs or
-asktgt or s4u or ("-ticket" and ptt) or (dump and (tickets or
-keytab))))
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+ process.args:("-action" and ("-kerberoast" or askhash or asktgs or asktgt or s4u or ("-ticket" and ptt) or (dump and (tickets or keytab))))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,8 +61,10 @@ keytab))))
 ** Name: Use Alternate Authentication Material
 ** ID: T1550
 ** Reference URL: https://attack.mitre.org/techniques/T1550/
-
-
+* Sub-technique:
+** Name: Pass the Ticket
+** ID: T1550.003
+** Reference URL: https://attack.mitre.org/techniques/T1550/003/
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -76,24 +73,7 @@ keytab))))
 ** Name: Steal or Forge Kerberos Tickets
 ** ID: T1558
 ** Reference URL: https://attack.mitre.org/techniques/T1558/
-
-[[potential-kerberos-attack-via-bifrost-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:start and
-process.args:("-action" and ("-kerberoast" or askhash or asktgs or
-asktgt or s4u or ("-ticket" and ptt) or (dump and (tickets or
-keytab))))
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc
index d1388ce7d1..5e4c16b2c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or change of a Windows executable file over network shar
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,48 +15,45 @@ Identifies the creation or change of a Windows executable file over network shar
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<potential-lateral-tool-transfer-via-smb-share-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Lateral Tool Transfer via SMB Share
 
-Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools
-can include discovery utilities, credential dumpers, malware, etc. Attackers can also leverage file shares that employees
-frequently access to host malicious files to gain a foothold in other machines.
+Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc. Attackers can also leverage file shares that employees frequently access to host malicious files to gain a foothold in other machines.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -82,35 +79,29 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - Review the privileges needed to write to the network share and restrict write access as needed.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=30s [network where event.type ==
-"start" and process.pid == 4 and destination.port == 445 and
-network.direction : ("incoming", "ingress") and network.transport
-== "tcp" and source.ip != "127.0.0.1" and source.ip != "::1" ] by
-process.entity_id /* add more executable extensions here if they are
-not noisy in your environment */ [file where event.type in
-("creation", "change") and process.pid == 4 and file.extension :
-("exe", "dll", "bat", "cmd")] by process.entity_id
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=30s
+  [network where host.os.type == "windows" and event.type == "start" and process.pid == 4 and destination.port == 445 and
+   network.direction : ("incoming", "ingress") and
+   network.transport == "tcp" and source.ip != "127.0.0.1" and source.ip != "::1"
+  ] by process.entity_id
+  /* add more executable extensions here if they are not noisy in your environment */
+  [file where host.os.type == "windows" and event.type in ("creation", "change") and process.pid == 4 and file.extension : ("exe", "dll", "bat", "cmd")] by process.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -119,54 +110,14 @@ not noisy in your environment */ [file where event.type in
 ** ID: TA0008
 ** Reference URL: https://attack.mitre.org/tactics/TA0008/
 * Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
+* Technique:
 ** Name: Lateral Tool Transfer
 ** ID: T1570
 ** Reference URL: https://attack.mitre.org/techniques/T1570/
-
-[[potential-lateral-tool-transfer-via-smb-share-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Rule name changed from: Lateral Tool Transfer
-Version 4 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=30s [network where event.type ==
-"start" and process.pid == 4 and destination.port == 445 and
-network.direction : ("incoming", "ingress") and network.transport ==
-"tcp" and source.address != "127.0.0.1" and source.address != "::1"
-] by process.entity_id /* add more executable extensions here if
-they are not noisy in your environment */ [file where event.type in
-("creation", "change") and process.pid == 4 and file.extension :
-("exe", "dll", "bat", "cmd")] by process.entity_id
-----------------------------------
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=30s [network where event.type ==
-"start" and process.pid == 4 and destination.port == 445 and
-network.direction == "incoming" and network.transport == "tcp" and
-source.address != "127.0.0.1" and source.address != "::1" ] by
-process.entity_id /* add more executable extensions here if they are
-not noisy in your environment */ [file where event.type in
-("creation", "change") and process.pid == 4 and file.extension :
-("exe", "dll", "bat", "cmd")] by process.entity_id
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
new file mode 100644
index 0000000000..989e61b853
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -0,0 +1,121 @@
+[[potential-linux-backdoor-user-account-creation]]
+=== Potential Linux Backdoor User Account Creation
+
+Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Linux Backdoor User Account Creation
+
+The `usermod` command is used to modify user account attributes and settings in Linux-based operating systems.
+
+Attackers may create new accounts with a UID of 0 to maintain root access to target systems without leveraging the root user account.
+
+This rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible investigation steps
+- Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
+  - !{osquery{"label":"Osquery - Retrieve User Accounts with a UID of 0","query":"SELECT description, gid, gid_signed, shell, uid, uid_signed, username FROM users WHERE username != 'root' AND uid LIKE '0'"}}
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Identify if the account was added to privileged groups or assigned special privileges after creation.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Delete the created account.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+event.action in ("exec", "exec_event") and process.name == "usermod" and
+process.args : "-u" and process.args : "0" and process.args : "-o"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc
new file mode 100644
index 0000000000..0223fa57c9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc
@@ -0,0 +1,75 @@
+[[potential-linux-credential-dumping-via-proc-filesystem]]
+=== Potential Linux Credential Dumping via Proc Filesystem
+
+Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/huntergregal/mimipenguin
+* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Use Case: Vulnerability
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.parent.name,host.name with maxspan=1m
+[process where host.os.type == "linux" and process.name == "ps" and event.action == "exec"
+ and process.args in ("-eo", "pid", "command") ]
+
+[process where host.os.type == "linux" and process.name == "strings" and event.action == "exec"
+ and process.args : "/tmp/*" ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Proc Filesystem
+** ID: T1003.007
+** Reference URL: https://attack.mitre.org/techniques/T1003/007/
+* Technique:
+** Name: Exploitation for Credential Access
+** ID: T1212
+** Reference URL: https://attack.mitre.org/techniques/T1212/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc
new file mode 100644
index 0000000000..e78ae7f93c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc
@@ -0,0 +1,67 @@
+[[potential-linux-credential-dumping-via-unshadow]]
+=== Potential Linux Credential Dumping via Unshadow
+
+Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/
+
+*Tags*: 
+
+* Data Source: Elastic Endgame
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and process.name == "unshadow" and
+  event.type == "start" and event.action in ("exec", "exec_event") and process.args_count >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: /etc/passwd and /etc/shadow
+** ID: T1003.008
+** Reference URL: https://attack.mitre.org/techniques/T1003/008/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc
new file mode 100644
index 0000000000..90e82ffdbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc
@@ -0,0 +1,64 @@
+[[potential-linux-local-account-brute-force-detected]]
+=== Potential Linux Local Account Brute Force Detected
+
+Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.parent.executable, user.name with maxspan=1s
+[ process where host.os.type == "linux" and event.type == "start" and 
+  event.action == "exec" and process.name == "su" ] with runs=10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc
new file mode 100644
index 0000000000..508eace659
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc
@@ -0,0 +1,75 @@
+[[potential-linux-ransomware-note-creation-detected]]
+=== Potential Linux Ransomware Note Creation Detected
+
+This rule identifies a sequence of a mass file encryption event in conjunction with the creation of a .txt file with a file name containing ransomware keywords executed by the same process in a 1 second timespan. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Impact
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=1s 
+  [ file where host.os.type == "linux" and event.type == "change" and
+    event.action == "rename" and file.extension != "" and 
+    file.path : (
+      "/home/*", "/etc/*", "/root/*", "/opt/*", "/var/backups/*", "/var/lib/log/*"
+      ) and not 
+    file.extension : (
+      "xml", "json", "conf", "dat", "gz", "info", "mod", "final",
+      "php", "pyc", "log", "bak", "bin", "csv", "pdf", "cfg", "*old"
+      ) and not 
+    process.name : (
+      "dpkg",  "yum", "dnf", "rpm", "dockerd"
+      ) ] with runs=100
+  [ file where host.os.type == "linux" and event.action == "creation" and file.extension == "txt" and 
+    file.name : (
+      "*crypt*", "*restore*", "*lock*", "*recovery*", "*data*", 
+      "*read*", "*instruction*", "*how_to*", "*ransom*"
+      ) ] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Encrypted for Impact
+** ID: T1486
+** Reference URL: https://attack.mitre.org/techniques/T1486/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc
index 223fbf0704..0dfc9895c2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc
@@ -5,7 +5,7 @@ Identifies attempt to coerce a local NTLM authentication via HTTP using the Wind
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,51 +16,50 @@ Identifies attempt to coerce a local NTLM authentication via HTTP using the Wind
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/med0x2e/NTLMRelay2Self
 * https://github.com/topotam/PetitPotam
 * https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 102 (<<potential-local-ntlm-relay-via-http-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name :
-"rundll32.exe" and /* Rundll32 WbeDav Client */ process.args :
-("?:\\Windows\\System32\\davclnt.dll,DavSetCookie",
-"?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and /* Access to
-named pipe via http */ process.args : ("http*/print/pipe/*",
-"http*/pipe/spoolss", "http*/pipe/srvsvc")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "rundll32.exe" and
+
+  /* Rundll32 WbeDav Client  */
+  process.args : ("?:\\Windows\\System32\\davclnt.dll,DavSetCookie", "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and
 
-==== Threat mapping
+  /* Access to named pipe via http */
+  process.args : ("http*/print/pipe/*", "http*/pipe/spoolss", "http*/pipe/srvsvc")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,26 +71,3 @@ named pipe via http */ process.args : ("http*/print/pipe/*",
 ** Name: Exploitation for Credential Access
 ** ID: T1212
 ** Reference URL: https://attack.mitre.org/techniques/T1212/
-
-[[potential-local-ntlm-relay-via-http-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "rundll32.exe" and /* Rundll32 WbeDav Client */
-process.args : ("?:\\Windows\\System32\\davclnt.dll,DavSetCookie",
-"?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and /* Access
-to named pipe via http */ process.args : ("http*/print/pipe/*",
-"http*/pipe/spoolss", "http*/pipe/srvsvc")
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc
index d66f616fc6..5b01c039b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc
@@ -5,50 +5,54 @@ Adversaries can use the autostart mechanism provided by the Local Security Autho
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<potential-lsa-authentication-package-abuse-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type == "change" and registry.path :
-"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Authentication Packages"
-and /* exclude SYSTEM SID - look for changes by non-SYSTEM user */
-not user.id : "S-1-5-18"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+  registry.path : (
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Authentication Packages",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Authentication Packages"
+  ) and
+  /* exclude SYSTEM SID - look for changes by non-SYSTEM user */
+  not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -60,8 +64,10 @@ not user.id : "S-1-5-18"
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-
+* Sub-technique:
+** Name: Authentication Package
+** ID: T1547.002
+** Reference URL: https://attack.mitre.org/techniques/T1547/002/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -70,16 +76,7 @@ not user.id : "S-1-5-18"
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[potential-lsa-authentication-package-abuse-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Authentication Package
+** ID: T1547.002
+** Reference URL: https://attack.mitre.org/techniques/T1547/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc
index f51b48caf2..a2e678309c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc
@@ -5,65 +5,62 @@ Identifies the creation of an LSASS process clone via PssCaptureSnapShot where t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
+* logs-system.*
 * logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/
 * https://medium.com/@Achilles8284/the-birth-of-a-process-part-2-97c6fb9c42a2
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Sysmon Only
-
-*Version*: 101 (<<potential-lsass-clone-creation-via-psscapturesnapshot-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.code:"4688" and process.executable :
-"?:\\Windows\\System32\\lsass.exe" and process.parent.executable :
-"?:\\Windows\\System32\\lsass.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.code:"4688" and
+  process.executable : "?:\\Windows\\System32\\lsass.exe" and
+  process.parent.executable : "?:\\Windows\\System32\\lsass.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,19 +72,7 @@ process where event.code:"4688" and process.executable :
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-lsass-clone-creation-via-psscapturesnapshot-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc
index 0ecdee3cd1..f1d0a5bb22 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,57 +14,53 @@ Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/
 * https://twitter.com/sbousseaden/status/1280619931516747777?lang=en
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Sysmon Only
-
-*Version*: 101 (<<potential-lsass-memory-dump-via-psscapturesnapshot-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 206
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.code:10 and
-winlog.event_data.TargetImage:("C:\\Windows\\system32\\lsass.exe" or
-"c:\\Windows\\system32\\lsass.exe" or
-"c:\\Windows\\System32\\lsass.exe")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and event.code:10 and
+ winlog.event_data.TargetImage:("C:\\Windows\\system32\\lsass.exe" or
+                                 "c:\\Windows\\system32\\lsass.exe" or
+                                 "c:\\Windows\\System32\\lsass.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,22 +72,7 @@ winlog.event_data.TargetImage:("C:\\Windows\\system32\\lsass.exe" or
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-lsass-memory-dump-via-psscapturesnapshot-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
index 61aeca22bd..8bcb8961ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
@@ -5,7 +5,7 @@ Identifies a high number (20) of macOS SSH KeyGen process executions from the sa
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,44 +14,40 @@ Identifies a high number (20) of macOS SSH KeyGen process executions from the sa
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 101 (<<potential-macos-ssh-brute-force-detected-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and process.name:"sshd-
-keygen-wrapper" and process.parent.name:launchd
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:start and process.name:"sshd-keygen-wrapper" and process.parent.name:launchd
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,15 +59,3 @@ keygen-wrapper" and process.parent.name:launchd
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[potential-macos-ssh-brute-force-detected-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Rule name changed from: Potential SSH Brute Force Detected
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-malicious-file-downloaded-from-google-drive.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-malicious-file-downloaded-from-google-drive.asciidoc
new file mode 100644
index 0000000000..ea1cc24cdd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-malicious-file-downloaded-from-google-drive.asciidoc
@@ -0,0 +1,91 @@
+[[potential-malicious-file-downloaded-from-google-drive]]
+=== Potential Malicious File Downloaded from Google Drive
+
+Identifies potential malicious file download and execution from Google Drive. The rule checks for download activity from Google Drive URL, followed by the creation of files commonly leveraged by or for malware. This could indicate an attempt to run malicious scripts, executables or payloads.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://intelligence.abnormalsecurity.com/blog/google-drive-matanbuchus-malware
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: Windows
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Command and Control
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=30s
+[any where
+
+    /* Look for processes started or libraries loaded from untrusted or unsigned Windows, Linux or macOS binaries */
+    (event.action in ("exec", "fork", "start", "load")) or
+
+    /* Look for Google Drive download URL with AV flag skipping */
+    (process.args : "*drive.google.com*" and process.args : "*export=download*" and process.args : "*confirm=no_antivirus*")
+]
+
+[network where
+    /* Look for DNS requests for Google Drive */
+    (dns.question.name : "drive.google.com" and dns.question.type : "A") or
+
+    /* Look for connection attempts to address that resolves to Google */
+    (destination.as.organization.name : "GOOGLE" and event.action == "connection_attempted")
+
+    /* NOTE: Add LoLBins if tuning is required
+    process.name : (
+        "cmd.exe", "bitsadmin.exe", "certutil.exe", "esentutl.exe", "wmic.exe", "PowerShell.exe",
+        "homedrive.exe","regsvr32.exe", "mshta.exe", "rundll32.exe", "cscript.exe", "wscript.exe",
+        "curl", "wget", "scp", "ftp", "python", "perl", "ruby"))] */
+]
+
+/* Identify the creation of files following Google Drive connection with extensions commonly used for executables or libraries */
+[file where event.action == "creation" and file.extension : (
+    "exe", "dll", "scr", "jar", "pif", "app", "dmg", "pkg", "elf", "so", "bin", "deb", "rpm","sh","hta","lnk"
+    )
+]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
new file mode 100644
index 0000000000..bdb9a935ec
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
@@ -0,0 +1,101 @@
+[[potential-masquerading-as-communication-apps]]
+=== Potential Masquerading as Communication Apps
+
+Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and
+  event.type == "start" and
+  (
+    /* Slack */
+    (process.name : "slack.exe" and not
+      (process.code_signature.subject_name : "Slack Technologies, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WebEx */
+    (process.name : "WebexHost.exe" and not
+      (process.code_signature.subject_name : ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
+    ) or
+
+    /* Teams */
+    (process.name : "Teams.exe" and not
+      (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Discord */
+    (process.name : "Discord.exe" and not
+      (process.code_signature.subject_name : "Discord Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* RocketChat */
+    (process.name : "Rocket.Chat.exe" and not
+      (process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true)
+    ) or
+
+    /* Mattermost */
+    (process.name : "Mattermost.exe" and not
+      (process.code_signature.subject_name : "Mattermost, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WhatsApp */
+    (process.name : "WhatsApp.exe" and not
+      (process.code_signature.subject_name : "WhatsApp LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Zoom */
+    (process.name : "Zoom.exe" and not
+      (process.code_signature.subject_name : "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
index f4d24782ac..b905ec04fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a suspicious zip file prepended with special characte
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ Identifies the creation of a suspicious zip file prepended with special characte
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://i.blackhat.com/USA-20/Wednesday/us-20-Wardle-Office-Drama-On-macOS.pdf
 * https://www.mdsec.co.uk/2018/08/escaping-the-sandbox-microsoft-office-on-macos/
 * https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<potential-microsoft-office-sandbox-evasion-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and not event.type:deletion and file.name:~$*.zip
-and host.os.type:macos
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:(macos and macos) and not event.type:deletion and file.name:~$*.zip
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,18 +61,3 @@ and host.os.type:macos
 ** Name: Virtualization/Sandbox Evasion
 ** ID: T1497
 ** Reference URL: https://attack.mitre.org/techniques/T1497/
-
-[[potential-microsoft-office-sandbox-evasion-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and file.name:~$*.zip
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 2a586fad0b..b9f5509a4f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -10,12 +10,13 @@ Windows contains accessibility features that may be launched with a key combinat
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,74 +28,65 @@ Windows contains accessibility features that may be launched with a key combinat
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<potential-modification-of-accessibility-binaries-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Modification of Accessibility Binaries
 
-Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by
-accessibility features. Windows contains accessibility features that may be launched with a key combination before a
-user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs
-are launched to get a command prompt or backdoor without logging in to the system.
+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
 
 More details can be found [here](https://attack.mitre.org/techniques/T1546/008/).
 
-This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features
-binaries' original file names, which is likely a custom binary deployed by the attacker.
+This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This activity should not happen legitimately. The security team should address any potential benign true positive
-(B-TP), as this configuration can put the user and the domain at risk.
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
 ### Response and remediation
 
@@ -104,43 +96,50 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("Utilman.exe", "winlogon.exe") and user.name == "SYSTEM" and
-process.args : ( "C:\\Windows\\System32\\osk.exe",
-"C:\\Windows\\System32\\Magnify.exe",
-"C:\\Windows\\System32\\Narrator.exe",
-"C:\\Windows\\System32\\Sethc.exe", "utilman.exe",
-"ATBroker.exe", "DisplaySwitch.exe", "sethc.exe" ) and
-not process.pe.original_file_name in ( "osk.exe",
-"sethc.exe", "utilman2.exe", "DisplaySwitch.exe",
-"ATBroker.exe", "ScreenMagnifier.exe", "SR.exe",
-"Narrator.exe", "magnify.exe", "MAGNIFY.EXE" ) /*
-uncomment once in winlogbeat to avoid bypass with rogue process with
-matching pe original file name */ /* and
-process.code_signature.subject_name == "Microsoft Windows" and
-process.code_signature.status == "trusted" */
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : ("Utilman.exe", "winlogon.exe") and user.name == "SYSTEM" and
+ process.args :
+    (
+    "C:\\Windows\\System32\\osk.exe",
+    "C:\\Windows\\System32\\Magnify.exe",
+    "C:\\Windows\\System32\\Narrator.exe",
+    "C:\\Windows\\System32\\Sethc.exe",
+    "utilman.exe",
+    "ATBroker.exe",
+    "DisplaySwitch.exe",
+    "sethc.exe"
+    )
+ and not process.pe.original_file_name in
+    (
+    "osk.exe",
+    "sethc.exe",
+    "utilman2.exe",
+    "DisplaySwitch.exe",
+    "ATBroker.exe",
+    "ScreenMagnifier.exe",
+    "SR.exe",
+    "Narrator.exe",
+    "magnify.exe",
+    "MAGNIFY.EXE"
+    )
+
+/* uncomment once in winlogbeat to avoid bypass with rogue process with matching pe original file name */
+/* and process.code_signature.subject_name == "Microsoft Windows" and process.code_signature.status == "trusted" */
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -152,8 +151,10 @@ process.code_signature.status == "trusted" */
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-
+* Sub-technique:
+** Name: Accessibility Features
+** ID: T1546.008
+** Reference URL: https://attack.mitre.org/techniques/T1546/008/
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -162,84 +163,7 @@ process.code_signature.status == "trusted" */
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[potential-modification-of-accessibility-binaries-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.parent.name : ("Utilman.exe", "winlogon.exe") and user.name ==
-"SYSTEM" and process.args : (
-"C:\\Windows\\System32\\osk.exe",
-"C:\\Windows\\System32\\Magnify.exe",
-"C:\\Windows\\System32\\Narrator.exe",
-"C:\\Windows\\System32\\Sethc.exe", "utilman.exe",
-"ATBroker.exe", "DisplaySwitch.exe", "sethc.exe" ) and
-not process.pe.original_file_name in ( "osk.exe",
-"sethc.exe", "utilman2.exe", "DisplaySwitch.exe",
-"ATBroker.exe", "ScreenMagnifier.exe", "SR.exe",
-"Narrator.exe", "magnify.exe", "MAGNIFY.EXE" ) /*
-uncomment once in winlogbeat to avoid bypass with rogue process with
-matching pe original file name */ /* and
-process.code_signature.subject_name == "Microsoft Windows" and
-process.code_signature.status == "trusted" */
-----------------------------------
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:winlogon.exe and not process.name:(atbroker.exe or
-displayswitch.exe or magnify.exe or narrator.exe or osk.exe or
-sethc.exe or utilman.exe)
-----------------------------------
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:1 and process.parent.name:winlogon.exe and
-process.name:(atbroker.exe or displayswitch.exe or magnify.exe or
-narrator.exe or osk.exe or sethc.exe or utilman.exe)
-----------------------------------
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:1 and process.parent.name:winlogon.exe and
-(process.name:atbroker.exe or process.name:displayswitch.exe or
-process.name:magnify.exe or process.name:narrator.exe or
-process.name:osk.exe or process.name:sethc.exe or
-process.name:utilman.exe)
-----------------------------------
-
+* Sub-technique:
+** Name: Accessibility Features
+** ID: T1546.008
+** Reference URL: https://attack.mitre.org/techniques/T1546/008/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-network-scan-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-network-scan-detected.asciidoc
new file mode 100644
index 0000000000..8ac5cb2a61
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-network-scan-detected.asciidoc
@@ -0,0 +1,72 @@
+[[potential-network-scan-detected]]
+=== Potential Network Scan Detected
+
+This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-network_traffic.*
+* packetbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Network
+* Tactic: Discovery
+* Tactic: Reconnaissance
+* Use Case: Network Security Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+destination.port :* and event.action: ("network_flow" or "connection_accepted" or "connection_attempted" )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
+* Sub-technique:
+** Name: Scanning IP Blocks
+** ID: T1595.001
+** Reference URL: https://attack.mitre.org/techniques/T1595/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-network-sweep-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-network-sweep-detected.asciidoc
new file mode 100644
index 0000000000..b09eb9b1cd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-network-sweep-detected.asciidoc
@@ -0,0 +1,72 @@
+[[potential-network-sweep-detected]]
+=== Potential Network Sweep Detected
+
+This rule identifies a potential network sweep.  A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-network_traffic.*
+* packetbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Network
+* Tactic: Discovery
+* Tactic: Reconnaissance
+* Use Case: Network Security Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+destination.port : (21 or 22 or 23 or 25 or 139 or 445 or 3389 or 5985 or 5986)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
+* Sub-technique:
+** Name: Scanning IP Blocks
+** ID: T1595.001
+** Reference URL: https://attack.mitre.org/techniques/T1595/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc
new file mode 100644
index 0000000000..270a099bfa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc
@@ -0,0 +1,83 @@
+[[potential-non-standard-port-http-https-connection]]
+=== Potential Non-Standard Port HTTP/HTTPS connection
+
+Identifies potentially malicious processes communicating via a port paring typically not associated with HTTP/HTTPS. For example, HTTP over port 8443 or port 440 as opposed to the traditional port 80 , 443. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where process.name : ("http", "https")
+  and destination.port not in (80, 443)
+  and event.action in ("connection_attempted", "connection_accepted")
+  and destination.ip != "127.0.0.1"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Non-Standard Port
+** ID: T1571
+** Reference URL: https://attack.mitre.org/techniques/T1571/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
+* Technique:
+** Name: Encrypted Channel
+** ID: T1573
+** Reference URL: https://attack.mitre.org/techniques/T1573/
+* Sub-technique:
+** Name: Symmetric Cryptography
+** ID: T1573.001
+** Reference URL: https://attack.mitre.org/techniques/T1573/001/
+* Sub-technique:
+** Name: Asymmetric Cryptography
+** ID: T1573.002
+** Reference URL: https://attack.mitre.org/techniques/T1573/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-ssh-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-ssh-connection.asciidoc
index c5da69891f..3a8e279bc2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-ssh-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-ssh-connection.asciidoc
@@ -5,7 +5,7 @@ Identifies potentially malicious processes communicating via a port paring typic
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,50 +13,48 @@ Identifies potentially malicious processes communicating via a port paring typic
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://attack.mitre.org/techniques/T1571/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Command and Control
-* macOS
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* OS: macOS
 
-*Version*: 1
+*Version*: 3
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-SSH over ports apart from the traditional port 22 is highly uncommon. This rule alerts the usage of the such uncommon ports by the ssh service. Tuning is needed to have higher confidence. If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination whitelisted ports for such legitimate ssh activities.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [process where
-event.action == "exec" and process.name:"ssh"] [network where
-process.name:"ssh" and event.action in ("connection_attempted",
-"connection_accepted") and destination.port != 22 and destination.ip
-!= "127.0.0.1" and network.transport: "tcp" ]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=1m
+[process where event.action == "exec" and process.name:"ssh"]
+[network where process.name:"ssh"
+ and event.action in ("connection_attempted", "connection_accepted")
+ and destination.port != 22
+ and destination.ip != "127.0.0.1"
+ and network.transport: "tcp"
+]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
index 022a884672..3a3edbbbd5 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
@@ -5,81 +5,89 @@ Identifies a Secure Shell (SSH) client or server process creating or writing to
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/eset/malware-ioc/tree/master/sshdoor
 * https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-* Credential Access
-
-*Version*: 100 (<<potential-openssh-backdoor-logging-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Updates to approved and trusted SSH executables can trigger this rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "change" and process.executable :
-("/usr/sbin/sshd", "/usr/bin/ssh") and ( (file.name : (".*",
-"~*", "*~") and not file.name : (".cache", ".viminfo",
-".bash_history")) or file.extension : ("in", "out", "ini", "h",
-"gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7",
-"8", "9") or file.path : ( "/private/etc/*--",
-"/usr/share/*", "/usr/include/*", "/usr/local/include/*",
-"/private/tmp/*", "/private/var/tmp/*", "/usr/tmp/*",
-"/usr/share/man/*", "/usr/local/share/*",
-"/usr/lib/*.so.*", "/private/etc/ssh/.sshd_auth",
-"/usr/bin/ssd", "/private/var/opt/power",
-"/private/etc/ssh/ssh_known_hosts", "/private/var/html/lol",
-"/private/var/log/utmp", "/private/var/lib",
-"/var/run/sshd/sshd.pid", "/var/run/nscd/ns.pid",
-"/var/run/udev/ud.pid", "/var/run/udevd.pid" ) )
+[source, js]
 ----------------------------------
+file where host.os.type == "linux" and event.type == "change" and process.executable : ("/usr/sbin/sshd", "/usr/bin/ssh") and
+  (
+    (file.name : (".*", "~*", "*~") and not file.name : (".cache", ".viminfo", ".bash_history")) or
+    file.extension : ("in", "out", "ini", "h", "gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or
+    file.path :
+    (
+      "/private/etc/*--",
+      "/usr/share/*",
+      "/usr/include/*",
+      "/usr/local/include/*",
+      "/private/tmp/*",
+      "/private/var/tmp/*",
+      "/usr/tmp/*",
+      "/usr/share/man/*",
+      "/usr/local/share/*",
+      "/usr/lib/*.so.*",
+      "/private/etc/ssh/.sshd_auth",
+      "/usr/bin/ssd",
+      "/private/var/opt/power",
+      "/private/etc/ssh/ssh_known_hosts",
+      "/private/var/html/lol",
+      "/private/var/log/utmp",
+      "/private/var/lib",
+      "/var/run/sshd/sshd.pid",
+      "/var/run/nscd/ns.pid",
+      "/var/run/udev/ud.pid",
+      "/var/run/udevd.pid"
+    )
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -91,8 +99,6 @@ file where event.type == "change" and process.executable :
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -101,34 +107,3 @@ file where event.type == "change" and process.executable :
 ** Name: Compromise Client Software Binary
 ** ID: T1554
 ** Reference URL: https://attack.mitre.org/techniques/T1554/
-
-[[potential-openssh-backdoor-logging-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "change" and process.executable :
-("/usr/sbin/sshd", "/usr/bin/ssh") and ( file.name : (".*",
-"~*") or file.extension : ("in", "out", "ini", "h", "gz", "so",
-"sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or
-file.path : ( "/private/etc/*--", "/usr/share/*",
-"/usr/include/*", "/usr/local/include/*",
-"/private/tmp/*", "/private/var/tmp/*", "/usr/tmp/*",
-"/usr/share/man/*", "/usr/local/share/*",
-"/usr/lib/*.so.*", "/private/etc/ssh/.sshd_auth",
-"/usr/bin/ssd", "/private/var/opt/power",
-"/private/etc/ssh/ssh_known_hosts", "/private/var/html/lol",
-"/private/var/log/utmp", "/private/var/lib",
-"/var/run/sshd/sshd.pid", "/var/run/nscd/ns.pid",
-"/var/run/udev/ud.pid", "/var/run/udevd.pid" ) )
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-pass-the-hash-pth-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-pass-the-hash-pth-attempt.asciidoc
new file mode 100644
index 0000000000..d8dc4fc7ac
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-pass-the-hash-pth-attempt.asciidoc
@@ -0,0 +1,69 @@
+[[potential-pass-the-hash-pth-attempt]]
+=== Potential Pass-the-Hash (PtH) Attempt
+
+Adversaries may pass the hash using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+* logs-system.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1550/002/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:"windows" and 
+event.category : "authentication" and event.action : "logged-in" and 
+winlog.logon.type : "NewCredentials" and event.outcome : "success" and 
+user.id : (S-1-5-21-* or S-1-12-1-*) and winlog.event_data.LogonProcessName : "seclogo"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Pass the Hash
+** ID: T1550.002
+** Reference URL: https://attack.mitre.org/techniques/T1550/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
index 581a86fb07..cb5eccf0d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
@@ -5,7 +5,7 @@ Identifies a high number (25) of failed Microsoft 365 user authentication attemp
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,56 +14,47 @@ Identifies a high number (25) of failed Microsoft 365 user authentication attemp
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Identity and Access
+*Tags*: 
 
-*Version*: 101 (<<potential-password-spraying-of-microsoft-365-user-accounts-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(Exchange or
-AzureActiveDirectory) and event.category:authentication and
-event.action:("UserLoginFailed" or
-"PasswordLogonInitialAuthUsingPassword")
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:(Exchange or AzureActiveDirectory) and event.category:authentication and
+event.action:("UserLoginFailed" or "PasswordLogonInitialAuthUsingPassword")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,62 +66,3 @@ event.action:("UserLoginFailed" or
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[potential-password-spraying-of-microsoft-365-user-accounts-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(Exchange or
-AzureActiveDirectory) and event.category:authentication and
-event.action:("UserLoginFailed" or
-"PasswordLogonInitialAuthUsingPassword")
-----------------------------------
-
-Version 6 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(Exchange or
-AzureActiveDirectory) and event.category:authentication and
-event.action:("UserLoginFailed" or
-"PasswordLogonInitialAuthUsingPassword") and event.outcome:success
-----------------------------------
-
-Version 5 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:(Exchange or
-AzureActiveDirectory) and event.category:authentication and
-event.action:("UserLoginFailed" or
-"PasswordLogonInitialAuthUsingPassword") and event.outcome:failure
-----------------------------------
-
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:o365.audit and event.provider:AzureActiveDirectory and
-event.category:authentication and event.action:UserLoginFailed and
-event.outcome:failure
-----------------------------------
-
-Version 3 (7.13.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
new file mode 100644
index 0000000000..acac554362
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -0,0 +1,136 @@
+[[potential-persistence-through-init-d-detected]]
+=== Potential Persistence Through init.d Detected
+
+Files that are placed in the /etc/init.d/ directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the "systemd-sysv-generator" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the /etc/init.d/ directory to execute malicious code upon boot in order to gain persistence on the system.
+
+*Rule type*: new_terms
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/
+* https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts
+* https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Persistence Through init.d Detected
+
+The `/etc/init.d` directory is used in Linux systems to store the initialization scripts for various services and daemons that are executed during system startup and shutdown.
+
+Attackers can abuse files within the `/etc/init.d/` directory to run scripts, commands or malicious software every time a system is rebooted by converting an executable file into a service file through the `systemd-sysv-generator`. After conversion, a unit file is created within the `/run/systemd/generator.late/` directory.
+
+This rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+#### Possible Investigation Steps
+
+- Investigate the file that was created or modified.
+  - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
+- Investigate whether any other files in the `/etc/init.d/` or `/run/systemd/generator.late/` directories have been altered.
+  - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')"}}
+  - !{osquery{"label":"Osquery - Retrieve Additional File Listing Information","query":"SELECT\n  f.path,\n  u.username AS file_owner,\n  g.groupname AS group_owner,\n  datetime(f.atime, 'unixepoch') AS file_last_access_time,\n  datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\n  datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\n  datetime(f.btime, 'unixepoch') AS file_created_time,\n  f.size AS size_bytes\nFROM\n  file f\n  LEFT JOIN users u ON f.uid = u.uid\n  LEFT JOIN groups g ON f.gid = g.gid\nWHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\n"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate syslog through the `sudo cat /var/log/syslog | grep 'LSB'` command to find traces of the LSB header of the script (if present). If syslog is being ingested into Elasticsearch, the same can be accomplished through Kibana.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+        - Cron jobs, services and other persistence mechanisms.
+            - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
+
+### False Positive Analysis
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If this activity is related to a system administrator who uses init.d for administrative purposes, consider adding exceptions for this specific administrator user account.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+### Related Rules
+
+- Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the maliciously created service/init.d files or restore it to the original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type :"linux" and event.action:("creation" or "file_create_event" or "rename" or "file_rename_event") and
+file.path : /etc/init.d/* and not process.executable : ("/usr/bin/dpkg" or "/usr/bin/dockerd" or "/bin/rpm") and not
+file.extension : "swp"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
new file mode 100644
index 0000000000..8046166b2f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -0,0 +1,130 @@
+[[potential-persistence-through-motd-file-creation-detected]]
+=== Potential Persistence Through MOTD File Creation Detected
+
+Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and "/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the creation of potentially malicious files within the default MOTD file directories.
+
+*Rule type*: new_terms
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Persistence Through MOTD File Creation Detected
+
+The message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.
+
+Attackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Executable files in these directories automatically run with root privileges.
+
+This rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible Investigation Steps
+
+- Investigate the file that was created or modified.
+  - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
+- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.
+  - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')"}}
+  - !{osquery{"label":"Osquery - Retrieve Additional File Listing Information","query":"SELECT\n  f.path,\n  u.username AS file_owner,\n  g.groupname AS group_owner,\n  datetime(f.atime, 'unixepoch') AS file_last_access_time,\n  datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\n  datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\n  datetime(f.btime, 'unixepoch') AS file_created_time,\n  f.size AS size_bytes\nFROM\n  file f\n  LEFT JOIN users u ON f.uid = u.uid\n  LEFT JOIN groups g ON f.gid = g.gid\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\n"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate whether the modified scripts call other malicious scripts elsewhere on the file system.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+        - Cron jobs, services and other persistence mechanisms.
+            - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
+
+### Related Rules
+
+- Suspicious Process Spawned from MOTD Detected - 4ec47004-b34a-42e6-8003-376a123ea447
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the MOTD files or restore their original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type :"linux" and event.action:("creation" or "file_create_event" or "rename" or "file_rename_event") and
+file.path : (/etc/update-motd.d/* or /usr/lib/update-notifier/*) and not
+process.executable : ("/usr/bin/dpkg" or "/usr/bin/dockerd" or "/bin/rpm") and not file.extension : "swp"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
new file mode 100644
index 0000000000..0f5d3d9d2c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -0,0 +1,137 @@
+[[potential-persistence-through-run-control-detected]]
+=== Potential Persistence Through Run Control Detected
+
+This rule monitors the creation/alteration of the rc.local file by a previously unknown process executable through the use of the new terms rule type. The /etc/rc.local file is used to start custom applications, services, scripts or commands during start-up. The rc.local file has mostly been replaced by Systemd. However, through the "systemd-rc-local-generator", rc.local files can be converted to services that run at boot. Adversaries may alter rc.local to execute malicious code at start-up, and gain persistence onto the system.
+
+*Rule type*: new_terms
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/
+* https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts
+* https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 104
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Persistence Through Run Control Detected
+
+The `rc.local` file executes custom commands or scripts during system startup on Linux systems. `rc.local` has been deprecated in favor of the use of `systemd services`, and more recent Unix distributions no longer leverage this method of on-boot script execution.
+
+There might still be users that use `rc.local` in a benign matter, so investigation to see whether the file is malicious is vital.
+
+Detection alerts from this rule indicate the creation of a new `/etc/rc.local` file.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible Investigation Steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the file that was created or modified.
+  - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate whether the `/lib/systemd/system/rc-local.service` and `/run/systemd/generator/multi-user.target.wants/rc-local.service` files were created through the `systemd-rc-local-generator` located at `/usr/lib/systemd/system-generators/systemd-rc-local-generator`.
+  - !{osquery{"label":"Osquery - Retrieve rc-local.service File Information","query":"SELECT * FROM file WHERE (path = '/run/systemd/generator/multi-user.target.wants/rc-local.service' OR path = '/run/systemd/generator/multi-user.target.wants/rc-local.service')"}}
+  - In case the file is not present here, `sudo systemctl status rc-local` can be executed to find the location of the rc-local unit file.
+  - If `rc-local.service` is found, manual investigation is required to check for the rc script execution. Systemd will generate syslogs in case of the execution of the rc-local service. `sudo cat /var/log/syslog | grep "rc-local.service|/etc/rc.local Compatibility"` can be executed to check for the execution of the service.
+    - If logs are found, it's likely that the contents of the `rc.local` file have been executed. Analyze the logs. In case several syslog log files are available, use a wildcard to search through all of the available logs.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+        - Cron jobs, services and other persistence mechanisms.
+            - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
+
+### False Positive Analysis
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If this activity is related to a system administrator who uses `rc.local` for administrative purposes, consider adding exceptions for this specific administrator user account.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+### Response and remediation
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the `service/rc.local` files or restore their original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type : "linux" and event.category : "file" and
+event.type : ("change" or "file_modify_event" or "creation" or "file_create_event") and
+file.path : "/etc/rc.local" and not file.extension : "swp"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
+* Sub-technique:
+** Name: RC Scripts
+** ID: T1037.004
+** Reference URL: https://attack.mitre.org/techniques/T1037/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
index 027f323462..0428a4f724 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to the Atom desktop text editor Init File. Adversaries
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ Identifies modifications to the Atom desktop text editor Init File. Adversaries
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/D00MFist/PersistentJXA/blob/master/AtomPersist.js
 * https://flight-manual.atom.io/hacking-atom/sections/the-init-file/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<potential-persistence-via-atom-init-script-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:"file" and not event.type:"deletion" and
-file.path:/Users/*/.atom/init.coffee and not process.name:(Atom or
-xpcproxy) and not user.name:root
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and not event.type:"deletion" and
+ file.path:/Users/*/.atom/init.coffee and not process.name:(Atom or xpcproxy) and not user.name:root
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,13 +61,3 @@ xpcproxy) and not user.name:root
 ** Name: Boot or Logon Initialization Scripts
 ** ID: T1037
 ** Reference URL: https://attack.mitre.org/techniques/T1037/
-
-[[potential-persistence-via-atom-init-script-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
index fad726a0ed..cfa176d3bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of the login window property list (plist
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,58 +14,53 @@ Identifies the creation or modification of the login window property list (plist
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/D00MFist/PersistentJXA/blob/master/LoginScript.js
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 101 (<<potential-persistence-via-login-hook-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. This can be abused to establish or maintain persistence on a compromised system.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:"file" and not event.type:"deletion" and
-file.name:"com.apple.loginwindow.plist" and process.name:(* and not
-(systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync
-or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor
-or backupd or "iMazing Profile Editor" ))
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and not event.type:"deletion" and
+ file.name:"com.apple.loginwindow.plist" and
+ process.name:(* and not (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor or backupd or "iMazing Profile Editor"
+))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +72,6 @@ or backupd or "iMazing Profile Editor" ))
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -87,27 +80,3 @@ or backupd or "iMazing Profile Editor" ))
 ** Name: Plist File Modification
 ** ID: T1647
 ** Reference URL: https://attack.mitre.org/techniques/T1647/
-
-[[potential-persistence-via-login-hook-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:"file" and not event.type:"deletion" and
-file.name:"com.apple.loginwindow.plist" and process.name:(* and not
-(systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync
-or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor))
-----------------------------------
-
-Version 2 (7.13.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
index 10a37f4639..09d2df3426 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of the default configuration for periodi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,47 +14,43 @@ Identifies the creation or modification of the default configuration for periodi
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://opensource.apple.com/source/crontabs/crontabs-13/private/etc/defaults/periodic.conf.auto.html
 * https://www.oreilly.com/library/view/mac-os-x/0596003706/re328.html
 * https://github.com/D00MFist/PersistentJXA/blob/master/PeriodicPersist.js
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<potential-persistence-via-periodic-tasks-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:"file" and not event.type:"deletion" and
-file.path:(/private/etc/periodic/* or
-/private/etc/defaults/periodic.conf or /private/etc/periodic.conf)
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and not event.type:"deletion" and
+ file.path:(/private/etc/periodic/* or /private/etc/defaults/periodic.conf or /private/etc/periodic.conf)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,13 +62,7 @@ file.path:(/private/etc/periodic/* or
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[potential-persistence-via-periodic-tasks-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
index 8b5062dcc3..1c4364b585 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
@@ -5,53 +5,55 @@ Identifies modification of the Time Provider. Adversaries may establish persiste
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://pentestlab.blog/2019/10/22/persistence-time-providers/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<potential-persistence-via-time-provider-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type:"change" and registry.path:"HKLM\\SYSTEM\\
-*ControlSet*\\Services\\W32Time\\TimeProviders\\*" and
-registry.data.strings:"*.dll"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type:"change" and
+  registry.path: (
+    "HKLM\\SYSTEM\\*ControlSet*\\Services\\W32Time\\TimeProviders\\*",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\W32Time\\TimeProviders\\*"
+  ) and
+  registry.data.strings:"*.dll"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,19 +65,7 @@ registry.data.strings:"*.dll"
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[potential-persistence-via-time-provider-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Time Providers
+** ID: T1547.003
+** Reference URL: https://attack.mitre.org/techniques/T1547/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc
index 9485d49086..9102af0064 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc
@@ -5,57 +5,58 @@ Identifies port monitor and print processor registry modifications. Adversaries
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<potential-port-monitor-or-print-processor-registration-abuse-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path :
-("HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*", "HKLM\
-\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print
-Processors\\*") and registry.data.strings : "*.dll" and /* exclude
-SYSTEM SID - look for changes by non-SYSTEM user */ not user.id :
-"S-1-5-18"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  registry.path : (
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*",
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*"
+  ) and registry.data.strings : "*.dll" and
+  /* exclude SYSTEM SID - look for changes by non-SYSTEM user */
+  not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -67,8 +68,10 @@ SYSTEM SID - look for changes by non-SYSTEM user */ not user.id :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-
+* Sub-technique:
+** Name: Port Monitors
+** ID: T1547.010
+** Reference URL: https://attack.mitre.org/techniques/T1547/010/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -77,27 +80,7 @@ SYSTEM SID - look for changes by non-SYSTEM user */ not user.id :
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[potential-port-monitor-or-print-processor-registration-abuse-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path :
-("HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*", "HLLM\
-\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print
-Processors\\*") and registry.data.strings : "*.dll" and /* exclude
-SYSTEM SID - look for changes by non-SYSTEM user */ not user.id :
-"S-1-5-18"
-----------------------------------
-
+* Sub-technique:
+** Name: Port Monitors
+** ID: T1547.010
+** Reference URL: https://attack.mitre.org/techniques/T1547/010/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
new file mode 100644
index 0000000000..39d93bd526
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -0,0 +1,255 @@
+[[potential-powershell-hacktool-script-by-function-names]]
+=== Potential PowerShell HackTool Script by Function Names
+
+Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+* https://github.com/BC-SECURITY/Empire
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: PowerShell Logs
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Add-DomainGroupMember" or "Add-DomainObjectAcl" or
+    "Add-RemoteConnection" or "Add-ServiceDacl" or
+    "Add-Win32Type" or "Convert-ADName" or
+    "Convert-LDAPProperty" or "ConvertFrom-LDAPLogonHours" or
+    "ConvertFrom-UACValue" or "Copy-ArrayOfMemAddresses" or
+    "Create-NamedPipe" or "Create-ProcessWithToken" or
+    "Create-RemoteThread" or "Create-SuspendedWinLogon" or
+    "Create-WinLogonProcess" or "Emit-CallThreadStub" or
+    "Enable-SeAssignPrimaryTokenPrivilege" or "Enable-SeDebugPrivilege" or
+    "Enum-AllTokens" or "Export-PowerViewCSV" or
+    "Find-AVSignature" or "Find-AppLockerLog" or
+    "Find-DomainLocalGroupMember" or "Find-DomainObjectPropertyOutlier" or
+    "Find-DomainProcess" or "Find-DomainShare" or
+    "Find-DomainUserEvent" or "Find-DomainUserLocation" or
+    "Find-InterestingDomainAcl" or "Find-InterestingDomainShareFile" or
+    "Find-InterestingFile" or "Find-LocalAdminAccess" or
+    "Find-PSScriptsInPSAppLog" or "Find-PathDLLHijack" or
+    "Find-ProcessDLLHijack" or "Find-RDPClientConnection" or
+    "Get-AllAttributesForClass" or "Get-CachedGPPPassword" or
+    "Get-DecryptedCpassword" or "Get-DecryptedSitelistPassword" or
+    "Get-DelegateType" or
+    "Get-DomainDFSShare" or "Get-DomainDFSShareV1" or
+    "Get-DomainDFSShareV2" or "Get-DomainDNSRecord" or
+    "Get-DomainDNSZone" or "Get-DomainFileServer" or
+    "Get-DomainForeignGroupMember" or "Get-DomainForeignUser" or
+    "Get-DomainGPO" or "Get-DomainGPOComputerLocalGroupMapping" or
+    "Get-DomainGPOLocalGroup" or "Get-DomainGPOUserLocalGroupMapping" or
+    "Get-DomainGUIDMap" or "Get-DomainGroup" or
+    "Get-DomainGroupMember" or "Get-DomainGroupMemberDeleted" or
+    "Get-DomainManagedSecurityGroup" or "Get-DomainOU" or
+    "Get-DomainObject" or "Get-DomainObjectAcl" or
+    "Get-DomainObjectAttributeHistory" or "Get-DomainObjectLinkedAttributeHistory" or
+    "Get-DomainPolicyData" or "Get-DomainSID" or
+    "Get-DomainSPNTicket" or "Get-DomainSearcher" or
+    "Get-DomainSite" or "Get-DomainSubnet" or
+    "Get-DomainTrust" or "Get-DomainTrustMapping" or
+    "Get-DomainUser" or "Get-DomainUserEvent" or
+    "Get-Forest" or "Get-ForestDomain" or
+    "Get-ForestGlobalCatalog" or "Get-ForestSchemaClass" or
+    "Get-ForestTrust" or "Get-GPODelegation" or
+    "Get-GPPAutologon" or "Get-GPPInnerField" or
+    "Get-GPPInnerFields" or "Get-GPPPassword" or
+    "Get-GptTmpl" or "Get-GroupsXML" or
+    "Get-HttpStatus" or "Get-ImageNtHeaders" or
+    "Get-Keystrokes" or
+    "Get-MemoryProcAddress" or "Get-MicrophoneAudio" or
+    "Get-ModifiablePath" or "Get-ModifiableRegistryAutoRun" or
+    "Get-ModifiableScheduledTaskFile" or "Get-ModifiableService" or
+    "Get-ModifiableServiceFile" or "Get-Name" or
+    "Get-NetComputerSiteName" or "Get-NetLocalGroup" or
+    "Get-NetLocalGroupMember" or "Get-NetLoggedon" or
+    "Get-NetRDPSession" or "Get-NetSession" or
+    "Get-NetShare" or "Get-PEArchitecture" or
+    "Get-PEBasicInfo" or "Get-PEDetailedInfo" or
+    "Get-PathAcl" or "Get-PrimaryToken" or
+    "Get-ProcAddress" or "Get-ProcessTokenGroup" or
+    "Get-ProcessTokenPrivilege" or "Get-ProcessTokenType" or
+    "Get-RegLoggedOn" or "Get-RegistryAlwaysInstallElevated" or
+    "Get-RegistryAutoLogon" or "Get-RemoteProcAddress" or
+    "Get-Screenshot" or "Get-ServiceDetail" or
+    "Get-SiteListPassword" or "Get-SitelistField" or
+    "Get-System" or "Get-SystemNamedPipe" or
+    "Get-SystemToken" or "Get-ThreadToken" or
+    "Get-TimedScreenshot" or "Get-TokenInformation" or
+    "Get-TopPort" or "Get-UnattendedInstallFile" or
+    "Get-UniqueTokens" or "Get-UnquotedService" or
+    "Get-VaultCredential" or "Get-VaultElementValue" or
+    "Get-VirtualProtectValue" or "Get-VolumeShadowCopy" or
+    "Get-WMIProcess" or "Get-WMIRegCachedRDPConnection" or
+    "Get-WMIRegLastLoggedOn" or "Get-WMIRegMountedDrive" or
+    "Get-WMIRegProxy" or "Get-WebConfig" or
+    "Get-Win32Constants" or "Get-Win32Functions" or
+    "Get-Win32Types" or "Import-DllImports" or
+    "Import-DllInRemoteProcess" or "Inject-LocalShellcode" or
+    "Inject-RemoteShellcode" or "Install-ServiceBinary" or
+    "Invoke-CompareAttributesForClass" or "Invoke-CreateRemoteThread" or
+    "Invoke-CredentialInjection" or "Invoke-DllInjection" or
+    "Invoke-EventVwrBypass" or "Invoke-ImpersonateUser" or
+    "Invoke-Kerberoast" or "Invoke-MemoryFreeLibrary" or
+    "Invoke-MemoryLoadLibrary" or "Invoke-Method" or
+    "Invoke-Mimikatz" or "Invoke-NinjaCopy" or
+    "Invoke-PatchDll" or "Invoke-Portscan" or
+    "Invoke-PrivescAudit" or "Invoke-ReflectivePEInjection" or
+    "Invoke-ReverseDnsLookup" or "Invoke-RevertToSelf" or
+    "Invoke-ServiceAbuse" or "Invoke-Shellcode" or
+    "Invoke-TokenManipulation" or "Invoke-UserImpersonation" or
+    "Invoke-WmiCommand" or "Mount-VolumeShadowCopy" or
+    "New-ADObjectAccessControlEntry" or "New-DomainGroup" or
+    "New-DomainUser" or "New-DynamicParameter" or
+    "New-InMemoryModule" or
+    "New-ThreadedFunction" or "New-VolumeShadowCopy" or
+    "Out-CompressedDll" or "Out-EncodedCommand" or
+    "Out-EncryptedScript" or "Out-Minidump" or
+    "PortScan-Alive" or "Portscan-Port" or
+    "Remove-DomainGroupMember" or "Remove-DomainObjectAcl" or
+    "Remove-RemoteConnection" or "Remove-VolumeShadowCopy" or
+    "Restore-ServiceBinary" or "Set-DesktopACLToAllowEveryone" or
+    "Set-DesktopACLs" or "Set-DomainObject" or
+    "Set-DomainObjectOwner" or "Set-DomainUserPassword" or
+    "Set-ServiceBinaryPath" or "Sub-SignedIntAsUnsigned" or
+    "Test-AdminAccess" or "Test-MemoryRangeValid" or
+    "Test-ServiceDaclPermission" or "Update-ExeFunctions" or
+    "Update-MemoryAddresses" or "Update-MemoryProtectionFlags" or
+    "Write-BytesToMemory" or "Write-HijackDll" or
+    "Write-PortscanOut" or "Write-ServiceBinary" or
+    "Write-UserAddMSI" or "Invoke-Privesc" or
+    "func_get_proc_address" or "Invoke-BloodHound" or
+    "Invoke-HostEnum" or "Get-BrowserInformation" or
+    "Get-DomainAccountPolicy" or "Get-DomainAdmins" or
+    "Get-AVProcesses" or "Get-AVInfo" or
+    "Get-RecycleBin" or "Invoke-BruteForce" or
+    "Get-PassHints" or "Invoke-SessionGopher" or
+    "Get-LSASecret" or "Get-PassHashes" or
+    "Invoke-WdigestDowngrade" or "Get-ChromeDump" or
+    "Invoke-DomainPasswordSpray" or "Get-FoxDump" or
+    "New-HoneyHash" or "Invoke-DCSync" or
+    "Invoke-PowerDump" or "Invoke-SSIDExfil" or
+    "Invoke-PowerShellTCP" or "Add-Exfiltration" or
+    "Do-Exfiltration" or "Invoke-DropboxUpload" or
+    "Invoke-ExfilDataToGitHub" or "Invoke-EgressCheck" or
+    "Invoke-PostExfil" or "Create-MultipleSessions" or
+    "Invoke-NetworkRelay" or "New-GPOImmediateTask" or
+    "Invoke-WMIDebugger" or "Invoke-SQLOSCMD" or
+    "Invoke-SMBExec" or "Invoke-PSRemoting" or
+    "Invoke-ExecuteMSBuild" or "Invoke-DCOM" or
+    "Invoke-InveighRelay" or "Invoke-PsExec" or
+    "Invoke-SSHCommand" or "Find-ActiveUsersWMI" or
+    "Get-SystemDrivesWMI" or "Get-ActiveNICSWMI" or
+    "Remove-Persistence" or "DNS_TXT_Pwnage" or
+    "Execute-OnTime" or "HTTP-Backdoor" or
+    "Add-ConstrainedDelegationBackdoor" or "Add-RegBackdoor" or
+    "Add-ScrnSaveBackdoor" or "Gupt-Backdoor" or
+    "Invoke-ADSBackdoor" or "Add-Persistence" or
+    "Invoke-ResolverBackdoor" or "Invoke-EventLogBackdoor" or
+    "Invoke-DeadUserBackdoor" or "Invoke-DisableMachineAcctChange" or
+    "Invoke-AccessBinary" or "Add-NetUser" or
+    "Invoke-Schtasks" or "Invoke-JSRatRegsvr" or
+    "Invoke-JSRatRundll" or "Invoke-PoshRatHttps" or
+    "Invoke-PsGcatAgent" or "Remove-PoshRat" or
+    "Install-SSP" or "Invoke-BackdoorLNK" or
+    "PowerBreach" or "InstallEXE-Persistence" or
+    "RemoveEXE-Persistence" or "Install-ServiceLevel-Persistence" or
+    "Remove-ServiceLevel-Persistence" or "Invoke-Prompt" or
+    "Invoke-PacketCapture" or "Start-WebcamRecorder" or
+    "Get-USBKeyStrokes" or "Invoke-KeeThief" or
+    "Get-Keystrokes" or "Invoke-NetRipper" or
+    "Get-EmailItems" or "Invoke-MailSearch" or
+    "Invoke-SearchGAL" or "Get-WebCredentials" or
+    "Start-CaptureServer" or "Invoke-PowerShellIcmp" or
+    "Invoke-PowerShellTcpOneLine" or "Invoke-PowerShellTcpOneLineBind" or
+    "Invoke-PowerShellUdp" or "Invoke-PowerShellUdpOneLine" or
+    "Run-EXEonRemote" or "Download-Execute-PS" or
+    "Out-RundllCommand" or "Set-RemoteWMI" or
+    "Set-DCShadowPermissions" or "Invoke-PowerShellWMI" or
+    "Invoke-Vnc" or "Invoke-LockWorkStation" or
+    "Invoke-EternalBlue" or "Invoke-ShellcodeMSIL" or
+    "Invoke-MetasploitPayload" or "Invoke-DowngradeAccount" or
+    "Invoke-RunAs" or "ExetoText" or
+    "Disable-SecuritySettings" or "Set-MacAttribute" or
+    "Invoke-MS16032" or "Invoke-BypassUACTokenManipulation" or
+    "Invoke-SDCLTBypass" or "Invoke-FodHelperBypass" or
+    "Invoke-EventVwrBypass" or "Invoke-EnvBypass" or
+    "Get-ServiceUnquoted" or "Get-ServiceFilePermission" or
+    "Get-ServicePermission" or "Get-ServicePermission" or
+    "Enable-DuplicateToken" or "Invoke-PsUaCme" or
+    "Invoke-Tater" or "Invoke-WScriptBypassUAC" or
+    "Invoke-AllChecks" or "Find-TrustedDocuments" or
+    "Invoke-Interceptor" or "Invoke-PoshRatHttp" or
+    "Invoke-ExecCommandWMI" or "Invoke-KillProcessWMI" or
+    "Invoke-CreateShareandExecute" or "Invoke-RemoteScriptWithOutput" or
+    "Invoke-SchedJobManipulation" or "Invoke-ServiceManipulation" or
+    "Invoke-PowerOptionsWMI" or "Invoke-DirectoryListing" or
+    "Invoke-FileTransferOverWMI" or "Invoke-WMImplant" or
+    "Invoke-WMIObfuscatedPSCommand" or "Invoke-WMIDuplicateClass" or
+    "Invoke-WMIUpload" or "Invoke-WMIRemoteExtract" or "Invoke-winPEAS"
+  )
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
index 0f07d511b3..e967bceae1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusin
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,56 +14,53 @@ Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusin
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Privilege Escalation
-* Defense Evasion
-
-*Version*: 100 (<<potential-privacy-control-bypass-via-localhost-secure-copy-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name:"scp" and process.args:"StrictHostKeyChecking=no" and
-process.command_line:("scp *localhost:/*", "scp *127.0.0.1:/*") and
-not process.args:"vagrant@*127.0.0.1*"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+ process.name:"scp" and
+ process.args:"StrictHostKeyChecking=no" and
+ process.command_line:("scp *localhost:/*", "scp *127.0.0.1:/*") and
+ not process.args:"vagrant@*127.0.0.1*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,8 +72,6 @@ not process.args:"vagrant@*127.0.0.1*"
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -85,27 +80,3 @@ not process.args:"vagrant@*127.0.0.1*"
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[potential-privacy-control-bypass-via-localhost-secure-copy-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name:"scp" and process.args:"StrictHostKeyChecking=no" and
-process.command_line:("scp *localhost:/*", "scp *127.0.0.1:/*") and
-not process.args:"vagrant@*127.0.0.1*"
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
index 610b9ba6e0..da1da57e60 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of sqlite3 to directly modify the Transparency, Consent, and
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,57 +14,52 @@ Identifies the use of sqlite3 to directly modify the Transparency, Consent, and
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/
 * https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh
 * https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<potential-privacy-control-bypass-via-tccdb-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "sqlite*" and process.args : "/*/Application
-Support/com.apple.TCC/TCC.db" and not process.parent.executable :
-"/Library/Bitdefender/AVP/product/bin/*"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "sqlite*" and
+ process.args : "/*/Application Support/com.apple.TCC/TCC.db" and
+ not process.parent.executable : "/Library/Bitdefender/AVP/product/bin/*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,26 +71,7 @@ Support/com.apple.TCC/TCC.db" and not process.parent.executable :
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[potential-privacy-control-bypass-via-tccdb-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "sqlite*" and process.args : "/*/Application
-Support/com.apple.TCC/TCC.db"
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc
new file mode 100644
index 0000000000..482baad1e3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc
@@ -0,0 +1,66 @@
+[[potential-privilege-escalation-through-writable-docker-socket]]
+=== Potential Privilege Escalation through Writable Docker Socket
+
+This rule monitors for the usage of Docker runtime sockets to escalate privileges on Linux systems. Docker sockets by default are only be writable by the root user and docker group. Attackers that have permissions to write to these sockets may be able to create and run a container that allows them to escalate privileges and gain further access onto the host file system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#automatic-enumeration-and-escape
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Domain: Container
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and 
+(
+  (process.name == "docker" and process.args : "run" and process.args : "-it"  and 
+   process.args : ("unix://*/docker.sock", "unix://*/dockershim.sock")) or 
+  (process.name == "socat" and process.args : ("UNIX-CONNECT:*/docker.sock", "UNIX-CONNECT:*/dockershim.sock"))
+) and not user.Ext.real.id : "0" and not group.Ext.real.id : "0"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Escape to Host
+** ID: T1611
+** Reference URL: https://attack.mitre.org/techniques/T1611/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index 029666ff88..a05293c997 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -15,7 +15,7 @@ Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) defaul
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,65 +27,58 @@ Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) defaul
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<potential-privilege-escalation-via-installerfiletakeover-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Privilege Escalation via InstallerFileTakeOver
 
-InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (EoP PoC) to the CVE-2021-41379 vulnerability. Upon successful exploitation, an
-unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.
+InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (EoP PoC) to the CVE-2021-41379 vulnerability. Upon successful exploitation, an unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.
 
-This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself
-to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked),
-which is outside the scope of this rule.
+This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Look for additional processes spawned by the process, command lines, and network communications.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -103,36 +96,33 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 /* This rule is compatible with both Sysmon and Elastic Endpoint */
-process where event.type == "start" and
-(?process.Ext.token.integrity_level_name : "System" or
-?winlog.event_data.IntegrityLevel : "System") and (
-(process.name : "elevation_service.exe" and not
-process.pe.original_file_name == "elevation_service.exe") or
-(process.parent.name : "elevation_service.exe" and process.name
-: ("rundll32.exe", "cmd.exe", "powershell.exe")) )
-----------------------------------
 
-==== Threat mapping
+process where host.os.type == "windows" and event.type == "start" and
+    (?process.Ext.token.integrity_level_name : "System" or
+    ?winlog.event_data.IntegrityLevel : "System") and
+    (
+      (process.name : "elevation_service.exe" and
+       not process.pe.original_file_name == "elevation_service.exe") or
+
+      (process.parent.name : "elevation_service.exe" and
+       process.name : ("rundll32.exe", "cmd.exe", "powershell.exe"))
+    )
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -144,59 +134,3 @@ process.pe.original_file_name == "elevation_service.exe") or
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[potential-privilege-escalation-via-installerfiletakeover-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* This rule is compatible with both Sysmon and Elastic Endpoint */
-process where event.type == "start" and
-(?process.Ext.token.integrity_level_name : "System" or
-?winlog.event_data.IntegrityLevel : "System") and (
-(process.name : "elevation_service.exe" and not
-process.pe.original_file_name == "elevation_service.exe") or
-(process.parent.name : "elevation_service.exe" and
-process.name : ("rundll32.exe", "cmd.exe", "powershell.exe")) )
-----------------------------------
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* This rule is compatible with both Sysmon and Elastic Endpoint */
-process where event.type == "start" and
-(process.Ext.token.integrity_level_name : "System" or
-winlog.event_data.IntegrityLevel : "System") and (
-(process.name : "elevation_service.exe" and not
-process.pe.original_file_name == "elevation_service.exe") or
-(process.parent.name : "elevation_service.exe" and
-process.name : ("rundll32.exe", "cmd.exe", "powershell.exe")) )
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* This rule is compatible with both Sysmon and Elastic Endpoint */
-process where event.type == "start" and user.id : "S-1-5-18" and
-( (process.name : "elevation_service.exe" and not
-process.pe.original_file_name == "elevation_service.exe") or
-(process.parent.name : "elevation_service.exe" and
-process.name : ("rundll32.exe", "cmd.exe", "powershell.exe")) )
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc
index 65b4d15560..69b924ad71 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc
@@ -5,52 +5,52 @@ Identifies an attempt to exploit a local privilege escalation in polkit pkexec (
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://seclists.org/oss-sec/2022/q1/80
 * https://haxx.in/files/blasty-vs-pkexec.c
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<potential-privilege-escalation-via-pkexec-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where file.path : "/*GCONV_PATH*"
+[source, js]
 ----------------------------------
+file where host.os.type == "linux" and file.path : "/*GCONV_PATH*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -62,8 +62,6 @@ file where file.path : "/*GCONV_PATH*"
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -72,16 +70,7 @@ file where file.path : "/*GCONV_PATH*"
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[potential-privilege-escalation-via-pkexec-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Path Interception by PATH Environment Variable
+** ID: T1574.007
+** Reference URL: https://attack.mitre.org/techniques/T1574/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-sudoers-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-sudoers-file-modification.asciidoc
index d179933ad5..7033c6c921 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-sudoers-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-sudoers-file-modification.asciidoc
@@ -5,7 +5,7 @@ A sudoers file specifies the commands users or groups can run and from which ter
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,41 +14,39 @@ A sudoers file specifies the commands users or groups can run and from which ter
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<potential-privilege-escalation-via-sudoers-file-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and process.args:(echo and
-*NOPASSWD*ALL*)
+[source, js]
 ----------------------------------
+event.category:process and event.type:start and process.args:(echo and *NOPASSWD*ALL*)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -60,13 +58,7 @@ event.category:process and event.type:start and process.args:(echo and
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[potential-privilege-escalation-via-sudoers-file-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Sudo and Sudo Caching
+** ID: T1548.003
+** Reference URL: https://attack.mitre.org/techniques/T1548/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc
index b3c92123c1..b9ce1008b7 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc
@@ -5,22 +5,23 @@ Identifies a suspicious computer account name rename event, which may indicate a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://support.microsoft.com/en-us/topic/kb5008102-active-directory-security-accounts-manager-hardening-changes-cve-2021-42278-5975b463-4c95-45e1-831a-d120004e258e
 * https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
@@ -28,46 +29,44 @@ Identifies a suspicious computer account name rename event, which may indicate a
 * https://twitter.com/exploitph/status/1469157138928914432
 * https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Privilege Escalation
-
-*Version*: 100 (<<potential-privileged-escalation-via-samaccountname-spoofing-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-iam where event.action == "renamed-user-account" and /* machine
-account name renamed to user like account name */
-winlog.event_data.OldTargetUserName : "*$" and not
-winlog.event_data.NewTargetUserName : "*$"
+[source, js]
 ----------------------------------
+iam where event.action == "renamed-user-account" and
+  /* machine account name renamed to user like account name */
+  winlog.event_data.OldTargetUserName : "*$" and not winlog.event_data.NewTargetUserName : "*$"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,8 +78,10 @@ winlog.event_data.NewTargetUserName : "*$"
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
+* Sub-technique:
+** Name: Domain Accounts
+** ID: T1078.002
+** Reference URL: https://attack.mitre.org/techniques/T1078/002/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -89,16 +90,3 @@ winlog.event_data.NewTargetUserName : "*$"
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[potential-privileged-escalation-via-samaccountname-spoofing-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-process-herpaderping-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-process-herpaderping-attempt.asciidoc
index b85d7eb7e6..9c117a1f57 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-process-herpaderping-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-process-herpaderping-attempt.asciidoc
@@ -5,7 +5,7 @@ Identifies process execution followed by a file overwrite of an executable by th
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,50 +15,48 @@ Identifies process execution followed by a file overwrite of an executable by th
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/jxy-s/herpaderping
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-
-*Version*: 101 (<<potential-process-herpaderping-attempt-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=5s [process where event.type == "start" and
-not process.parent.executable : (
-"?:\\Windows\\SoftwareDistribution\\*.exe", "?:\\Program
-Files\\Elastic\\Agent\\data\\*.exe", "?:\\Program Files
-(x86)\\Trend Micro\\*.exe" ) ] by host.id,
-process.executable, process.parent.entity_id [file where event.type
-== "change" and event.action == "overwrite" and file.extension ==
-"exe"] by host.id, file.path, process.entity_id
+[source, js]
 ----------------------------------
+sequence with maxspan=5s
+   [process where host.os.type == "windows" and event.type == "start" and not process.parent.executable :
+      (
+         "?:\\Windows\\SoftwareDistribution\\*.exe",
+         "?:\\Program Files\\Elastic\\Agent\\data\\*.exe",
+         "?:\\Program Files (x86)\\Trend Micro\\*.exe"
+      )
+   ] by host.id, process.executable, process.parent.entity_id
+   [file where host.os.type == "windows" and event.type == "change" and event.action == "overwrite" and file.extension == "exe"] by host.id, file.path, process.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,29 +68,3 @@ process.executable, process.parent.entity_id [file where event.type
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[potential-process-herpaderping-attempt-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=5s [process where event.type == "start" and
-not process.parent.executable :
-"C:\\Windows\\SoftwareDistribution\\*.exe"] by host.id,
-process.executable, process.parent.entity_id [file where event.type
-== "change" and event.action == "overwrite" and file.extension ==
-"exe"] by host.id, file.path, process.entity_id
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-ld-preload-environment-variable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-ld-preload-environment-variable.asciidoc
new file mode 100644
index 0000000000..9b7348fee4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-ld-preload-environment-variable.asciidoc
@@ -0,0 +1,112 @@
+[[potential-process-injection-via-ld-preload-environment-variable]]
+=== Potential Process Injection via LD_PRELOAD Environment Variable
+
+This rule detects the execution of a process where the LD_PRELOAD environment variable is set. LD_PRELOAD can be used to inject a shared library into a binary at or prior to execution. A threat actor may do this in order to load a malicious shared library for the purposes of persistence, privilege escalation, and defense evasion. This activity is not common and will potentially indicate malicious or suspicious behavior.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.getambassador.io/resources/code-injection-on-linux-and-macos
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+By default, the `Elastic Defend` integration does not collect environment variable logging. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the `Elastic Defend` integration. 
+```
+Kibana -->
+Fleet -->
+Agent policies -->
+Agent policy for which the option should be enabled -->
+Name of the Elastic Defend integration --> 
+Show advanced settings -->
+linux.advanced.capture_env_vars
+```
+`linux.advanced.capture_env_vars` should be set to `LD_PRELOAD,LD_LIBRARY_PATH`. 
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and 
+ event.action == "exec" and  
+ process.env_vars : ("LD_PRELOAD=?*", "LD_LIBRARY_PATH=?*") 
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc
index d5767d1671..2a6f307c34 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc
@@ -5,75 +5,65 @@ Detects the use of Windows API functions that are commonly abused by malware and
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1
 * https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-ReflectivePEInjection.ps1
 * https://github.com/BC-SECURITY/Empire/blob/master/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-
-*Version*: 102 (<<potential-process-injection-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate PowerShell scripts that make use of these functions.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Process Injection via PowerShell
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-PowerShell also has solid capabilities to make the interaction with the Win32 API in an uncomplicated and reliable way,
-like the execution of inline C# code, PSReflect, Get-ProcAddress, etc.
+PowerShell also has solid capabilities to make the interaction with the Win32 API in an uncomplicated and reliable way, like the execution of inline C# code, PSReflect, Get-ProcAddress, etc.
 
-Red Team tooling and malware developers take advantage of these capabilities to develop stagers and loaders that inject
-payloads directly into the memory without touching the disk to circumvent file-based security protections.
+Red Team tooling and malware developers take advantage of these capabilities to develop stagers and loaders that inject payloads directly into the memory without touching the disk to circumvent file-based security protections.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
@@ -93,32 +83,28 @@ prevalence, whether they are located in expected locations, and if they are sign
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-(VirtualAlloc or VirtualAllocEx or VirtualProtect or LdrLoadDll or
-LoadLibrary or LoadLibraryA or LoadLibraryEx or GetProcAddress
-or OpenProcess or OpenProcessToken or AdjustTokenPrivileges) and
-(WriteProcessMemory or CreateRemoteThread or NtCreateThreadEx or
-CreateThread or QueueUserAPC or SuspendThread or ResumeThread or
-GetDelegateForFunctionPointer) )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+   (VirtualAlloc or VirtualAllocEx or VirtualProtect or LdrLoadDll or LoadLibrary or LoadLibraryA or
+      LoadLibraryEx or GetProcAddress or OpenProcess or OpenProcessToken or AdjustTokenPrivileges) and
+   (WriteProcessMemory or CreateRemoteThread or NtCreateThreadEx or CreateThread or QueueUserAPC or
+      SuspendThread or ResumeThread or GetDelegateForFunctionPointer)
+  ) and not 
+  (user.id:("S-1-5-18" or "S-1-5-19") and
+   file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -130,47 +116,11 @@ GetDelegateForFunctionPointer) )
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[potential-process-injection-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-(VirtualAlloc or VirtualAllocEx or VirtualProtect or LdrLoadDll or
-LoadLibrary or LoadLibraryA or LoadLibraryEx or GetProcAddress
-or OpenProcess or OpenProcessToken or AdjustTokenPrivileges) and
-(WriteProcessMemory or CreateRemoteThread or NtCreateThreadEx or
-CreateThread or QueueUserAPC or SuspendThread or ResumeThread or
-GetDelegateForFunctionPointer) )
-----------------------------------
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-(VirtualAlloc or VirtualAllocEx or VirtualProtect or LdrLoadDll or
-LoadLibrary or LoadLibraryA or LoadLibraryEx or GetProcAddress
-or OpenProcess or OpenProcessToken or AdjustTokenPrivileges) and
-(WriteProcessMemory or CreateRemoteThread or NtCreateThreadEx or
-CreateThread or QueueUserAPC or SuspendThread or ResumeThread)
-)
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Dynamic-link Library Injection
+** ID: T1055.001
+** Reference URL: https://attack.mitre.org/techniques/T1055/001/
+* Sub-technique:
+** Name: Portable Executable Injection
+** ID: T1055.002
+** Reference URL: https://attack.mitre.org/techniques/T1055/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
index c6a30d5903..39864635d4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
@@ -5,63 +5,61 @@ Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel netwo
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * http://rootkiter.com/EarthWorm/
 * https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Command and Control
-
-*Version*: 100 (<<potential-protocol-tunneling-via-earthworm-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.args : "-s" and
-process.args : "-d" and process.args : "rssocks"
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+ process.args : "-s" and process.args : "-d" and process.args : "rssocks"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,16 +71,3 @@ process.args : "-d" and process.args : "rssocks"
 ** Name: Protocol Tunneling
 ** ID: T1572
 ** Reference URL: https://attack.mitre.org/techniques/T1572/
-
-[[potential-protocol-tunneling-via-earthworm-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc
new file mode 100644
index 0000000000..20fb7efcce
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc
@@ -0,0 +1,93 @@
+[[potential-pspy-process-monitoring-detected]]
+=== Potential Pspy Process Monitoring Detected
+
+This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/DominicBreuker/pspy
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /proc/ -p r -k audit_proc
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.pid, host.id with maxspan=5s
+[ file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+  auditd.data.syscall == "openat" and file.path == "/proc" and auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and 
+  auditd.data.a2 : ("80000", "88000") ] with runs=10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
new file mode 100644
index 0000000000..776cab57ff
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -0,0 +1,151 @@
+[[potential-remote-code-execution-via-web-server]]
+=== Potential Remote Code Execution via Web Server
+
+Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://pentestlab.blog/tag/web-shell/
+* https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Remote Code Execution via Web Server
+
+Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a malicious script, often embedded into a compromised web server, that grants an attacker remote access and control over the server. This enables the execution of arbitrary commands, data exfiltration, and further exploitation of the target network.
+
+This rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible investigation steps
+
+- Investigate abnormal behaviors by the subject process such as network connections, file modifications, and any other spawned child processes.
+  - Investigate listening ports and open sockets to look for potential reverse shells or data exfiltration.
+    - !{osquery{"label":"Osquery - Retrieve Listening Ports","query":"SELECT pid, address, port, socket, protocol, path FROM listening_ports"}}
+    - !{osquery{"label":"Osquery - Retrieve Open Sockets","query":"SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets"}}
+  - Investigate the process information for malicious or uncommon processes/process trees.
+    - !{osquery{"label":"Osquery - Retrieve Process Info","query":"SELECT name, cmdline, parent, path, uid FROM processes"}}
+  - Investigate the process tree spawned from the user that is used to run the web application service. A user that is running a web application should not spawn other child processes.
+    - !{osquery{"label":"Osquery - Retrieve Process Info for Webapp User","query":"SELECT name, cmdline, parent, path, uid FROM processes WHERE uid = {{process.user.id}}"}}
+- Examine the command line to determine which commands or scripts were executed.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+        - Check if the domain is newly registered or unexpected.
+        - Check the reputation of the domain or IP address.
+      - File access, modification, and creation activities.
+      - Cron jobs, services and other persistence mechanisms.
+        - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+event.action in ("exec", "exec_event") and process.parent.executable : (
+  "/usr/sbin/nginx", "/usr/local/sbin/nginx",
+  "/usr/sbin/apache", "/usr/local/sbin/apache",
+  "/usr/sbin/apache2", "/usr/local/sbin/apache2",
+  "/usr/sbin/php*", "/usr/local/sbin/php*",
+  "/usr/sbin/lighttpd", "/usr/local/sbin/lighttpd",
+  "/usr/sbin/hiawatha", "/usr/local/sbin/hiawatha",
+  "/usr/local/bin/caddy",
+  "/usr/local/lsws/bin/lswsctrl",
+  "*/bin/catalina.sh"
+) and
+process.name : ("*sh", "python*", "perl", "php*", "tmux") and
+process.args : ("whoami", "id", "uname", "cat", "hostname", "ip", "curl", "wget", "pwd")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: Web Shell
+** ID: T1505.003
+** Reference URL: https://attack.mitre.org/techniques/T1505/003/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
index 7a95806278..f41dbb2c35 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
@@ -5,7 +5,7 @@ Identifies remote access to the registry to potentially dump credential data fro
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
@@ -15,53 +15,47 @@ Identifies remote access to the registry to potentially dump credential data fro
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<potential-remote-credential-access-via-registry-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Remote Credential Access via Registry
 
-Dumping registry hives is a common way to access credential information. Some hives store credential material,
-such as the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain
-cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to
-decrypt these secrets.
+Dumping registry hives is a common way to access credential information. Some hives store credential material, such as the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
 
-Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry hives remotely, and use dumped
-credentials to access other systems in the domain.
+Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry hives remotely, and use dumped credentials to access other systems in the domain.
 
 #### Possible investigation steps
 
@@ -69,13 +63,11 @@ credentials to access other systems in the domain.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Determine the privileges of the compromised accounts.
 - Investigate other alerts associated with the user/source host during the past 48 hours.
-- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target
-host.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
 
 ### False positive analysis
 
-- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious
-must be monitored by the security team.
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
 ### Related rules
 
@@ -85,40 +77,34 @@ must be monitored by the security team.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine if other hosts were compromised.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Reimage the host operating system or restore the compromised files to clean versions.
 - Ensure that the machine has the latest security updates and is not running unsupported Windows versions.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, user.id with maxspan=1m [authentication where
-event.outcome == "success" and event.action == "logged-in" and
-winlog.logon.type == "Network" and not user.name == "ANONYMOUS LOGON"
-and not user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1"
-and source.ip !="::1"] [file where event.action == "creation" and
-process.name : "svchost.exe" and file.Ext.header_bytes : "72656766*"
-and user.id : ("S-1-5-21-*", "S-1-12-1-*") and file.size >= 30000 and
-not file.path : ("?:\\Windows\\system32\\HKEY_LOCAL_MACHINE
-_SOFTWARE_Microsoft_*.registry",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG?",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat",
-"?:\\Users\\*\\ntuser.dat.LOG?",
-"?:\\Users\\*\\NTUSER.DAT")]
+[source, js]
 ----------------------------------
+sequence by host.id, user.id with maxspan=1m
+ [authentication where
+   event.outcome == "success" and event.action == "logged-in" and
+   winlog.logon.type == "Network" and not user.name == "ANONYMOUS LOGON" and
+   not user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1" and source.ip !="::1"]
+ [file where event.action == "creation" and process.name : "svchost.exe" and
+  file.Ext.header_bytes : "72656766*" and user.id : ("S-1-5-21-*", "S-1-12-1-*") and file.size >= 30000 and
+  not file.path :
+           ("?:\\Windows\\system32\\HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_*.registry",
+            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG?",
+            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat",
+            "?:\\Users\\*\\ntuser.dat.LOG?",
+            "?:\\Users\\*\\NTUSER.DAT")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -130,8 +116,10 @@ _SOFTWARE_Microsoft_*.registry",
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -140,47 +128,3 @@ _SOFTWARE_Microsoft_*.registry",
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[potential-remote-credential-access-via-registry-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, user.id with maxspan=1m [authentication where
-event.outcome == "success" and event.action == "logged-in" and
-winlog.logon.type == "Network" and not user.name == "ANONYMOUS LOGON"
-and not user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1"
-and source.ip !="::1"] [file where event.action == "creation" and
-process.name : "svchost.exe" and file.Ext.header_bytes : "72656766*"
-and user.id : "S-1-5-21-*" and file.size >= 30000 and not file.path
-: ("?:\\Windows\\system32\\HKEY_LOCAL_MACHINE_SOFTWARE_Micr
-osoft_*.registry",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG?",
-"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat",
-"?:\\Users\\*\\ntuser.dat.LOG?",
-"?:\\Users\\*\\NTUSER.DAT")]
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, user.id with maxspan=1m [authentication where
-event.outcome == "success" and winlog.logon.type == "Network" and
-not user.name == "ANONYMOUS LOGON" and not user.domain == "NT
-AUTHORITY" and source.ip != "127.0.0.1" and source.ip !="::1"] [file
-where event.action == "creation" and process.name : "svchost.exe" and
-file.Ext.header_bytes : "72656766*" and user.id : "S-1-5-21-*" and
-file.size >= 30000]
-----------------------------------
-
-Version 2 (8.3.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
index a924e2b657..1eb008002c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
@@ -5,71 +5,76 @@ Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing
 * https://swarm.ptsecurity.com/remote-desktop-services-shadowing/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<potential-remote-desktop-shadowing-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* Identifies the modification of RDP Shadow registry or the
-execution of processes indicative of active shadow RDP session */ any
-where (event.category == "registry" and registry.path :
-"HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Terminal
-Services\\Shadow" ) or (event.category == "process" and
-(process.name : ("RdpSaUacHelper.exe", "RdpSaProxy.exe") and
-process.parent.name : "svchost.exe") or
-(process.pe.original_file_name : "mstsc.exe" and process.args :
-"/shadow:*") )
+[source, js]
 ----------------------------------
+/* Identifies the modification of RDP Shadow registry or
+  the execution of processes indicative of active shadow RDP session */
+
+any where host.os.type == "windows" and
+(
+  (event.category == "registry" and
+     registry.path : (
+      "HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow",
+      "\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow"
+    )
+  ) or
+  (event.category == "process" and event.type == "start" and
+     (process.name : ("RdpSaUacHelper.exe", "RdpSaProxy.exe") and process.parent.name : "svchost.exe") or
+     (process.pe.original_file_name : "mstsc.exe" and process.args : "/shadow:*")
+  )
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,29 +86,3 @@ process.parent.name : "svchost.exe") or
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[potential-remote-desktop-shadowing-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Identifies the modification of RDP Shadow registry or the
-execution of processes indicative of active shadow RDP session */ any
-where (event.category == "registry" and registry.path :
-"HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Terminal
-Services\\Shadow" ) or (event.category == "process" and
-(process.name : ("RdpSaUacHelper.exe", "RdpSaProxy.exe") and
-process.parent.name : "svchost.exe") or
-(process.pe.original_file_name : "mstsc.exe" and process.args :
-"/shadow:*") )
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
index 039bc8f140..c44aded526 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
@@ -5,7 +5,7 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,59 +16,52 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.netspi.com/how-to-access-rdp-over-a-reverse-ssh-tunnel/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<potential-remote-desktop-tunneling-detected-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Remote Desktop Tunneling Detected
 
-Protocol Tunneling is a mechanism that involves explicitly encapsulating a protocol within another for various use cases,
-ranging from providing an outer layer of encryption (similar to a VPN) to enabling traffic that network appliances would
-filter to reach their destination.
+Protocol Tunneling is a mechanism that involves explicitly encapsulating a protocol within another for various use cases, ranging from providing an outer layer of encryption (similar to a VPN) to enabling traffic that network appliances would filter to reach their destination.
 
-Attackers may tunnel Remote Desktop Protocol (RDP) traffic through other protocols like Secure Shell (SSH) to bypass network restrictions that block incoming RDP
-connections but may be more permissive to other protocols.
+Attackers may tunnel Remote Desktop Protocol (RDP) traffic through other protocols like Secure Shell (SSH) to bypass network restrictions that block incoming RDP connections but may be more permissive to other protocols.
 
-This rule looks for command lines involving the `3389` port, which RDP uses by default and options commonly associated
-with tools that perform tunneling.
+This rule looks for command lines involving the `3389` port, which RDP uses by default and options commonly associated with tools that perform tunneling.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -84,30 +77,24 @@ for prevalence, whether they are located in expected locations, and if they are
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Take the necessary actions to disable the tunneling, which can be a process kill, service deletion, registry key
-modification, etc. Inspect the host to learn which method was used and to determine a response for the case.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Take the necessary actions to disable the tunneling, which can be a process kill, service deletion, registry key modification, etc. Inspect the host to learn which method was used and to determine a response for the case.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and /* RDP port and usual SSH
-tunneling related switches in command line */ process.args :
-"*:3389" and process.args : ("-L", "-P", "-R", "-pw", "-ssh")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  /* RDP port and usual SSH tunneling related switches in command line */
+  process.args : "*:3389" and
+  process.args : ("-L", "-P", "-R", "-pw", "-ssh")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -119,55 +106,3 @@ tunneling related switches in command line */ process.args :
 ** Name: Protocol Tunneling
 ** ID: T1572
 ** Reference URL: https://attack.mitre.org/techniques/T1572/
-
-[[potential-remote-desktop-tunneling-detected-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and /* RDP
-port and usual SSH tunneling related switches in command line */
-process.args : "*:3389" and process.args : ("-L", "-P", "-R", "-pw",
-"-ssh")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-/* RDP port and usual SSH tunneling related switches in commandline */
-wildcard(process.args, "*:3389") and wildcard(process.args,"-L", "-P",
-"-R", "-pw", "-ssh")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-/* RDP port and usual SSH tunneling related switches in commandline */
-wildcard(process.args, "*:3389") and wildcard(process.args,"-L", "-P",
-"-R", "-pw", "-ssh")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc
index 14874d8a1b..ffff014a5c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a shell process with suspicious arguments which may
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,46 @@ Identifies the execution of a shell process with suspicious arguments which may
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
 * https://github.com/WangYihang/Reverse-Shell-Manager
 * https://www.netsparker.com/blog/web-security/understanding-reverse-shells/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Execution
-* Investigation Guide
-
-*Version*: 102 (<<potential-reverse-shell-activity-via-terminal-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential Reverse Shell Activity via Terminal
 
-A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects
-the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are
-vulnerable since the connection is outgoing. This activity is typically the result of vulnerability exploitation,
-malware infection, or penetration testing.
+A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing. This activity is typically the result of vulnerability exploitation, malware infection, or penetration testing.
 
 This rule identifies commands that are potentially related to reverse shell activities using shell applications.
 
@@ -67,53 +62,41 @@ This rule identifies commands that are potentially related to reverse shell acti
 - Examine the command line and extract the target domain or IP address information.
   - Check if the domain is newly registered or unexpected.
   - Check the reputation of the domain or IP address.
-  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the
-  domain or IP address.
+  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the domain or IP address.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
-spawned child processes.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 
 ### False positive analysis
 
-- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently
-malicious must be monitored by the security team.
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Take actions to terminate processes and connections used by the attacker.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 process where event.type in ("start", "process_started") and
-process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
-process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*",
-"*zsh/net/udp*") and /* noisy FPs */ not (process.parent.name :
-"timeout" and process.executable : "/var/lib/docker/overlay*") and
-not process.command_line : ("*/dev/tcp/sirh_db/*",
-"*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*",
-"*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*",
-"*/dev/udp/127.*", "*/dev/tcp/localhost/*") and not
-process.parent.command_line : "runc init"
-----------------------------------
+  process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
+  process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
 
-==== Threat mapping
+  /* noisy FPs */
+  not (process.parent.name : "timeout" and process.executable : "/var/lib/docker/overlay*") and
+  not process.command_line : ("*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*") and
+  not process.parent.command_line : "runc init"
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -125,27 +108,3 @@ process.parent.command_line : "runc init"
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[potential-reverse-shell-activity-via-terminal-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
-process.args:("*/dev/tcp/*", "*/dev/udp/*", "zsh/net/tcp",
-"zsh/net/udp")
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc
new file mode 100644
index 0000000000..4dc3f7fcee
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc
@@ -0,0 +1,78 @@
+[[potential-reverse-shell-via-java]]
+=== Potential Reverse Shell via Java
+
+This detection rule identifies the execution of a Linux shell process from a Java JAR application post an incoming network connection. This behavior may indicate reverse shell activity via a Java application.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=5s
+[ network where host.os.type == "linux" and event.action in ("connection_accepted", "connection_attempted") and 
+  process.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and
+  destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ] by process.entity_id
+[ process where host.os.type == "linux" and event.action == "exec" and 
+  process.parent.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and
+  process.parent.args : "-jar"  and process.executable : "*sh" ] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc
new file mode 100644
index 0000000000..2e9bbbfbc6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc
@@ -0,0 +1,89 @@
+[[potential-reverse-shell-via-suspicious-binary]]
+=== Potential Reverse Shell via Suspicious Binary
+
+This detection rule detects the creation of a shell through a chain consisting of the execution of a suspicious binary (located in a commonly abused location or executed manually) followed by a network event and ending with a shell being spawned. Stageless reverse tcp shells display this behaviour. Attackers may spawn reverse shells to establish persistence onto a target system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=1s
+[ process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+  process.executable : (
+  "./*", "/tmp/*", "/var/tmp/*", "/var/www/*", "/dev/shm/*", "/etc/init.d/*", "/etc/rc*.d/*",
+  "/etc/crontab", "/etc/cron.*", "/etc/update-motd.d/*", "/usr/lib/update-notifier/*",
+  "/boot/*", "/srv/*", "/run/*", "/root/*", "/etc/rc.local"
+   ) and
+  process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not
+  process.name : ("curl", "wget", "ping", "apt", "dpkg", "yum", "rpm", "dnf", "dockerd") ]
+[ network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
+  process.executable : (
+  "./*", "/tmp/*", "/var/tmp/*", "/var/www/*", "/dev/shm/*", "/etc/init.d/*", "/etc/rc*.d/*",
+  "/etc/crontab", "/etc/cron.*", "/etc/update-motd.d/*", "/usr/lib/update-notifier/*",
+  "/boot/*", "/srv/*", "/run/*", "/root/*", "/etc/rc.local"
+   ) and destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ]
+[ process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
+  process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and 
+  process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc
new file mode 100644
index 0000000000..5bdb88d1cd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc
@@ -0,0 +1,86 @@
+[[potential-reverse-shell-via-suspicious-child-process]]
+=== Potential Reverse Shell via Suspicious Child Process
+
+This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=1s
+[ process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
+  (process.name : "python*" and process.args : "-c") or
+  (process.name : "php*" and process.args : "-r") or
+  (process.name : "perl" and process.args : "-e") or
+  (process.name : "ruby" and process.args : ("-e", "-rsocket")) or
+  (process.name : "lua*" and process.args : "-e") or
+  (process.name : "openssl" and process.args : "-connect") or
+  (process.name : ("nc", "ncat", "netcat") and process.args_count >= 3) or
+  (process.name : "telnet" and process.args_count >= 3) or
+  (process.name : "awk")) and 
+  process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") ]
+[ network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and 
+  process.name : ("python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk") and
+  destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-parent-process.asciidoc
new file mode 100644
index 0000000000..ab007ca22a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-parent-process.asciidoc
@@ -0,0 +1,86 @@
+[[potential-reverse-shell-via-suspicious-parent-process]]
+=== Potential Reverse Shell via Suspicious Parent Process
+
+This detection rule detects the creation of a shell through a suspicious parent child relationship. Any reverse shells spawned by the specified utilities that use a forked process to initialize the connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.parent.entity_id with maxspan=1s
+[ process where host.os.type == "linux" and event.type == "start" and event.action == "fork" and (
+  (process.name : "python*" and process.args : "-c") or
+  (process.name : "php*" and process.args : "-r") or
+  (process.name : "perl" and process.args : "-e") or
+  (process.name : "ruby" and process.args : ("-e", "-rsocket")) or
+  (process.name : "lua*" and process.args : "-e") or
+  (process.name : "openssl" and process.args : "-connect") or
+  (process.name : ("nc", "ncat", "netcat") and process.args_count >= 3) or
+  (process.name : "telnet" and process.args_count >= 3) or
+  (process.name : "awk")) and 
+  process.parent.name : ("python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk") ]
+[ network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and 
+  process.name : ("python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk") and
+  destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc
new file mode 100644
index 0000000000..e393a4e052
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc
@@ -0,0 +1,78 @@
+[[potential-reverse-shell]]
+=== Potential Reverse Shell
+
+This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=1s
+[ network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and 
+  process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and 
+  destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ] by process.entity_id
+[ process where host.os.type == "linux" and event.type == "start" and event.action : ("exec", "fork") and 
+  process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and 
+  process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") ] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
index 55b0170c28..da72cdf487 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
@@ -5,7 +5,7 @@ Detects file name patterns generated by the use of Sysinternals SDelete utility
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,97 +16,91 @@ Detects file name patterns generated by the use of Sysinternals SDelete utility
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<potential-secure-file-deletion-via-sdelete-utility-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-Verify process details such as command line and hash to confirm this activity legitimacy.
-----------------------------------
-
-
-==== Rule query
+### Investigating Potential Secure File Deletion via SDelete Utility
 
+SDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.
 
-[source,js]
-----------------------------------
-file where event.type == "change" and file.name : "*AAA.AAA"
-----------------------------------
+This rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.
 
-==== Threat mapping
+#### Possible investigation steps
 
-*Framework*: MITRE ATT&CK^TM^
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Indicator Removal on Host
-** ID: T1070
-** Reference URL: https://attack.mitre.org/techniques/T1070/
+### False positive analysis
 
-[[potential-secure-file-deletion-via-sdelete-utility-history]]
-==== Rule version history
+- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
 
-Version 101 (8.6.0 release)::
-* Formatting only
+### Response and remediation
 
-Version 100 (8.5.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If important data was encrypted, deleted, or modified, activate your data recovery plan.
+    - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 8 (8.4.0 release)::
-* Formatting only
+----------------------------------
 
-Version 6 (8.2.0 release)::
-* Formatting only
+==== Rule query
 
-Version 5 (7.13.0 release)::
-* Formatting only
 
-Version 4 (7.12.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-file where event.type == "change" and wildcard(file.name,"*AAA.AAA")
-----------------------------------
+file where host.os.type == "windows" and event.type == "change" and file.name : "*AAA.AAA"
 
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file AND event.type:change AND file.name:/.+A+\.AAA/
 ----------------------------------
 
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc
index 0563d1b308..1bcb3f43bc 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc
@@ -5,71 +5,95 @@ Identify the modification of the msDS-KeyCredentialLink attribute in an Active D
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab
 * https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials
 * https://github.com/OTRF/Set-AuditRule
 * https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Active Directory
-
-*Version*: 101 (<<potential-shadow-credentials-added-to-ad-object-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Potential Shadow Credentials added to AD Object
+
+The msDS-KeyCredentialLink is an Active Directory (AD) attribute that links cryptographic certificates to a user or computer for domain authentication.
+
+Attackers with write privileges on this attribute over an object can abuse it to gain access to the object or maintain persistence. This means they can authenticate and perform actions on behalf of the exploited identity, and they can use Shadow Credentials to request Ticket Granting Tickets (TGTs) on behalf of the identity.
 
+#### Possible investigation steps
+
+- Identify whether Windows Hello for Business (WHfB) and/or Azure AD is used in the environment.
+  - Review the event ID 4624 for logon events involving the subject identity (`winlog.event_data.SubjectUserName`).
+    - Check whether the `source.ip` is the server running Azure AD Connect.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Review the event IDs 4768 and 4769 for suspicious ticket requests involving the modified identity (`winlog.event_data.ObjectDN`).
+  - Extract the source IP addresses from these events and use them as indicators of compromise (IoCs) to investigate whether the host is compromised and to scope the attacker's access to the environment.
+
+### False positive analysis
+
+- Administrators might use custom accounts on Azure AD Connect. If this is the case, make sure the account is properly secured. You can also create an exception for the account if expected activity makes too much noise in your environment.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+  - Remove the Shadow Credentials from the object.
+- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.action:"Directory Service Changes" and event.code:"5136" and
-winlog.event_data.AttributeLDAPDisplayName:"msDS-KeyCredentialLink"
-and winlog.event_data.AttributeValue :B\:828*
-----------------------------------
+ winlog.event_data.AttributeLDAPDisplayName:"msDS-KeyCredentialLink" and winlog.event_data.AttributeValue :B\:828* and
+ not winlog.event_data.SubjectUserName: MSOL_*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,25 +105,3 @@ and winlog.event_data.AttributeValue :B\:828*
 ** Name: Modify Authentication Process
 ** ID: T1556
 ** Reference URL: https://attack.mitre.org/techniques/T1556/
-
-[[potential-shadow-credentials-added-to-ad-object-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Directory Service Changes" and event.code:"5136" and
-winlog.event_data.AttributeLDAPDisplayName:"msDS-KeyCredentialLink"
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc
index cea57da0f6..b48a4df4ea 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc
@@ -3,65 +3,56 @@
 
 Identifies access to the /etc/shadow file via the commandline using standard system utilities. After elevating privileges to root, threat actors may attempt to read or dump this file in order to gain valid credentials. They may utilize these to move laterally undetected and access additional resources.
 
-*Rule type*: eql
+*Rule type*: new_terms
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Privilege Escalation
-* Credential Access
-
-*Version*: 2 (<<potential-shadow-file-read-via-command-line-utilities-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and event.action == "exec" and
-user.name == "root" and (process.args : "/etc/shadow" or
-(process.working_directory: "/etc" and process.args: "shadow")) and
-not process.executable: ("/usr/bin/tar", "/bin/tar",
-"/usr/bin/gzip", "/bin/gzip", "/usr/bin/zip",
-"/bin/zip", "/usr/bin/stat", "/bin/stat",
-"/usr/bin/cmp", "/bin/cmp", "/usr/bin/sudo",
-"/bin/sudo", "/usr/bin/find", "/bin/find",
-"/usr/bin/ls", "/bin/ls", "/usr/bin/uniq", "/bin/uniq",
-"/usr/bin/unzip", "/bin/unzip") and not
-process.parent.executable: "/bin/dracut"
+[source, js]
 ----------------------------------
+host.os.type : "linux" and event.category : "process" and event.action : ("exec" or "exec_event") and
+(process.args : "/etc/shadow" or (process.working_directory: "/etc" and process.args: "shadow")) and not 
+(process.executable : ("/bin/chown" or "/usr/bin/chown") and process.args : "root:shadow") and not 
+(process.executable : ("/bin/chmod" or "/usr/bin/chmod") and process.args : "640")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,8 +64,6 @@ process.parent.executable: "/bin/dracut"
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -83,21 +72,7 @@ process.parent.executable: "/bin/dracut"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[potential-shadow-file-read-via-command-line-utilities-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Rule name changed from: Shadow File Read via Command Line Utilities
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and event.action == "exec" and
-user.name == "root" and process.args : "/etc/shadow" and not
-process.executable: ("/usr/bin/find", "/usr/bin/cmp", "/bin/ls",
-"/usr/sbin/restorecon", "/usr/bin/uniq") and not
-process.parent.executable: "/bin/dracut"
-----------------------------------
-
+* Sub-technique:
+** Name: /etc/passwd and /etc/shadow
+** ID: T1003.008
+** Reference URL: https://attack.mitre.org/techniques/T1003/008/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-sharprdp-behavior.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-sharprdp-behavior.asciidoc
index e2ba83a329..098bd6c5a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-sharprdp-behavior.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-sharprdp-behavior.asciidoc
@@ -5,7 +5,7 @@ Identifies potential behavior of SharpRDP, which is a tool that can be used to p
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,57 +13,57 @@ Identifies potential behavior of SharpRDP, which is a tool that can be used to p
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3
 * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Lateral%20Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 101 (<<potential-sharprdp-behavior-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* Incoming RDP followed by a new RunMRU string value set to cmd,
-powershell, taskmgr or tsclient, followed by process execution within
-1m */ sequence by host.id with maxspan=1m [network where event.type
-== "start" and process.name : "svchost.exe" and destination.port ==
-3389 and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" and source.ip != "127.0.0.1" and
-source.ip != "::1" ] [registry where process.name :
-"explorer.exe" and registry.path : ("HKEY_USERS\\*\\Software\\Micro
-soft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\*") and
-registry.data.strings : ("cmd.exe*", "powershell.exe*", "taskmgr*",
-"\\\\tsclient\\*.exe\\*") ] [process where event.type == "start"
-and (process.parent.name : ("cmd.exe", "powershell.exe",
-"taskmgr.exe") or process.args : ("\\\\tsclient\\*.exe")) and not
-process.name : "conhost.exe" ]
+[source, js]
 ----------------------------------
+/* Incoming RDP followed by a new RunMRU string value set to cmd, powershell, taskmgr or tsclient, followed by process execution within 1m */
+
+sequence by host.id with maxspan=1m
+  [network where host.os.type == "windows" and event.type == "start" and process.name : "svchost.exe" and destination.port == 3389 and
+   network.direction : ("incoming", "ingress") and network.transport == "tcp" and
+   source.ip != "127.0.0.1" and source.ip != "::1"
+  ]
 
-==== Threat mapping
+  [registry where host.os.type == "windows" and process.name : "explorer.exe" and
+   registry.path : ("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\*") and
+   registry.data.strings : ("cmd.exe*", "powershell.exe*", "taskmgr*", "\\\\tsclient\\*.exe\\*")
+  ]
+
+  [process where host.os.type == "windows" and event.type == "start" and
+   (process.parent.name : ("cmd.exe", "powershell.exe", "taskmgr.exe") or process.args : ("\\\\tsclient\\*.exe")) and
+   not process.name : "conhost.exe"
+   ]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,79 +75,7 @@ process.name : "conhost.exe" ]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[potential-sharprdp-behavior-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Incoming RDP followed by a new RunMRU string value set to cmd,
-powershell, taskmgr or tsclient, followed by process execution within
-1m */ sequence by host.id with maxspan=1m [network where event.type
-== "start" and process.name : "svchost.exe" and destination.port ==
-3389 and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" and source.ip != "127.0.0.1" and
-source.ip != "::1" ] [registry where process.name :
-"explorer.exe" and registry.path : ("HKEY_USERS\\*\\Software\\Micr
-osoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\*") and
-registry.data.strings : ("cmd.exe*", "powershell.exe*", "taskmgr*",
-"\\\\tsclient\\*.exe\\*") ] [process where event.type in
-("start", "process_started") and (process.parent.name : ("cmd.exe",
-"powershell.exe", "taskmgr.exe") or process.args :
-("\\\\tsclient\\*.exe")) and not process.name : "conhost.exe" ]
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Incoming RDP followed by a new RunMRU string value set to cmd,
-powershell, taskmgr or tsclient, followed by process execution within
-1m */ sequence by host.id with maxspan=1m [network where event.type
-== "start" and process.name : "svchost.exe" and destination.port ==
-3389 and network.direction : ("incoming", "ingress") and
-network.transport == "tcp" and source.address != "127.0.0.1" and
-source.address != "::1" ] [registry where process.name :
-"explorer.exe" and registry.path : ("HKEY_USERS\\*\\Software\\Micr
-osoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\*") and
-registry.data.strings : ("cmd.exe*", "powershell.exe*", "taskmgr*",
-"\\\\tsclient\\*.exe\\*") ] [process where event.type in
-("start", "process_started") and (process.parent.name : ("cmd.exe",
-"powershell.exe", "taskmgr.exe") or process.args :
-("\\\\tsclient\\*.exe")) and not process.name : "conhost.exe" ]
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Incoming RDP followed by a new RunMRU string value set to cmd,
-powershell, taskmgr or tsclient, followed by process execution within
-1m */ sequence by host.id with maxspan=1m [network where event.type
-== "start" and process.name : "svchost.exe" and destination.port ==
-3389 and network.direction == "incoming" and network.transport ==
-"tcp" and source.address != "127.0.0.1" and source.address != "::1"
-] [registry where process.name : "explorer.exe" and
-registry.path : ("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\Current
-Version\\Explorer\\RunMRU\\*") and registry.data.strings :
-("cmd.exe*", "powershell.exe*", "taskmgr*", "\\\\tsclient\\*.exe\\*")
-] [process where event.type in ("start", "process_started") and
-(process.parent.name : ("cmd.exe", "powershell.exe", "taskmgr.exe") or
-process.args : ("\\\\tsclient\\*.exe")) and not process.name :
-"conhost.exe" ]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-ssh-password-guessing.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-ssh-password-guessing.asciidoc
index ed078f15e3..ee8879ab81 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-ssh-password-guessing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-ssh-password-guessing.asciidoc
@@ -5,7 +5,7 @@ Identifies multiple SSH login failures followed by a successful one from the sam
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-system.auth-*
@@ -14,39 +14,40 @@ Identifies multiple SSH login failures followed by a successful one from the sam
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Credential Access
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Version*: 1
+*Version*: 6
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Potential SSH Password Guessing Attack
 
-The rule identifies consecutive SSH login failures followed by a successful login from the same source IP address to the
-same target host indicating a successful attempt of brute force password guessing.
+The rule identifies consecutive SSH login failures followed by a successful login from the same source IP address to the same target host indicating a successful attempt of brute force password guessing.
 
 #### Possible investigation steps
 
@@ -64,37 +65,29 @@ same target host indicating a successful attempt of brute force password guessin
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- Ensure active session(s) on the host(s) are terminated as the attacker could have gained initial
-access to the system(s).
+- Ensure active session(s) on the host(s) are terminated as the attacker could have gained initial access to the system(s).
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified.
-- Reset passwords for these accounts and other potentially compromised credentials.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 sequence by host.id, source.ip, user.name with maxspan=3s
-[authentication where event.action in ("ssh_login", "user_login") and
-event.outcome == "failure" and source.ip != null and source.ip !=
-"0.0.0.0" and source.ip != "::" ] with runs=2 [authentication where
-event.action in ("ssh_login", "user_login") and event.outcome ==
-"success" and source.ip != null and source.ip != "0.0.0.0" and
-source.ip != "::" ]
-----------------------------------
+  [authentication where host.os.type == "linux" and event.action  in ("ssh_login", "user_login") and
+   event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ] with runs=10
 
-==== Threat mapping
+  [authentication where host.os.type == "linux" and event.action  in ("ssh_login", "user_login") and
+   event.outcome == "success" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -106,3 +99,11 @@ source.ip != "::" ]
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
new file mode 100644
index 0000000000..b11aef572d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -0,0 +1,94 @@
+[[potential-successful-linux-ftp-brute-force-attack-detected]]
+=== Potential Successful Linux FTP Brute Force Attack Detected
+
+An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+```
+For this detection rule no additional audit rules are required to be added to the integration. 
+```
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, auditd.data.addr, related.user with maxspan=5s
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "failure" and 
+   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] with runs=10
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action  == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "success" and 
+   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
new file mode 100644
index 0000000000..b022b1c102
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -0,0 +1,92 @@
+[[potential-successful-linux-rdp-brute-force-attack-detected]]
+=== Potential Successful Linux RDP Brute Force Attack Detected
+
+An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+```
+For this detection rule no additional audit rules are required to be added to the integration. 
+```
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, related.user with maxspan=5s
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "failure"] with runs=10
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action  == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "success"] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-suspicious-file-edit.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-suspicious-file-edit.asciidoc
new file mode 100644
index 0000000000..375f12304b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-suspicious-file-edit.asciidoc
@@ -0,0 +1,112 @@
+[[potential-suspicious-file-edit]]
+=== Potential Suspicious File Edit
+
+This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish persistence, escalate privileges or perform reconnaisance on the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where event.action in ("creation", "file_create_event") and file.extension == "swp" and 
+file.path : (
+  /* common interesting files and locations */
+  "/etc/.shadow.swp", "/etc/.shadow-.swp", "/etc/.shadow~.swp", "/etc/.gshadow.swp", "/etc/.gshadow-.swp",
+  "/etc/.passwd.swp", "/etc/.pwd.db.swp", "/etc/.master.passwd.swp", "/etc/.spwd.db.swp", "/etc/security/.opasswd.swp",
+  "/etc/.hosts.swp", "/etc/.environment.swp", "/etc/.profile.swp", "/etc/sudoers.d/.*.swp",
+  "/etc/ld.so.conf.d/.*.swp", "/etc/init.d/.*.swp", "/etc/.rc.local.swp", "/etc/rc*.d/.*.swp",
+  "/dev/shm/.*.swp", "/etc/update-motd.d/.*.swp", "/usr/lib/update-notifier/.*.swp",
+
+  /* service, timer, want, socket and lock files */
+  "/etc/systemd/system/.*.swp", "/usr/local/lib/systemd/system/.*.swp", "/lib/systemd/system/.*.swp",
+  "/usr/lib/systemd/system/.*.swp","/home/*/.config/systemd/user/.*.swp", "/run/.*.swp", "/var/run/.*.swp/",
+
+  /* profile and shell configuration files */  
+  "/home/*.profile.swp", "/home/*.bash_profile.swp", "/home/*.bash_login.swp", "/home/*.bashrc.swp", "/home/*.bash_logout.swp",
+  "/home/*.zshrc.swp", "/home/*.zlogin.swp", "/home/*.tcshrc.swp", "/home/*.kshrc.swp", "/home/*.config.fish.swp",
+  "/root/*.profile.swp", "/root/*.bash_profile.swp", "/root/*.bash_login.swp", "/root/*.bashrc.swp", "/root/*.bash_logout.swp",
+  "/root/*.zshrc.swp", "/root/*.zlogin.swp", "/root/*.tcshrc.swp", "/root/*.kshrc.swp", "/root/*.config.fish.swp"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
+* Sub-technique:
+** Name: RC Scripts
+** ID: T1037.004
+** Reference URL: https://attack.mitre.org/techniques/T1037/004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Systemd Service
+** ID: T1543.002
+** Reference URL: https://attack.mitre.org/techniques/T1543/002/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Sudo and Sudo Caching
+** ID: T1548.003
+** Reference URL: https://attack.mitre.org/techniques/T1548/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-syn-based-network-scan-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-syn-based-network-scan-detected.asciidoc
new file mode 100644
index 0000000000..e3e6d68f6e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-syn-based-network-scan-detected.asciidoc
@@ -0,0 +1,72 @@
+[[potential-syn-based-network-scan-detected]]
+=== Potential SYN-Based Network Scan Detected
+
+This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-network_traffic.*
+* packetbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Network
+* Tactic: Discovery
+* Tactic: Reconnaissance
+* Use Case: Network Security Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+destination.port :* and network.packets <= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
+* Sub-technique:
+** Name: Scanning IP Blocks
+** ID: T1595.001
+** Reference URL: https://attack.mitre.org/techniques/T1595/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index 147751663d..68e99ba7ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -15,7 +15,7 @@ Identifies suspicious instances of the Windows Error Reporting process (WerFault
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -29,86 +29,98 @@ Identifies suspicious instances of the Windows Error Reporting process (WerFault
 
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 104
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
 
-*Version*: 100 (<<potential-windows-error-manager-masquerading-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.10.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
 
-==== Potential false positives
+### Investigating Potential Windows Error Manager Masquerading
 
-Legit Application Crash with rare Werfault commandline value
+By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
 
-==== Rule query
+This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
 
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 5s [process
-where event.type:"start" and process.name : ("wermgr.exe",
-"WerFault.exe") and process.args_count == 1] [network where
-process.name : ("wermgr.exe", "WerFault.exe") and network.protocol !=
-"dns" and network.direction : ("outgoing", "egress") and
-destination.ip !="::1" and destination.ip !="127.0.0.1" ]
-----------------------------------
+#### Possible investigation steps
 
-==== Threat mapping
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-*Framework*: MITRE ATT&CK^TM^
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Masquerading
-** ID: T1036
-** Reference URL: https://attack.mitre.org/techniques/T1036/
+### False positive analysis
 
-[[potential-windows-error-manager-masquerading-history]]
-==== Rule version history
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-Version 100 (8.5.0 release)::
-* Formatting only
+### Response and remediation
 
-Version 5 (8.4.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan = 5s [process
-where event.type:"start" and process.name : ("wermgr.exe",
-"WerFault.exe") and process.args_count == 1] [network where
-process.name : ("wermgr.exe", "WerFault.exe") and network.protocol !=
-"dns" and network.direction == "outgoing" and destination.ip
-!="::1" and destination.ip !="127.0.0.1" ]
 ----------------------------------
 
-Version 3 (7.12.0 release)::
-* Formatting only
+==== Rule query
+
 
-Version 2 (7.11.0 release)::
-* Rule name changed from: Process Potentially Masquerading as WerFault
-+
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:WerFault.exe and not process.args:((("-u" or "-pss") and
-"-p" and "-s") or ("/h" and "/shared") or ("-k" and "-lcq"))
+sequence by host.id, process.entity_id with maxspan = 5s
+  [process where host.os.type == "windows" and event.type:"start" and process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1]
+  [network where host.os.type == "windows" and process.name : ("wermgr.exe", "WerFault.exe") and network.protocol != "dns" and
+    network.direction : ("outgoing", "egress") and destination.ip !="::1" and destination.ip !="127.0.0.1"
+  ]
+
 ----------------------------------
 
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc
new file mode 100644
index 0000000000..a62d9fbe87
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc
@@ -0,0 +1,143 @@
+[[powershell-invoke-ninjacopy-script]]
+=== PowerShell Invoke-NinjaCopy script
+
+Detects PowerShell scripts that contain the default exported functions used on Invoke-NinjaCopy. Attackers can use Invoke-NinjaCopy to read SYSTEM files that are normally locked, such as the NTDS.dit file or registry hives.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/collection/Invoke-NinjaCopy.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Invoke-NinjaCopy script
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
+
+Invoke-NinjaCopy is a PowerShell script capable of reading SYSTEM files that were normally locked, such as `NTDS.dit` or sensitive registry locations. It does so by using the direct volume access technique, which enables attackers to bypass access control mechanisms and file system monitoring by reading the raw data directly from the disk and extracting the file by parsing the file system structures.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Check if the imported function was executed and which file it targeted.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "StealthReadFile" or
+    "StealthReadFileAddr" or
+    "StealthCloseFileDelegate" or
+    "StealthOpenFile" or
+    "StealthCloseFile" or
+    "StealthReadFile" or
+    "Invoke-NinjaCopy"
+   )
+  and not user.id : "S-1-5-18"
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Sub-technique:
+** Name: NTDS
+** ID: T1003.003
+** Reference URL: https://attack.mitre.org/techniques/T1003/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Direct Volume Access
+** ID: T1006
+** Reference URL: https://attack.mitre.org/techniques/T1006/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
index 4089f59ef4..998c09ff28 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
@@ -5,7 +5,7 @@ Detects PowerShell scripts that have the capability of requesting kerberos ticke
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,98 +14,89 @@ Detects PowerShell scripts that have the capability of requesting kerberos ticke
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cobalt.io/blog/kerberoast-attack-techniques
 * https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<powershell-kerberos-ticket-request-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-### Investigating Explicit PowerShell Kerberos Ticket Request
+### Investigating PowerShell Kerberos Ticket Request
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making
-it available for use in various environments, creating an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
 
-Accounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute
-force to crack the user password, which is used to encrypt a Kerberos TGS ticket.
+Accounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute force to crack the user password, which is used to encrypt a Kerberos TGS ticket.
 
-Attackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to
-perform Kerberoasting.
+Attackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to perform Kerberoasting.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate if the script was executed, and if so, which account was targeted.
 - Validate if the account has an SPN associated with it.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Check if the script has any other functionality that can be potentially malicious.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769)
-related to this account and service name for additional information.
+- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769) related to this account and service name for additional information.
 
 ### False positive analysis
 
-- A possible false positive can be identified if the script content is not malicious/harmful or does not request
-Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password
-requirements and policy.
+- A possible false positive can be identified if the script content is not malicious/harmful or does not request Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password requirements and policy.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services. Prioritize privileged accounts.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-KerberosRequestorSecurityToken )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    KerberosRequestorSecurityToken
+  ) and not user.id : "S-1-5-18"
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -117,8 +108,14 @@ KerberosRequestorSecurityToken )
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -127,28 +124,7 @@ KerberosRequestorSecurityToken )
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-kerberos-ticket-request-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-KerberosRequestorSecurityToken )
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc
index 194e37370f..e192437b07 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc
@@ -5,77 +5,71 @@ Detects the use of Win32 API Functions that can be used to capture user keystrok
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-Keystrokes.ps1
 * https://github.com/MojtabaTajik/FunnyKeylogger/blob/master/FunnyLogger.ps1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Collection
-* Investigation Guide
-
-*Version*: 102 (<<powershell-keylogging-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 108
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Keylogging Script
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other
-valuable information as credit card data and confidential conversations.
+Attackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other valuable information as credit card data and confidential conversations.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
-- Investigate if the script stores the captured data locally.
-- Investigate if the script contains exfiltration capabilities and the destination of this exfiltration.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
 ### False positive analysis
 
-- Regular users do not have a business justification for using scripting utilities to capture keystrokes, making
-false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+- Regular users do not have a business justification for using scripting utilities to capture keystrokes, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
 ### Related rules
 
@@ -85,34 +79,32 @@ false positives unlikely. In the case of authorized benign true positives (B-TPs
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- The response must be prioritized if this alert involves key executives or potentially valuable targets for espionage.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and ( powershell.file.script_block_text :
-(GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or
-"Get-Keystrokes") or powershell.file.script_block_text : (
-(SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or
-SetWindowsHookExA or NtUserSetWindowsHookEx) and
-(GetForegroundWindow or GetWindowTextA or GetWindowTextW or
-"WM_KEYBOARD_LL") ) )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  (
+   powershell.file.script_block_text : (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or "Get-Keystrokes") or
+   powershell.file.script_block_text : (
+        (SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or SetWindowsHookExA or NtUserSetWindowsHookEx) and
+        (GetForegroundWindow or GetWindowTextA or GetWindowTextW or "WM_KEYBOARD_LL")
+   )
+   ) and not user.id : "S-1-5-18"
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -124,8 +116,10 @@ SetWindowsHookExA or NtUserSetWindowsHookEx) and
 ** Name: Input Capture
 ** ID: T1056
 ** Reference URL: https://attack.mitre.org/techniques/T1056/
-
-
+* Sub-technique:
+** Name: Keylogging
+** ID: T1056.001
+** Reference URL: https://attack.mitre.org/techniques/T1056/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -134,46 +128,7 @@ SetWindowsHookExA or NtUserSetWindowsHookEx) and
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-keylogging-script-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and ( powershell.file.script_block_text
-: (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or
-"Get-Keystrokes") or powershell.file.script_block_text : (
-(SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or
-SetWindowsHookExA or NtUserSetWindowsHookEx) and
-(GetForegroundWindow or GetWindowTextA or GetWindowTextW or
-"WM_KEYBOARD_LL") ) )
-----------------------------------
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and ( powershell.file.script_block_text
-: (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or
-Get-Keystrokes) or powershell.file.script_block_text :
-((SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or
-SetWindowsHookExA or NtUserSetWindowsHookEx) and (GetForegroundWindow
-or GetWindowTextA or GetWindowTextW or WM_KEYBOARD_LL)) )
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
new file mode 100644
index 0000000000..7bf36bba65
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
@@ -0,0 +1,140 @@
+[[powershell-mailbox-collection-script]]
+=== PowerShell Mailbox Collection Script
+
+Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/dafthack/MailSniper/blob/master/MailSniper.ps1
+* https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Mailbox Collection Script
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.
+
+This rule identifies scripts that contains methods and classes that can be abused to collect emails from local and remote mailboxes.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Determine whether the script was executed and capture relevant information, such as arguments that reveal intent or are indicators of compromise (IoCs).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+  - Assess network data to determine if the host communicated with the exfiltration server.
+
+### False positive analysis
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+### Related rules
+
+- Exporting Exchange Mailbox via PowerShell - 6aace640-e631-4870-ba8e-5fdda09325db
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (
+   powershell.file.script_block_text : (
+      "Microsoft.Office.Interop.Outlook" or
+      "Interop.Outlook.olDefaultFolders" or
+      "::olFolderInBox"
+   ) or
+   powershell.file.script_block_text : (
+      "Microsoft.Exchange.WebServices.Data.Folder" or
+      "Microsoft.Exchange.WebServices.Data.FileAttachment"
+   )
+   )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc
index 810dc6aaf0..1676f08175 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc
@@ -5,7 +5,7 @@ This rule detects PowerShell scripts capable of dumping process memory using Win
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,62 +14,53 @@ This rule detects PowerShell scripts capable of dumping process memory using Win
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1
 * https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Get-ProcessMiniDump.ps1
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<powershell-minidump-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-PowerShell scripts that use this capability for troubleshooting.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell MiniDump Script
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can abuse Process Memory Dump capabilities to extract credentials from LSASS or to obtain other
-privileged information stored in the process memory.
+Attackers can abuse Process Memory Dump capabilities to extract credentials from LSASS or to obtain other privileged information stored in the process memory.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
@@ -77,8 +68,7 @@ prevalence, whether they are located in expected locations, and if they are sign
 
 ### False positive analysis
 
-- Regular users do not have a business justification for using scripting utilities to dump process memory, making false
-positives unlikely.
+- Regular users do not have a business justification for using scripting utilities to dump process memory, making false positives unlikely.
 
 ### Related rules
 
@@ -90,28 +80,20 @@ positives unlikely.
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and
-powershell.file.script_block_text:(MiniDumpWriteDump or
-MiniDumpWithFullMemory or pmuDetirWpmuDiniM)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and powershell.file.script_block_text:(MiniDumpWriteDump or MiniDumpWithFullMemory or pmuDetirWpmuDiniM) and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -123,8 +105,10 @@ MiniDumpWithFullMemory or pmuDetirWpmuDiniM)
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -133,35 +117,7 @@ MiniDumpWithFullMemory or pmuDetirWpmuDiniM)
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-minidump-script-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:"4104" and
-powershell.file.script_block_text:(MiniDumpWriteDump or
-MiniDumpWithFullMemory or pmuDetirWpmuDiniM)
-----------------------------------
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index 4110966dcc..00461a22fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -14,7 +14,7 @@ Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,78 +27,63 @@ Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-
-*Version*: 102 (<<powershell-psreflect-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate PowerShell scripts that make use of PSReflect to access the win32 API
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell PSReflect Script
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-PSReflect is a library that enables PowerShell to access win32 API functions in an uncomplicated way. It also helps to
-create enums and structs easily—all without touching the disk.
+PSReflect is a library that enables PowerShell to access win32 API functions in an uncomplicated way. It also helps to create enums and structs easily—all without touching the disk.
 
-Although this is an interesting project for every developer and admin out there, it is mainly used in the red team and
-malware tooling for its capabilities.
+Although this is an interesting project for every developer and admin out there, it is mainly used in the red team and malware tooling for its capabilities.
 
-Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through
-PowerShell, enabling defenders to discover tools being dropped in the environment.
+Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics. The
-script content that may be split into multiple script blocks (you can use the field `powershell.file.script_block_id`
-for filtering).
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics. The script content that may be split into multiple script blocks (you can use the field `powershell.file.script_block_id` for filtering).
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Check for additional PowerShell and command-line logs that indicate that imported functions were run.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the script using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -122,32 +107,33 @@ prevalence, whether they are located in expected locations, and if they are sign
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text:(
-"New-InMemoryModule" or "Add-Win32Type" or psenum or
-DefineDynamicAssembly or DefineDynamicModule or
-"Reflection.TypeAttributes" or "Reflection.Emit.OpCodes" or
-"Reflection.Emit.CustomAttributeBuilder" or
-"Runtime.InteropServices.DllImportAttribute" )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "New-InMemoryModule" or
+    "Add-Win32Type" or
+    psenum or
+    DefineDynamicAssembly or
+    DefineDynamicModule or
+    "Reflection.TypeAttributes" or
+    "Reflection.Emit.OpCodes" or
+    "Reflection.Emit.CustomAttributeBuilder" or
+    "Runtime.InteropServices.DllImportAttribute"
+  ) and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -159,45 +145,11 @@ DefineDynamicAssembly or DefineDynamicModule or
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-psreflect-script-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text:(
-"New-InMemoryModule" or "Add-Win32Type" or psenum or
-DefineDynamicAssembly or DefineDynamicModule or
-"Reflection.TypeAttributes" or "Reflection.Emit.OpCodes" or
-"Reflection.Emit.CustomAttributeBuilder" or
-"Runtime.InteropServices.DllImportAttribute" )
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text:(
-New-InMemoryModule or Add-Win32Type or psenum or
-DefineDynamicAssembly or DefineDynamicModule or
-Reflection.TypeAttributes or Reflection.Emit.OpCodes or
-Reflection.Emit.CustomAttributeBuilder or
-Runtime.InteropServices.DllImportAttribute )
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
index de06aad999..2ee71d88ac 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to disable PowerShell Script Block Logging via registry modi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,51 @@ Identifies attempts to disable PowerShell Script Block Logging via registry modi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScriptBlockLogging
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<powershell-script-block-logging-disabled-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Script Block Logging Disabled
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making
-it available in various environments and creating an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available in various environments and creating an attractive way for attackers to execute code.
 
-PowerShell Script Block Logging is a feature of PowerShell that records the content of all script blocks that it
-processes, giving defenders visibility of PowerShell scripts and sequences of executed commands.
+PowerShell Script Block Logging is a feature of PowerShell that records the content of all script blocks that it processes, giving defenders visibility of PowerShell scripts and sequences of executed commands.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check whether it makes sense for the user to use PowerShell to complete tasks.
 - Investigate if PowerShell scripts were run after logging was disabled.
@@ -90,28 +85,24 @@ for prevalence, whether they are located in expected locations, and if they are
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type == "change" and registry.path : (
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlock
-Logging\\EnableScriptBlockLogging", "\\REGISTRY\\MACHINE\\SOFT
-WARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\En
-ableScriptBlockLogging" ) and registry.data.strings : ("0",
-"0x00000000")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+    registry.path : (
+        "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging",
+        "\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging"
+    ) and registry.data.strings : ("0", "0x00000000")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -123,38 +114,7 @@ ableScriptBlockLogging" ) and registry.data.strings : ("0",
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[powershell-script-block-logging-disabled-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type == "change" and registry.path : 
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlock
-Logging\\EnableScriptBlockLogging" and registry.data.strings :
-("0", "0x00000000")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type == "change" and registry.path :
-"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlock
-Logging\\EnableScriptBlockLogging" and registry.data.strings :
-("0", "0x00000000")
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
new file mode 100644
index 0000000000..77d4e81d13
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
@@ -0,0 +1,98 @@
+[[powershell-script-with-archive-compression-capabilities]]
+=== PowerShell Script with Archive Compression Capabilities
+
+Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+(
+  powershell.file.script_block_text : (
+    "IO.Compression.ZipFile" or
+    "IO.Compression.ZipArchive" or
+    "ZipFile.CreateFromDirectory" or
+    "IO.Compression.BrotliStream" or
+    "IO.Compression.DeflateStream" or
+    "IO.Compression.GZipStream" or
+    "IO.Compression.ZLibStream"
+  ) and 
+  powershell.file.script_block_text : (
+    "CompressionLevel" or
+    "CompressionMode" or
+    "ZipArchiveMode"
+  ) or
+  powershell.file.script_block_text : "Compress-Archive"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Archive Collected Data
+** ID: T1560
+** Reference URL: https://attack.mitre.org/techniques/T1560/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
new file mode 100644
index 0000000000..23be1fe3b9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
@@ -0,0 +1,229 @@
+[[powershell-script-with-discovery-capabilities]]
+=== PowerShell Script with Discovery Capabilities
+
+Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Tactic: Discovery
+* Data Source: PowerShell Logs
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    (
+      ("Get-ItemProperty" or "Get-Item") and "-Path"
+    ) or
+    (
+      "Get-ADDefaultDomainPasswordPolicy" or
+      "Get-ADDomain" or "Get-ComputerInfo" or
+      "Get-Disk" or "Get-DnsClientCache" or
+      "Get-GPOReport" or "Get-HotFix" or
+      "Get-LocalUser" or "Get-NetFirewallProfile" or
+      "get-nettcpconnection" or "Get-NetAdapter" or
+      "Get-PhysicalDisk" or "Get-Process" or
+      "Get-PSDrive" or "Get-Service" or
+      "Get-SmbShare" or "Get-WinEvent"
+    ) or
+    (
+      ("Get-WmiObject" or "gwmi" or "Get-CimInstance" or
+       "gcim" or "Management.ManagementObjectSearcher" or
+       "System.Management.ManagementClass" or
+       "[WmiClass]" or "[WMI]") and
+      (
+        "AntiVirusProduct" or "CIM_BIOSElement" or "CIM_ComputerSystem" or "CIM_Product" or "CIM_DiskDrive" or
+        "CIM_LogicalDisk" or "CIM_NetworkAdapter" or "CIM_StorageVolume" or "CIM_OperatingSystem" or
+        "CIM_Process" or "CIM_Service" or "MSFT_DNSClientCache" or "Win32_BIOS" or "Win32_ComputerSystem" or
+        "Win32_ComputerSystemProduct" or "Win32_DiskDrive" or "win32_environment" or "Win32_Group" or
+        "Win32_groupuser" or "Win32_IP4RouteTable" or "Win32_logicaldisk" or "Win32_MappedLogicalDisk" or
+        "Win32_NetworkAdapterConfiguration" or "win32_ntdomain" or "Win32_OperatingSystem" or
+        "Win32_PnPEntity" or "Win32_Process" or "Win32_Product" or "Win32_quickfixengineering" or
+        "win32_service" or "Win32_Share" or "Win32_UserAccount"
+      )
+    ) or
+    (
+      ("ADSI" and "WinNT") or
+      ("Get-ChildItem" and "sysmondrv.sys") or
+      ("::GetIPGlobalProperties()" and "GetActiveTcpConnections()") or
+      ("ServiceProcess.ServiceController" and "::GetServices") or
+      ("Diagnostics.Process" and "::GetProcesses") or
+      ("DirectoryServices.Protocols.GroupPolicy" and ".GetGPOReport()") or
+      ("DirectoryServices.AccountManagement" and "PrincipalSearcher") or
+      ("NetFwTypeLib.NetFwMgr" and "CurrentProfile") or
+      ("NetworkInformation.NetworkInterface" and "GetAllNetworkInterfaces") or
+      ("Automation.PSDriveInfo") or
+      ("Microsoft.Win32.RegistryHive")
+    ) or
+    (
+      "Get-ItemProperty" and
+      (
+        "\Control\SecurityProviders\WDigest" or
+        "\microsoft\windows\currentversion\explorer\runmru" or
+        "\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" or
+        "\Microsoft\Windows\CurrentVersion\Uninstall" or
+        "\Microsoft\Windows\WindowsUpdate" or
+        "Policies\Microsoft\Windows\Installer" or
+        "Software\Microsoft\Windows\CurrentVersion\Policies" or
+        ("\Services\SharedAccess\Parameters\FirewallPolicy" and "EnableFirewall") or
+        ("Microsoft\Windows\CurrentVersion\Internet Settings" and "proxyEnable")
+      )
+    ) or
+    (
+      ("Directoryservices.Activedirectory" or
+      "DirectoryServices.AccountManagement") and 
+      (
+        "Domain Admins" or "DomainControllers" or
+        "FindAllGlobalCatalogs" or "GetAllTrustRelationships" or
+        "GetCurrentDomain" or "GetCurrentForest"
+      ) or
+      "DirectoryServices.DirectorySearcher" and
+      (
+        "samAccountType=805306368" or
+        "samAccountType=805306369" or
+        "objectCategory=group" or
+        "objectCategory=groupPolicyContainer" or
+        "objectCategory=site" or
+        "objectCategory=subnet" or
+        "objectClass=trustedDomain"
+      )
+    ) or
+    (
+      "Get-Process" and
+      (
+        "mcshield" or "windefend" or "savservice" or
+        "TMCCSF" or "symantec antivirus" or
+        "CSFalcon" or "TmPfw" or "kvoop"
+      )
+    )
+  ) and not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20")
+  and not file.path : (*WindowsPowerShell*Modules*.psd1 or *WindowsPowerShell*Modules*.psm1)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
+* Technique:
+** Name: File and Directory Discovery
+** ID: T1083
+** Reference URL: https://attack.mitre.org/techniques/T1083/
+* Technique:
+** Name: Group Policy Discovery
+** ID: T1615
+** Reference URL: https://attack.mitre.org/techniques/T1615/
+* Technique:
+** Name: Network Share Discovery
+** ID: T1135
+** Reference URL: https://attack.mitre.org/techniques/T1135/
+* Technique:
+** Name: Password Policy Discovery
+** ID: T1201
+** Reference URL: https://attack.mitre.org/techniques/T1201/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
+* Sub-technique:
+** Name: Security Software Discovery
+** ID: T1518.001
+** Reference URL: https://attack.mitre.org/techniques/T1518/001/
+* Technique:
+** Name: Query Registry
+** ID: T1012
+** Reference URL: https://attack.mitre.org/techniques/T1012/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
+* Technique:
+** Name: System Network Connections Discovery
+** ID: T1049
+** Reference URL: https://attack.mitre.org/techniques/T1049/
+* Technique:
+** Name: System Service Discovery
+** ID: T1007
+** Reference URL: https://attack.mitre.org/techniques/T1007/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc
new file mode 100644
index 0000000000..9c532cccc9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc
@@ -0,0 +1,122 @@
+[[powershell-script-with-encryption-decryption-capabilities]]
+=== PowerShell Script with Encryption/Decryption Capabilities
+
+Identifies the use of Cmdlets and methods related to encryption/decryption of files in PowerShell scripts, which malware and offensive security tools can abuse to encrypt data or decrypt payloads to bypass security solutions.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Script with Encryption/Decryption Capabilities
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
+
+PowerShell offers encryption and decryption functionalities that attackers can abuse for various purposes, such as concealing payloads, C2 communications, and encrypting data as part of ransomware operations.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+
+### False positive analysis
+
+- This is a dual-use mechanism, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the script doesn't contain malicious functions or potential for abuse, no other suspicious activity was identified, and there are justifications for the execution.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    (
+      "Cryptography.AESManaged" or
+      "Cryptography.RijndaelManaged" or
+      "Cryptography.SHA1Managed" or
+      "Cryptography.SHA256Managed" or
+      "Cryptography.SHA384Managed" or
+      "Cryptography.SHA512Managed" or
+      "Cryptography.SymmetricAlgorithm" or
+      "PasswordDeriveBytes" or
+      "Rfc2898DeriveBytes"
+    ) and
+    (
+      CipherMode and PaddingMode
+    ) and
+    (
+      ".CreateEncryptor" or
+      ".CreateDecryptor"
+    )
+  ) and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
new file mode 100644
index 0000000000..4146aa6f1c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
@@ -0,0 +1,94 @@
+[[powershell-script-with-log-clear-capabilities]]
+=== PowerShell Script with Log Clear Capabilities
+
+Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
+* https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Clear-EventLog" or
+    "Remove-EventLog" or
+    ("Eventing.Reader.EventLogSession" and ".ClearLog") or
+    ("Diagnostics.EventLog" and ".Clear")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc
index a2e04f142f..0adbde6788 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc
@@ -5,7 +5,7 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,61 +14,79 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/decoder-it/psgetsystem
 * https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/Get-System.ps1
 * https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: PowerShell Logs
 
-*Version*: 1
+*Version*: 7
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text:(
-"Invoke-TokenManipulation" or "ImpersonateNamedPipeClient" or
-"NtImpersonateThread" or ( "STARTUPINFOEX" and
-"UpdateProcThreadAttribute" ) or (
-"AdjustTokenPrivileges" and "SeDebugPrivilege" ) or (
-("DuplicateToken" or "DuplicateTokenEx") and
-("SetThreadToken" or "ImpersonateLoggedOnUser" or
-"CreateProcessWithTokenW" or "CreatePRocessAsUserW" or
-"CreateProcessAsUserA") ) )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "Invoke-TokenManipulation" or
+    "ImpersonateNamedPipeClient" or
+    "NtImpersonateThread" or
+    (
+      "STARTUPINFOEX" and
+      "UpdateProcThreadAttribute"
+    ) or
+    (
+      "AdjustTokenPrivileges" and
+      "SeDebugPrivilege"
+    ) or
+    (
+      ("DuplicateToken" or
+      "DuplicateTokenEx") and
+      ("SetThreadToken" or
+      "ImpersonateLoggedOnUser" or
+      "CreateProcessWithTokenW" or
+      "CreatePRocessAsUserW" or
+      "CreateProcessAsUserA")
+    ) 
+  ) and not 
+  (user.id:("S-1-5-18" or "S-1-5-19") and
+   file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads")
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,8 +98,10 @@ event.category:process and powershell.file.script_block_text:(
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -90,3 +110,11 @@ event.category:process and powershell.file.script_block_text:(
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
index daf4471e98..7950c02561 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
@@ -5,7 +5,7 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,58 +14,53 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.advintel.io/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations
 * https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-
-*Version*: 2 (<<powershell-share-enumeration-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 6
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Share Enumeration Script
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can use PowerShell to enumerate shares to search for sensitive data like documents, scripts, and other kinds
-of valuable data for encryption, exfiltration, and lateral movement.
+Attackers can use PowerShell to enumerate shares to search for sensitive data like documents, scripts, and other kinds of valuable data for encryption, exfiltration, and lateral movement.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
@@ -80,30 +75,33 @@ prevalence, whether they are located in expected locations, and if they are sign
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text:(
-"Invoke-ShareFinder" or "Invoke-ShareFinderThreaded" or (
-"shi1_netname" and "shi1_remark" ) or (
-"NetShareEnum" and "NetApiBufferFree" ) )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "Invoke-ShareFinder" or
+    "Invoke-ShareFinderThreaded" or
+    (
+      "shi1_netname" and
+      "shi1_remark"
+    ) or
+    (
+      "NetShareEnum" and
+      "NetApiBufferFree"
+    )
+  ) and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -115,8 +113,6 @@ event.category:process and powershell.file.script_block_text:(
 ** Name: Network Share Discovery
 ** ID: T1135
 ** Reference URL: https://attack.mitre.org/techniques/T1135/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -125,10 +121,11 @@ event.category:process and powershell.file.script_block_text:(
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-share-enumeration-script-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
index 9c21bb449a..2d50ba7f68 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
@@ -5,7 +5,7 @@ This rule detects the use of discovery-related Windows API functions in PowerShe
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,61 +14,52 @@ This rule detects the use of discovery-related Windows API functions in PowerShe
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-
-*Version*: 102 (<<powershell-suspicious-discovery-related-windows-api-functions-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 109
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate PowerShell scripts that make use of these functions.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Suspicious Discovery Related Windows API Functions
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can use PowerShell to interact with the Win32 API to bypass command line based detections, using libraries
-like PSReflect or Get-ProcAddress Cmdlet.
+Attackers can use PowerShell to interact with the Win32 API to bypass command line based detections, using libraries like PSReflect or Get-ProcAddress Cmdlet.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
@@ -76,9 +67,7 @@ prevalence, whether they are located in expected locations, and if they are sign
 
 ### False positive analysis
 
-- Discovery activities themselves are not inherently malicious if occurring in isolation, as long as the script does not
-contain other capabilities, and there are no other alerts related to the user or host; such alerts can be dismissed.
-However, analysts should keep in mind that this is not a common way of getting information, making it suspicious.
+- Discovery activities themselves are not inherently malicious if occurring in isolation, as long as the script does not contain other capabilities, and there are no other alerts related to the user or host; such alerts can be dismissed. However, analysts should keep in mind that this is not a common way of getting information, making it suspicious.
 
 ### Related rules
 
@@ -90,27 +79,45 @@ However, analysts should keep in mind that this is not a common way of getting i
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-NetShareEnum or NetWkstaUserEnum or NetSessionEnum or
-NetLocalGroupEnum or NetLocalGroupGetMembers or DsGetSiteName
-or DsEnumerateDomainTrusts or WTSEnumerateSessionsEx or
-WTSQuerySessionInformation or LsaGetLogonSessionData or
-QueryServiceObjectSecurity )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    NetShareEnum or
+    NetWkstaUserEnum or
+    NetSessionEnum or
+    NetLocalGroupEnum or
+    NetLocalGroupGetMembers or
+    DsGetSiteName or
+    DsEnumerateDomainTrusts or
+    WTSEnumerateSessionsEx or
+    WTSQuerySessionInformation or
+    LsaGetLogonSessionData or
+    QueryServiceObjectSecurity or
+    GetComputerNameEx or
+    NetWkstaGetInfo or
+    GetUserNameEx or
+    NetUserEnum or
+    NetUserGetInfo or
+    NetGroupEnum or
+    NetGroupGetInfo or
+    NetGroupGetUsers or
+    NetWkstaTransportEnum or
+    NetServerGetInfo or
+    LsaEnumerateTrustedDomains  or
+    NetScheduleJobEnum or
+    NetUserModalsGet
+  )
+  and not user.id : ("S-1-5-18" or "S-1-5-19")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -119,11 +126,29 @@ QueryServiceObjectSecurity )
 ** ID: TA0007
 ** Reference URL: https://attack.mitre.org/tactics/TA0007/
 * Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
 ** Name: Network Share Discovery
 ** ID: T1135
 ** Reference URL: https://attack.mitre.org/techniques/T1135/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -132,48 +157,11 @@ QueryServiceObjectSecurity )
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-suspicious-discovery-related-windows-api-functions-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-NetShareEnum or NetWkstaUserEnum or NetSessionEnum or
-NetLocalGroupEnum or NetLocalGroupGetMembers or DsGetSiteName
-or DsEnumerateDomainTrusts or WTSEnumerateSessionsEx or
-WTSQuerySessionInformation or LsaGetLogonSessionData or
-QueryServiceObjectSecurity )
-----------------------------------
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:"4104" and powershell.file.script_block_text : (
-NetShareEnum or NetWkstaUserEnum or NetSessionEnum or
-NetLocalGroupEnum or NetLocalGroupGetMembers or DsGetSiteName
-or DsEnumerateDomainTrusts or WTSEnumerateSessionsEx or
-WTSQuerySessionInformation or LsaGetLogonSessionData or
-QueryServiceObjectSecurity )
-----------------------------------
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index 8357114483..49703e35a5 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -14,83 +14,73 @@ Identifies the use of .NET functionality for decompression and base64 decoding c
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<powershell-suspicious-payload-encoded-and-compressed-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 108
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate PowerShell Scripts which makes use of compression and encoding.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Suspicious Payload Encoded and Compressed
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the
-disk. This strategy can circumvent string and file-based security protections.
+Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the script using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did
-not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
+- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
 
 ### Related rules
 
@@ -106,34 +96,35 @@ not identify malware or suspicious activity related to the user or host, this al
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-( "System.IO.Compression.DeflateStream" or
-"System.IO.Compression.GzipStream" or
-"IO.Compression.DeflateStream" or "IO.Compression.GzipStream"
-) and FromBase64String )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    (
+      "System.IO.Compression.DeflateStream" or
+      "System.IO.Compression.GzipStream" or
+      "IO.Compression.DeflateStream" or
+      "IO.Compression.GzipStream"
+    ) and
+    FromBase64String
+  ) and not
+  (user.id:("S-1-5-18" or "S-1-5-19") and
+   file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads")
+  and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -142,11 +133,13 @@ event.category:process and powershell.file.script_block_text : (
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
 ** Name: Deobfuscate/Decode Files or Information
 ** ID: T1140
 ** Reference URL: https://attack.mitre.org/techniques/T1140/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -155,42 +148,7 @@ event.category:process and powershell.file.script_block_text : (
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-suspicious-payload-encoded-and-compressed-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-( "System.IO.Compression.DeflateStream" or
-"System.IO.Compression.GzipStream" or
-"IO.Compression.DeflateStream" or "IO.Compression.GzipStream"
-) and FromBase64String )
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-(System.IO.Compression.DeflateStream or
-System.IO.Compression.GzipStream or IO.Compression.DeflateStream or
-IO.Compression.GzipStream) and FromBase64String )
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
index 5105335fc9..f000ce607c 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
@@ -5,7 +5,7 @@ Detects PowerShell scripts that can record audio, a common feature in popular po
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,67 +14,61 @@ Detects PowerShell scripts that can record audio, a common feature in popular po
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Collection
-* Investigation Guide
-
-*Version*: 102 (<<powershell-suspicious-script-with-audio-capture-capabilities-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Suspicious Script with Audio Capture Capabilities
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can use PowerShell to interact with the Windows API with the intent of capturing audio from input devices
-connected to the victim's computer.
+Attackers can use PowerShell to interact with the Windows API with the intent of capturing audio from input devices connected to the victim's computer.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
 - Investigate if the script stores the recorded data locally and determine if anything was recorded.
-- Investigate if the script contains exfiltration capabilities and the destination of this exfiltration.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
 ### False positive analysis
 
-- Regular users should not need scripts to capture audio, which makes false positives unlikely. In the case of
-authorized benign true positives (B-TPs), exceptions can be added.
+- Regular users should not need scripts to capture audio, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
 ### Related rules
 
@@ -85,29 +79,31 @@ authorized benign true positives (B-TPs), exceptions can be added.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- The response must be prioritized if this alert involves key executives or potentially valuable targets for espionage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-"Get-MicrophoneAudio" or (waveInGetNumDevs and mciSendStringA) )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Get-MicrophoneAudio" or
+    "WindowsAudioDevice-Powershell-Cmdlet" or
+    (waveInGetNumDevs and mciSendStringA)
+  )
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+  and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -119,8 +115,6 @@ event.category:process and powershell.file.script_block_text : (
 ** Name: Audio Capture
 ** ID: T1123
 ** Reference URL: https://attack.mitre.org/techniques/T1123/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -129,46 +123,7 @@ event.category:process and powershell.file.script_block_text : (
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-suspicious-script-with-audio-capture-capabilities-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-"Get-MicrophoneAudio" or (waveInGetNumDevs and mciSendStringA) )
-----------------------------------
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-Get-MicrophoneAudio or (waveInGetNumDevs and mciSendStringA) )
-----------------------------------
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:"4104" and powershell.file.script_block_text : (
-Get-MicrophoneAudio or (waveInGetNumDevs and mciSendStringA) )
-----------------------------------
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
new file mode 100644
index 0000000000..eda72aeb3e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -0,0 +1,138 @@
+[[powershell-suspicious-script-with-clipboard-retrieval-capabilities]]
+=== PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+
+Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can abuse PowerShell capabilities to get the contents of the clipboard with the goal of stealing credentials and other valuable information, such as credit card data and confidential conversations.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+- Assess network data to determine if the host communicated with the exfiltration server.
+
+### False positive analysis
+
+- Regular users are unlikely to use scripting utilities to capture contents of the clipboard, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+
+### Related rules
+
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (powershell.file.script_block_text : (
+    "Windows.Clipboard" or
+    "Windows.Forms.Clipboard" or
+    "Windows.Forms.TextBox"
+   ) and
+   powershell.file.script_block_text : (
+    "]::GetText" or
+    ".Paste()"
+  )) or powershell.file.script_block_text : "Get-Clipboard"
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+  and not user.id : "S-1-5-18"
+  and not file.path : (*WindowsPowerShell*Modules*.psd1 or *WindowsPowerShell*Modules*.psm1)
+  and not (
+    file.path : *WindowsPowerShell*Modules*.ps1 and
+    file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Clipboard Data
+** ID: T1115
+** Reference URL: https://attack.mitre.org/techniques/T1115/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc
index 25f3808e42..fe7cc27947 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc
@@ -5,7 +5,7 @@ Detects PowerShell scripts that can take screenshots, which is a common feature
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,67 +14,61 @@ Detects PowerShell scripts that can take screenshots, which is a common feature
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Collection
-* Investigation Guide
-
-*Version*: 102 (<<powershell-suspicious-script-with-screenshot-capabilities-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PowerShell Suspicious Script with Screenshot Capabilities
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, which makes
-it available for use in various environments and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, which makes it available for use in various environments and creates an attractive way for attackers to execute code.
 
-Attackers can abuse PowerShell capabilities and take screen captures of desktops to gather information over the course
-of an operation.
+Attackers can abuse PowerShell capabilities and take screen captures of desktops to gather information over the course of an operation.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine file or network events from the involved PowerShell process for suspicious behavior.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
-- Investigate if the script stores the captured data locally.
-- Investigate if the script contains exfiltration capabilities and the destination of this exfiltration.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
 ### False positive analysis
 
-- Regular users do not have a business justification for using scripting utilities to take screenshots, which makes false
-positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+- Regular users do not have a business justification for using scripting utilities to take screenshots, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
 ### Related rules
 
@@ -85,28 +79,24 @@ positives unlikely. In the case of authorized benign true positives (B-TPs), exc
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-CopyFromScreen and ("System.Drawing.Bitmap" or "Drawing.Bitmap")
-)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    CopyFromScreen and
+    ("System.Drawing.Bitmap" or "Drawing.Bitmap")
+  ) and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,8 +108,6 @@ CopyFromScreen and ("System.Drawing.Bitmap" or "Drawing.Bitmap")
 ** Name: Screen Capture
 ** ID: T1113
 ** Reference URL: https://attack.mitre.org/techniques/T1113/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -128,38 +116,7 @@ CopyFromScreen and ("System.Drawing.Bitmap" or "Drawing.Bitmap")
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[powershell-suspicious-script-with-screenshot-capabilities-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-CopyFromScreen and ("System.Drawing.Bitmap" or "Drawing.Bitmap")
-)
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-CopyFromScreen and (System.Drawing.Bitmap or Drawing.Bitmap) )
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index 623f3a9ee1..0b29abba3b 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -10,12 +10,13 @@ Identifies a privilege escalation attempt via named pipe impersonation. An adver
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -24,45 +25,93 @@ Identifies a privilege escalation attempt via named pipe impersonation. An adver
 *References*:
 
 * https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation
+* https://www.cobaltstrike.com/blog/what-happens-when-i-type-getsystem/
+* https://redcanary.com/blog/getsystem-offsec/
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 101 (<<privilege-escalation-via-named-pipe-impersonation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Privilege Escalation via Named Pipe Impersonation
+
+A named pipe is a type of inter-process communication (IPC) mechanism used in operating systems like Windows, which allows two or more processes to communicate with each other by sending and receiving data through a well-known point.
+
+Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - If any suspicious processes were found, examine the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.pe.original_file_name
-in ("Cmd.Exe", "PowerShell.EXE") and process.args : "echo" and
-process.args : ">" and process.args : "\\\\.\\pipe\\*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE") and
+ process.args : "echo" and process.args : ">" and process.args : "\\\\.\\pipe\\*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,38 +123,3 @@ process.args : ">" and process.args : "\\\\.\\pipe\\*"
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[privilege-escalation-via-named-pipe-impersonation-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE") and
-process.args : "echo" and process.args : ">" and process.args :
-"\\\\.\\pipe\\*"
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE") and
-process.args : "echo" and process.args : ">" and process.args :
-"\\\\.\\pipe\\*"
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc
index a313c3cc6e..2a4b17e540 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc
@@ -5,7 +5,7 @@ Identifies a privilege escalation attempt via rogue named pipe impersonation. An
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,41 +14,39 @@ Identifies a privilege escalation attempt via rogue named pipe impersonation. An
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/
 * https://github.com/zcgonvh/EfsPotato
 * https://twitter.com/SBousseaden/status/1429530155291193354
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Sysmon Only
-
-*Version*: 101 (<<privilege-escalation-via-rogue-named-pipe-impersonation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 Named Pipe Creation Events need to be enabled within the Sysmon configuration by including the following settings:
 `condition equal "contains" and keyword equal "pipe"`
@@ -56,18 +54,16 @@ Named Pipe Creation Events need to be enabled within the Sysmon configuration by
 If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.action : "Pipe Created*" and /* normal sysmon named
-pipe creation events truncate the pipe keyword */ file.name :
-"\\*\\Pipe\\*"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.action : "Pipe Created*" and
+ /* normal sysmon named pipe creation events truncate the pipe keyword */
+  file.name : "\\*\\Pipe\\*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,19 +75,3 @@ pipe creation events truncate the pipe keyword */ file.name :
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[privilege-escalation-via-rogue-named-pipe-impersonation-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
index 6b55047b30..0b77fc648d 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to the root crontab file. Adversaries may overwrite thi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ Identifies modifications to the root crontab file. Adversaries may overwrite thi
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc
 * https://www.exploit-db.com/exploits/42146
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<privilege-escalation-via-root-crontab-file-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.path:/private/var/at/tabs/root and not
-process.executable:/usr/bin/crontab
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and not event.type:deletion and
+ file.path:/private/var/at/tabs/root and not process.executable:/usr/bin/crontab
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,13 +61,7 @@ process.executable:/usr/bin/crontab
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[privilege-escalation-via-root-crontab-file-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
index e5e680aab5..014cef1263 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
@@ -5,53 +5,56 @@ Identifies a privilege escalation attempt via a rogue Windows directory (Windir)
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<privilege-escalation-via-windir-environment-variable-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path : ("HKEY_USERS\\*\\Environment\\windir",
-"HKEY_USERS\\*\\Environment\\systemroot") and not
-registry.data.strings : ("C:\\windows", "%SystemRoot%")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKEY_USERS\\*\\Environment\\windir",
+    "HKEY_USERS\\*\\Environment\\systemroot",
+    "\\REGISTRY\\USER\\*\\Environment\\windir",
+    "\\REGISTRY\\USER\\*\\Environment\\systemroot"
+    ) and
+ not registry.data.strings : ("C:\\windows", "%SystemRoot%")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,29 +66,7 @@ registry.data.strings : ("C:\\windows", "%SystemRoot%")
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[privilege-escalation-via-windir-environment-variable-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path : ("HKEY_USERS\\*\\Environment\\windir",
-"HKEY_USERS\\*\\Environment\\systemroot") and not
-registry.data.strings : ("C:\\windows", "%SystemRoot%")
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Path Interception by PATH Environment Variable
+** ID: T1574.007
+** Reference URL: https://attack.mitre.org/techniques/T1574/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
index dc361a47dc..33fe0b49f1 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
@@ -9,12 +9,13 @@ Identifies multiple consecutive logon failures targeting an Admin account from t
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -26,75 +27,89 @@ Identifies multiple consecutive logon failures targeting an Admin account from t
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 7
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
+### Investigating Privileged Account Brute Force
+
+Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found [here](https://attack.mitre.org/techniques/T1110/001/).
+
+This rule identifies potential password guessing/brute force activity from a single address against an account that contains the `admin` pattern on its name, which is likely a highly privileged account.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
 #### Possible investigation steps
 
-- Investigate the logon failure reason code and the targeted user names.
+- Investigate the logon failure reason code and the targeted user name.
+  - Prioritize the investigation if the account is critical or has administrative privileges over the domain.
 - Investigate the source IP address of the failed Network Logon attempts.
-- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Identify whether these attempts are coming from the internet or are internal.
+- Investigate other alerts associated with the involved users and source host during the past 48 hours.
 - Identify the source and the target computer and their roles in the IT environment.
+- Check whether the involved credentials are used in automation or scheduled tasks.
+- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
+- Examine the source host for derived artifacts that indicate compromise:
+  - Observe and collect information about the following activities in the alert source host:
+    - Attempts to contact external domains and addresses.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the host which is the source of this activity.
 
 ### False positive analysis
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
-- Trust relationship between the primary domain and the trusted domain issue.
-- Infrastructure or availability issue.
+- Domain trust relationship issues.
+- Infrastructure or availability issues.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- If the host is a domain controller (DC):
-  - Activate your incident response plan for total Active Directory compromise.
-  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is
-  being followed and to reduce the attack surface.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Isolate the source host to prevent further post-compromise behavior.
+- If the asset is exposed to the internet with RDP or other remote services available, take the necessary measures to restrict access to the asset. If not possible, limit the access via the firewall to only the needed IP addresses. Also, ensure the system uses robust authentication mechanisms and is patched regularly.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, source.ip with maxspan=10s [authentication
-where event.action == "logon-failed" and winlog.logon.type :
-"Network" and source.ip != null and source.ip != "127.0.0.1" and
-source.ip != "::1" and user.name : "*admin*" and /* noisy failure
-status codes often associated to authentication misconfiguration */
-not winlog.event_data.Status : ("0xC000015B", "0XC000005E",
-"0XC0000133", "0XC0000192")] with runs=5
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name, source.ip with maxspan=10s
+  [authentication where event.action == "logon-failed" and winlog.logon.type : "Network" and
+    source.ip != null and source.ip != "127.0.0.1" and source.ip != "::1" and user.name : "*admin*" and
 
-==== Threat mapping
+    /* noisy failure status codes often associated to authentication misconfiguration */
+    not winlog.event_data.Status : ("0xC000015B", "0XC000005E", "0XC0000133", "0XC0000192")] with runs=5
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -106,3 +121,11 @@ not winlog.event_data.Status : ("0xC000015B", "0XC000005E",
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc
index 7ca3a7ec65..81a4832efa 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc
@@ -5,7 +5,7 @@ Identifies parent process spoofing used to create an elevated child process. Adv
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,61 +13,66 @@ Identifies parent process spoofing used to create an elevated child process. Adv
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6
 * https://blog.didierstevens.com/2017/03/20/
 * https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute
 * https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Version*: 1
+*Version*: 4
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* This rule is compatible with Elastic Endpoint only */ process
-where event.action == "start" and /* process creation via seclogon
-*/ process.parent.Ext.real.pid > 0 and /* PrivEsc to SYSTEM */
-user.id : "S-1-5-18" and /* Common FPs - evasion via hollowing is
-possible, should be covered by code injection */ not
-process.executable : ("?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\SysWOW64\\WerFault.exe",
-"?:\\Windows\\System32\\WerFaultSecure.exe",
-"?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
-"?:\\Windows\\System32\\Wermgr.exe",
-"?:\\Windows\\SysWOW64\\Wermgr.exe", "?:\\W
-indows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.e
-xe") and not process.parent.executable :
-"?:\\Windows\\System32\\AtBroker.exe" and not
-(process.code_signature.subject_name in ("philandro
-Software GmbH", "Freedom Scientific Inc.", "TeamViewer Germany GmbH",
-"Projector.is, Inc.", "TeamViewer GmbH", "Cisco WebEx
-LLC", "Dell Inc") and process.code_signature.trusted == true)
+[source, js]
 ----------------------------------
+/* This rule is compatible with Elastic Endpoint only */
+
+process where host.os.type == "windows" and event.action == "start" and
+
+ /* process creation via seclogon */
+ process.parent.Ext.real.pid > 0 and
 
-==== Threat mapping
+ /* PrivEsc to SYSTEM */
+ user.id : "S-1-5-18"  and
+
+ /* Common FPs - evasion via hollowing is possible, should be covered by code injection */
+ not process.executable : ("?:\\Windows\\System32\\WerFault.exe",
+                           "?:\\Windows\\SysWOW64\\WerFault.exe",
+                           "?:\\Windows\\System32\\WerFaultSecure.exe",
+                           "?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
+                           "?:\\Windows\\System32\\Wermgr.exe",
+                           "?:\\Windows\\SysWOW64\\Wermgr.exe",
+                           "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
+
+ not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and
+
+ not (process.code_signature.subject_name in
+           ("philandro Software GmbH", "Freedom Scientific Inc.", "TeamViewer Germany GmbH", "Projector.is, Inc.",
+            "TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc") and process.code_signature.trusted == true)
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,3 +84,11 @@ LLC", "Dell Inc") and process.code_signature.trusted == true)
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
+* Sub-technique:
+** Name: Parent PID Spoofing
+** ID: T1134.004
+** Reference URL: https://attack.mitre.org/techniques/T1134/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index 26e989c5a3..da36c1607b 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -16,56 +16,105 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<process-activity-via-compiled-html-file-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Process Activity via Compiled HTML File
+
+CHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.
+
+When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate the parent process to gain understanding of what triggered this behavior.
+  - Retrieve `.chm`, `.ps1`, and other files that were involved to further examination.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executables, scripts and help files retrieved from the system using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- If the malicious file was delivered via phishing:
+  - Block the email sender from sending future emails.
+  - Block the malicious web pages.
+  - Remove emails from the sender from mailboxes.
+  - Consider improvements to the security awareness program.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"hh.exe" and process.name : ("mshta.exe", "cmd.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe", "cscript.exe",
-"wscript.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "hh.exe" and
+ process.name : ("mshta.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "cscript.exe", "wscript.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +126,10 @@ process where event.type == "start" and process.parent.name :
 ** Name: User Execution
 ** ID: T1204
 ** Reference URL: https://attack.mitre.org/techniques/T1204/
-
-
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -87,77 +138,7 @@ process where event.type == "start" and process.parent.name :
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[process-activity-via-compiled-html-file-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "hh.exe" and process.name : ("mshta.exe",
-"cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe",
-"cscript.exe", "wscript.exe")
-----------------------------------
-
-Version 13 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "hh.exe" and process.name : ("mshta.exe",
-"cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe",
-"cscript.exe", "wscript.exe")
-----------------------------------
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "hh.exe" and process.name : ("mshta.exe",
-"cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe")
-----------------------------------
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:hh.exe
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:1 and process.name:hh.exe
-----------------------------------
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Compiled HTML File
+** ID: T1218.001
+** Reference URL: https://attack.mitre.org/techniques/T1218/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc
index 6ad0c753d1..fa0ee22679 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,70 +13,104 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://lengjibo.github.io/token/
 * https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Version*: 1
+*Version*: 4
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* This rule is only compatible with Elastic Endpoint 8.4+ */ process
-where event.action == "start" and /* CreateProcessWithToken and
-effective parent is a privileged MS native binary used as a target for
-token theft */ user.id : "S-1-5-18" and /* Token Theft target
-process usually running as service are located in one of the following
-paths */ process.Ext.effective_parent.executable :
-("?:\\Windows\\*.exe", "?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\ProgramData\\*") and not
-(process.Ext.effective_parent.executable :
-"?:\\Windows\\System32\\Utilman.exe" and
-process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
-process.parent.args : "/debug") and not process.executable :
-("?:\\Windows\\System32\\WerFault.exe",
-"?:\\Windows\\SysWOW64\\WerFault.exe",
-"?:\\Windows\\System32\\WerFaultSecure.exe",
-"?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
-"?:\\windows\\system32\\WerMgr.exe", "?:\\W
-indows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.e
-xe") and not process.parent.executable :
-("?:\\Windows\\System32\\AtBroker.exe",
-"?:\\Windows\\system32\\svchost.exe", "?:\\Program Files
-(x86)\\*.exe", "?:\\Program Files\\*.exe",
-"?:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\System32\\DriverStore\\*") and not
-(process.code_signature.trusted == true and
-process.code_signature.subject_name in ("philandro Software GmbH",
-"Freedom Scientific Inc.", "TeamViewer Germany GmbH", "Projector.is,
-Inc.", "TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc"))
+[source, js]
 ----------------------------------
+/* This rule is only compatible with Elastic Endpoint 8.4+ */
+
+process where host.os.type == "windows" and event.action == "start" and
+
+ /* CreateProcessWithToken and effective parent is a privileged MS native binary used as a target for token theft */
+ user.id : "S-1-5-18"  and
+
+ /* Token Theft target process usually running as service are located in one of the following paths */
+ process.Ext.effective_parent.executable :
+                ("?:\\Windows\\*.exe",
+                 "?:\\Program Files\\*.exe",
+                 "?:\\Program Files (x86)\\*.exe",
+                 "?:\\ProgramData\\*") and
+
+/* Ignores Utility Manager in Windows running in debug mode */
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
+      process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and process.parent.args : "/debug") and
+
+/* Ignores Windows print spooler service with correlation to Access Intelligent Form */
+not (process.parent.executable : "?\\Windows\\System32\\spoolsv.exe" and
+     process.executable: "?:\\Program Files*\\Access\\Intelligent Form\\*\\LaunchCreate.exe") and 
+
+/* Ignores Windows error reporting executables */
+ not process.executable : ("?:\\Windows\\System32\\WerFault.exe",
+                           "?:\\Windows\\SysWOW64\\WerFault.exe",
+                           "?:\\Windows\\System32\\WerFaultSecure.exe",
+                           "?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
+                           "?:\\windows\\system32\\WerMgr.exe",
+                           "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe")  and
+
+ /* Ignores Windows updates from TiWorker.exe that runs with elevated privileges */
+ not (process.parent.executable : "?:\\Windows\\WinSxS\\*\\TiWorker.exe" and
+      process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*.exe",
+                            "?:\\Windows\\WinSxS\\*.exe",
+                            "?:\\Windows\\System32\\inetsrv\\iissetup.exe",
+                            "?:\\Windows\\SysWOW64\\inetsrv\\iissetup.exe",
+                            "?:\\Windows\\System32\\inetsrv\\aspnetca.exe",
+                            "?:\\Windows\\SysWOW64\\inetsrv\\aspnetca.exe",
+                            "?:\\Windows\\System32\\lodctr.exe",
+                            "?:\\Windows\\SysWOW64\\lodctr.exe",
+                            "?:\\Windows\\System32\\netcfg.exe",
+                            "?:\\Windows\\Microsoft.NET\\Framework*\\*\\ngen.exe",
+                            "?:\\Windows\\Microsoft.NET\\Framework*\\*\\aspnet_regiis.exe")) and
+
+
+/* Ignores additional parent executables that run with elevated privileges */
+ not process.parent.executable : 
+               ("?:\\Windows\\System32\\AtBroker.exe", 
+                "?:\\Windows\\system32\\svchost.exe", 
+                "?:\\Program Files (x86)\\*.exe", 
+                "?:\\Program Files\\*.exe", 
+                "?:\\Windows\\System32\\msiexec.exe",
+                "?:\\Windows\\System32\\DriverStore\\*") and
+
+/* Ignores Windows binaries with a trusted signature and specific signature name */
+ not (process.code_signature.trusted == true and
+      process.code_signature.subject_name : 
+                ("philandro Software GmbH", 
+                 "Freedom Scientific Inc.", 
+                 "TeamViewer Germany GmbH", 
+                 "Projector.is, Inc.", 
+                 "TeamViewer GmbH", 
+                 "Cisco WebEx LLC", 
+                 "Dell Inc"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -88,3 +122,7 @@ Inc.", "TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc"))
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc
index ca1b462561..6e784aa3e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc
@@ -5,67 +5,67 @@ Identifies process creation with alternate credentials. Adversaries may create a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://attack.mitre.org/techniques/T1134/002/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 2 (<<process-creation-via-secondary-logon-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 7
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=1m [authentication where
-event.action:"logged-in" and event.outcome == "success" and user.id :
-("S-1-5-21-*", "S-1-12-1-*") and /* seclogon service */
-process.name == "svchost.exe" and winlog.event_data.LogonProcessName
-: "seclogo*" and source.ip == "::1" ] by
-winlog.event_data.TargetLogonId [process where event.type == "start"]
-by winlog.event_data.TargetLogonId
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name with maxspan=1m
+
+[authentication where event.action:"logged-in" and
+ event.outcome == "success" and user.id : ("S-1-5-21-*", "S-1-12-1-*") and
+
+ /* seclogon service */
+ process.name == "svchost.exe" and
+ winlog.event_data.LogonProcessName : "seclogo*" and source.ip == "::1" ] by winlog.event_data.TargetLogonId
 
-==== Threat mapping
+[process where event.type == "start"] by winlog.event_data.TargetLogonId
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,20 +77,11 @@ by winlog.event_data.TargetLogonId
 ** Name: Access Token Manipulation
 ** ID: T1134
 ** Reference URL: https://attack.mitre.org/techniques/T1134/
-
-[[process-creation-via-secondary-logon-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [authentication where
-event.action:"logged-in" and event.outcome == "success" and
-user.id:"S-1-5-21-*" and /* seclogon service */ process.name ==
-"svchost.exe" and winlog.event_data.LogonProcessName : "seclogo*"
-and source.ip == "::1" ] by winlog.event_data.TargetLogonId [process
-where event.type == "start"] by winlog.event_data.TargetLogonId
-----------------------------------
-
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
+* Sub-technique:
+** Name: Make and Impersonate Token
+** ID: T1134.003
+** Reference URL: https://attack.mitre.org/techniques/T1134/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-discovery-via-built-in-applications.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-discovery-via-built-in-applications.asciidoc
new file mode 100644
index 0000000000..a75b2139ad
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/process-discovery-via-built-in-applications.asciidoc
@@ -0,0 +1,70 @@
+[[process-discovery-via-built-in-applications]]
+=== Process Discovery via Built-In Applications
+
+Identifies the use of built-in tools attackers can use to discover running processes on an endpoint.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type == "start" and event.action == "exec" and
+  process.name :("ps", "pstree", "htop", "pgrep") and
+  not (event.action == "exec" and process.parent.name in ("amazon-ssm-agent", "snap"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
+* Sub-technique:
+** Name: Security Software Discovery
+** ID: T1518.001
+** Reference URL: https://attack.mitre.org/techniques/T1518/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
index d6af5332e6..4c1854013a 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
@@ -5,7 +5,7 @@ Identifies process execution from suspicious default Windows directories. This i
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,92 +16,73 @@ Identifies process execution from suspicious default Windows directories. This i
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<process-execution-from-an-unusual-directory-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and /* add suspicious execution
-paths here */ process.executable : ("C:\\PerfLogs\\*.exe","C:\\Users\\
-Public\\*.exe","C:\\Windows\\Tasks\\*.exe","C:\\Intel\\*.exe","C:\\AMD
-\\Temp\\*.exe","C:\\Windows\\AppReadiness\\*.exe", "C:\\Windows\\Servi
-ceState\\*.exe","C:\\Windows\\security\\*.exe","C:\\Windows\\IdentityC
-RL\\*.exe","C:\\Windows\\Branding\\*.exe","C:\\Windows\\csc\\*.exe",
-"C:\\Windows\\DigitalLocker\\*.exe","C:\\Windows\\en-US\\*.exe","C:\\W
-indows\\wlansvc\\*.exe","C:\\Windows\\Prefetch\\*.exe","C:\\Windows\\F
-onts\\*.exe", "C:\\Windows\\diagnostics\\*.exe","C:\\Windows\\TAPI\\*
-.exe","C:\\Windows\\INF\\*.exe","C:\\Windows\\System32\\Speech\\*.exe"
-,"C:\\windows\\tracing\\*.exe", "c:\\windows\\IME\\*.exe","c:\\Window
-s\\Performance\\*.exe","c:\\windows\\intel\\*.exe","c:\\windows\\ms\\*
-.exe","C:\\Windows\\dot3svc\\*.exe", "C:\\Windows\\panther\\*.exe","C
-:\\Windows\\RemotePackages\\*.exe","C:\\Windows\\OCR\\*.exe","C:\\Wind
-ows\\appcompat\\*.exe","C:\\Windows\\apppatch\\*.exe","C:\\Windows\\ad
-dins\\*.exe", "C:\\Windows\\Setup\\*.exe","C:\\Windows\\Help\\*.exe",
-"C:\\Windows\\SKB\\*.exe","C:\\Windows\\Vss\\*.exe","C:\\Windows\\Web\
-\*.exe","C:\\Windows\\servicing\\*.exe","C:\\Windows\\CbsTemp\\*.exe",
-"C:\\Windows\\Logs\\*.exe","C:\\Windows\\WaaS\\*.exe","C:\\Windows\\Sh
-ellExperiences\\*.exe","C:\\Windows\\ShellComponents\\*.exe","C:\\Wind
-ows\\PLA\\*.exe", "C:\\Windows\\Migration\\*.exe","C:\\Windows\\debug
-\\*.exe","C:\\Windows\\Cursors\\*.exe","C:\\Windows\\Containers\\*.exe
-","C:\\Windows\\Boot\\*.exe","C:\\Windows\\bcastdvr\\*.exe", "C:\\Win
-dows\\assembly\\*.exe","C:\\Windows\\TextInput\\*.exe","C:\\Windows\\s
-ecurity\\*.exe","C:\\Windows\\schemas\\*.exe","C:\\Windows\\SchCache\\
-*.exe","C:\\Windows\\Resources\\*.exe", "C:\\Windows\\rescache\\*.exe
-","C:\\Windows\\Provisioning\\*.exe","C:\\Windows\\PrintDialog\\*.exe"
-,"C:\\Windows\\PolicyDefinitions\\*.exe","C:\\Windows\\media\\*.exe",
-"C:\\Windows\\Globalization\\*.exe","C:\\Windows\\L2Schemas\\*.exe","C
-:\\Windows\\LiveKernelReports\\*.exe","C:\\Windows\\ModemLogs\\*.exe",
-"C:\\Windows\\ImmersiveControlPanel\\*.exe") and not process.name : (
-"SpeechUXWiz.exe","SystemSettings.exe","TrustedInstaller.exe","PrintDi
-alog.exe","MpSigStub.exe","LMS.exe","mpam-*.exe") and not
-process.executable :
-("?:\\Intel\\Wireless\\WUSetupLauncher.exe",
-"?:\\Intel\\Wireless\\Setup.exe", "?:\\Intel\\Move
-Mouse.exe", "?:\\windows\\Panther\\DiagTrackRunner.exe",
-"?:\\Windows\\servicing\\GC64\\tzupd.exe",
-"?:\\Users\\Public\\res\\RemoteLite.exe",
-"?:\\Users\\Public\\IBM\\ClientSolutions\\*.exe",
-"?:\\Users\\Public\\Documents\\syspin.exe",
-"?:\\Users\\Public\\res\\FileWatcher.exe") /* uncomment once in
-winlogbeat */ /* and not (process.code_signature.subject_name ==
-"Microsoft Corporation" and process.code_signature.trusted == true) */
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ /* add suspicious execution paths here */
+process.executable : ("C:\\PerfLogs\\*.exe","C:\\Users\\Public\\*.exe","C:\\Windows\\Tasks\\*.exe","C:\\Intel\\*.exe","C:\\AMD\\Temp\\*.exe","C:\\Windows\\AppReadiness\\*.exe",
+"C:\\Windows\\ServiceState\\*.exe","C:\\Windows\\security\\*.exe","C:\\Windows\\IdentityCRL\\*.exe","C:\\Windows\\Branding\\*.exe","C:\\Windows\\csc\\*.exe",
+ "C:\\Windows\\DigitalLocker\\*.exe","C:\\Windows\\en-US\\*.exe","C:\\Windows\\wlansvc\\*.exe","C:\\Windows\\Prefetch\\*.exe","C:\\Windows\\Fonts\\*.exe",
+ "C:\\Windows\\diagnostics\\*.exe","C:\\Windows\\TAPI\\*.exe","C:\\Windows\\INF\\*.exe","C:\\Windows\\System32\\Speech\\*.exe","C:\\windows\\tracing\\*.exe",
+ "c:\\windows\\IME\\*.exe","c:\\Windows\\Performance\\*.exe","c:\\windows\\intel\\*.exe","c:\\windows\\ms\\*.exe","C:\\Windows\\dot3svc\\*.exe",
+ "C:\\Windows\\panther\\*.exe","C:\\Windows\\RemotePackages\\*.exe","C:\\Windows\\OCR\\*.exe","C:\\Windows\\appcompat\\*.exe","C:\\Windows\\apppatch\\*.exe","C:\\Windows\\addins\\*.exe",
+ "C:\\Windows\\Setup\\*.exe","C:\\Windows\\Help\\*.exe","C:\\Windows\\SKB\\*.exe","C:\\Windows\\Vss\\*.exe","C:\\Windows\\Web\\*.exe","C:\\Windows\\servicing\\*.exe","C:\\Windows\\CbsTemp\\*.exe",
+ "C:\\Windows\\Logs\\*.exe","C:\\Windows\\WaaS\\*.exe","C:\\Windows\\ShellExperiences\\*.exe","C:\\Windows\\ShellComponents\\*.exe","C:\\Windows\\PLA\\*.exe",
+ "C:\\Windows\\Migration\\*.exe","C:\\Windows\\debug\\*.exe","C:\\Windows\\Cursors\\*.exe","C:\\Windows\\Containers\\*.exe","C:\\Windows\\Boot\\*.exe","C:\\Windows\\bcastdvr\\*.exe",
+ "C:\\Windows\\assembly\\*.exe","C:\\Windows\\TextInput\\*.exe","C:\\Windows\\security\\*.exe","C:\\Windows\\schemas\\*.exe","C:\\Windows\\SchCache\\*.exe","C:\\Windows\\Resources\\*.exe",
+ "C:\\Windows\\rescache\\*.exe","C:\\Windows\\Provisioning\\*.exe","C:\\Windows\\PrintDialog\\*.exe","C:\\Windows\\PolicyDefinitions\\*.exe","C:\\Windows\\media\\*.exe",
+ "C:\\Windows\\Globalization\\*.exe","C:\\Windows\\L2Schemas\\*.exe","C:\\Windows\\LiveKernelReports\\*.exe","C:\\Windows\\ModemLogs\\*.exe","C:\\Windows\\ImmersiveControlPanel\\*.exe") and
+ not process.name : ("SpeechUXWiz.exe","SystemSettings.exe","TrustedInstaller.exe","PrintDialog.exe","MpSigStub.exe","LMS.exe","mpam-*.exe") and
+ not process.executable :
+           ("?:\\Intel\\Wireless\\WUSetupLauncher.exe",
+            "?:\\Intel\\Wireless\\Setup.exe",
+            "?:\\Intel\\Move Mouse.exe",
+            "?:\\windows\\Panther\\DiagTrackRunner.exe",
+            "?:\\Windows\\servicing\\GC64\\tzupd.exe",
+            "?:\\Users\\Public\\res\\RemoteLite.exe",
+            "?:\\Users\\Public\\IBM\\ClientSolutions\\*.exe",
+            "?:\\Users\\Public\\Documents\\syspin.exe",
+            "?:\\Users\\Public\\res\\FileWatcher.exe")
+ /* uncomment once in winlogbeat */
+ /* and not (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) */
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -113,115 +94,7 @@ winlogbeat */ /* and not (process.code_signature.subject_name ==
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[process-execution-from-an-unusual-directory-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-/* add suspicious execution paths here */ process.executable : ("C:\\P
-erfLogs\\*.exe","C:\\Users\\Public\\*.exe","C:\\Windows\\Tasks\\*.exe"
-,"C:\\Intel\\*.exe","C:\\AMD\\Temp\\*.exe","C:\\Windows\\AppReadiness\
-\*.exe", "C:\\Windows\\ServiceState\\*.exe","C:\\Windows\\security\\*.
-exe","C:\\Windows\\IdentityCRL\\*.exe","C:\\Windows\\Branding\\*.exe",
-"C:\\Windows\\csc\\*.exe",
-"C:\\Windows\\DigitalLocker\\*.exe","C:\\Windows\\en-US\\*.exe","C:\\W
-indows\\wlansvc\\*.exe","C:\\Windows\\Prefetch\\*.exe","C:\\Windows\\F
-onts\\*.exe", "C:\\Windows\\diagnostics\\*.exe","C:\\Windows\\TAPI\\*
-.exe","C:\\Windows\\INF\\*.exe","C:\\Windows\\System32\\Speech\\*.exe"
-,"C:\\windows\\tracing\\*.exe", "c:\\windows\\IME\\*.exe","c:\\Window
-s\\Performance\\*.exe","c:\\windows\\intel\\*.exe","c:\\windows\\ms\\*
-.exe","C:\\Windows\\dot3svc\\*.exe", "C:\\Windows\\panther\\*.exe","C
-:\\Windows\\RemotePackages\\*.exe","C:\\Windows\\OCR\\*.exe","C:\\Wind
-ows\\appcompat\\*.exe","C:\\Windows\\apppatch\\*.exe","C:\\Windows\\ad
-dins\\*.exe", "C:\\Windows\\Setup\\*.exe","C:\\Windows\\Help\\*.exe",
-"C:\\Windows\\SKB\\*.exe","C:\\Windows\\Vss\\*.exe","C:\\Windows\\Web\
-\*.exe","C:\\Windows\\servicing\\*.exe","C:\\Windows\\CbsTemp\\*.exe",
-"C:\\Windows\\Logs\\*.exe","C:\\Windows\\WaaS\\*.exe","C:\\Windows\\Sh
-ellExperiences\\*.exe","C:\\Windows\\ShellComponents\\*.exe","C:\\Wind
-ows\\PLA\\*.exe", "C:\\Windows\\Migration\\*.exe","C:\\Windows\\debug
-\\*.exe","C:\\Windows\\Cursors\\*.exe","C:\\Windows\\Containers\\*.exe
-","C:\\Windows\\Boot\\*.exe","C:\\Windows\\bcastdvr\\*.exe", "C:\\Win
-dows\\assembly\\*.exe","C:\\Windows\\TextInput\\*.exe","C:\\Windows\\s
-ecurity\\*.exe","C:\\Windows\\schemas\\*.exe","C:\\Windows\\SchCache\\
-*.exe","C:\\Windows\\Resources\\*.exe", "C:\\Windows\\rescache\\*.exe
-","C:\\Windows\\Provisioning\\*.exe","C:\\Windows\\PrintDialog\\*.exe"
-,"C:\\Windows\\PolicyDefinitions\\*.exe","C:\\Windows\\media\\*.exe",
-"C:\\Windows\\Globalization\\*.exe","C:\\Windows\\L2Schemas\\*.exe","C
-:\\Windows\\LiveKernelReports\\*.exe","C:\\Windows\\ModemLogs\\*.exe",
-"C:\\Windows\\ImmersiveControlPanel\\*.exe") and not process.name : (
-"SpeechUXWiz.exe","SystemSettings.exe","TrustedInstaller.exe","PrintDi
-alog.exe","MpSigStub.exe","LMS.exe","mpam-*.exe") and not
-process.executable :
-("?:\\Intel\\Wireless\\WUSetupLauncher.exe",
-"?:\\Intel\\Wireless\\Setup.exe", "?:\\Intel\\Move
-Mouse.exe", "?:\\windows\\Panther\\DiagTrackRunner.exe",
-"?:\\Windows\\servicing\\GC64\\tzupd.exe",
-"?:\\Users\\Public\\res\\RemoteLite.exe",
-"?:\\Users\\Public\\IBM\\ClientSolutions\\*.exe",
-"?:\\Users\\Public\\Documents\\syspin.exe",
-"?:\\Users\\Public\\res\\FileWatcher.exe") /* uncomment once in
-winlogbeat */ /* and not (process.code_signature.subject_name ==
-"Microsoft Corporation" and process.code_signature.trusted == true) */
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-/* add suspicious execution paths here */ process.executable : ("C:\\P
-erfLogs\\*.exe","C:\\Users\\Public\\*.exe","C:\\Users\\Default\\*.exe"
-,"C:\\Windows\\Tasks\\*.exe","C:\\Intel\\*.exe","C:\\AMD\\Temp\\*.exe"
-,"C:\\Windows\\AppReadiness\\*.exe", "C:\\Windows\\ServiceState\\*.exe
-","C:\\Windows\\security\\*.exe","C:\\Windows\\IdentityCRL\\*.exe","C:
-\\Windows\\Branding\\*.exe","C:\\Windows\\csc\\*.exe",
-"C:\\Windows\\DigitalLocker\\*.exe","C:\\Windows\\en-US\\*.exe","C:\\W
-indows\\wlansvc\\*.exe","C:\\Windows\\Prefetch\\*.exe","C:\\Windows\\F
-onts\\*.exe", "C:\\Windows\\diagnostics\\*.exe","C:\\Windows\\TAPI\\*
-.exe","C:\\Windows\\INF\\*.exe","C:\\Windows\\System32\\Speech\\*.exe"
-,"C:\\windows\\tracing\\*.exe", "c:\\windows\\IME\\*.exe","c:\\Window
-s\\Performance\\*.exe","c:\\windows\\intel\\*.exe","c:\\windows\\ms\\*
-.exe","C:\\Windows\\dot3svc\\*.exe","C:\\Windows\\ServiceProfiles\\*.e
-xe", "C:\\Windows\\panther\\*.exe","C:\\Windows\\RemotePackages\\*.ex
-e","C:\\Windows\\OCR\\*.exe","C:\\Windows\\appcompat\\*.exe","C:\\Wind
-ows\\apppatch\\*.exe","C:\\Windows\\addins\\*.exe", "C:\\Windows\\Set
-up\\*.exe","C:\\Windows\\Help\\*.exe","C:\\Windows\\SKB\\*.exe","C:\\W
-indows\\Vss\\*.exe","C:\\Windows\\Web\\*.exe","C:\\Windows\\servicing\
-\*.exe","C:\\Windows\\CbsTemp\\*.exe", "C:\\Windows\\Logs\\*.exe","C:
-\\Windows\\WaaS\\*.exe","C:\\Windows\\twain_32\\*.exe","C:\\Windows\\S
-hellExperiences\\*.exe","C:\\Windows\\ShellComponents\\*.exe","C:\\Win
-dows\\PLA\\*.exe", "C:\\Windows\\Migration\\*.exe","C:\\Windows\\debu
-g\\*.exe","C:\\Windows\\Cursors\\*.exe","C:\\Windows\\Containers\\*.ex
-e","C:\\Windows\\Boot\\*.exe","C:\\Windows\\bcastdvr\\*.exe", "C:\\Wi
-ndows\\assembly\\*.exe","C:\\Windows\\TextInput\\*.exe","C:\\Windows\\
-security\\*.exe","C:\\Windows\\schemas\\*.exe","C:\\Windows\\SchCache\
-\*.exe","C:\\Windows\\Resources\\*.exe", "C:\\Windows\\rescache\\*.ex
-e","C:\\Windows\\Provisioning\\*.exe","C:\\Windows\\PrintDialog\\*.exe
-","C:\\Windows\\PolicyDefinitions\\*.exe","C:\\Windows\\media\\*.exe",
-"C:\\Windows\\Globalization\\*.exe","C:\\Windows\\L2Schemas\\*.exe","C
-:\\Windows\\LiveKernelReports\\*.exe","C:\\Windows\\ModemLogs\\*.exe",
-"C:\\Windows\\ImmersiveControlPanel\\*.exe") and not process.name : (
-"SpeechUXWiz.exe","SystemSettings.exe","TrustedInstaller.exe","PrintDi
-alog.exe","MpSigStub.exe","LMS.exe","mpam-*.exe") /* uncomment once
-in winlogbeat */ /* and not (process.code_signature.subject_name ==
-"Microsoft Corporation" and process.code_signature.trusted == true) */
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-injection-by-the-microsoft-build-engine.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-injection-by-the-microsoft-build-engine.asciidoc
index a051cba587..203974c199 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-injection-by-the-microsoft-build-engine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-injection-by-the-microsoft-build-engine.asciidoc
@@ -5,7 +5,7 @@ An instance of MSBuild, the Microsoft Build Engine, created a thread in another
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,45 +14,39 @@ An instance of MSBuild, the Microsoft Build Engine, created a thread in another
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Sysmon Only
+*Tags*: 
 
-*Version*: 101 (<<process-injection-by-the-microsoft-build-engine-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-The Build Engine is commonly used by Windows developers but use by non-engineers is unusual.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process.name:MSBuild.exe and event.action:"CreateRemoteThread detected
-(rule: CreateRemoteThread)"
+[source, js]
 ----------------------------------
+process.name:MSBuild.exe and host.os.type:windows and event.action:"CreateRemoteThread detected (rule: CreateRemoteThread)"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,8 +58,6 @@ process.name:MSBuild.exe and event.action:"CreateRemoteThread detected
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -74,28 +66,3 @@ process.name:MSBuild.exe and event.action:"CreateRemoteThread detected
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[process-injection-by-the-microsoft-build-engine-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/process-injection-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-injection-detected-elastic-endgame.asciidoc
index 01caece0c5..31a7518e3d 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-injection-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-injection-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in th
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,37 @@ Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in th
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<process-injection-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and
-(event.action:kernel_shellcode_event or
-endgame.event_subtype_full:kernel_shellcode_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,35 +55,3 @@ endgame.event_subtype_full:kernel_shellcode_event)
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[process-injection-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Process Injection - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Process Injection - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Process Injection - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:kernel_shellcode_event and
-endgame.metadata.type:detection
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/process-injection-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-injection-prevented-elastic-endgame.asciidoc
index e425e4a10a..6fefaa15c7 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-injection-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-injection-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented Process Injection. Click the Elastic Endgame icon in t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,41 +13,37 @@ Elastic Endgame prevented Process Injection. Click the Elastic Endgame icon in t
 
 *Risk score*: 47
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<process-injection-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and
-(event.action:kernel_shellcode_event or
-endgame.event_subtype_full:kernel_shellcode_event)
+[source, js]
 ----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:kernel_shellcode_event or endgame.event_subtype_full:kernel_shellcode_event)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,35 +55,3 @@ endgame.event_subtype_full:kernel_shellcode_event)
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[process-injection-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.0.0 release)::
-* Formatting only
-
-Version 6 (7.12.1 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Rule name changed from: Process Injection - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Process Injection - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Process Injection - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:kernel_shellcode_event and
-endgame.metadata.type:prevention
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc
index 3a16e581e0..6bfa94167d 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc
@@ -5,54 +5,50 @@ Identifies a new process starting from a process ID (PID), lock or reboot file w
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/
 * https://twitter.com/GossiTheDog/status/1522964028284411907
 * https://exatrack.com/public/Tricephalic_Hellkeeper.pdf
 * https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* BPFDoor
-
-*Version*: 101 (<<process-started-from-process-id-pid-file-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Threat: BPFDoor
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-False-Positives (FP) should be at a minimum with this detection as PID files are meant to hold process IDs, not inherently be executables that spawn processes.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -63,17 +59,15 @@ Detection alerts from this rule indicate a process spawned from an executable ma
 - Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and user.id == "0" and
-process.executable regex~ """/var/run/\w+\.(pid|lock|reboot)"""
+[source, js]
 ----------------------------------
+process where host.os.type == "linux" and event.type == "start" and user.id == "0" and
+  process.executable regex~ """/var/run/\w+\.(pid|lock|reboot)"""
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -85,16 +79,3 @@ process.executable regex~ """/var/run/\w+\.(pid|lock|reboot)"""
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[process-started-from-process-id-pid-file-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
index 5bbbe2cc9a..c03fe61a73 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
@@ -14,50 +14,107 @@ Identifies a process termination event quickly followed by the deletion of its e
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
+*References*: None
+
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 105
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
 
-*Version*: 101 (<<process-termination-followed-by-deletion-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.11.0
 
-*Last modified ({stack} release)*: 8.6.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Process Termination followed by Deletion
+
+This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately, as programs that exhibit this behavior, such as installers and similar utilities, should be signed. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type ==
-"end" and process.code_signature.trusted != true and not
-process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe",
-"C:\\Windows\\WinSxS\\*.exe") ] by process.executable [file
-where event.type == "deletion" and file.extension : ("exe", "scr",
-"com") and not process.executable : ("?:\\Program
-Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\drvinst.exe") and not file.path :
-("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") ] by
-file.path
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=5s
+   [process where host.os.type == "windows" and event.type == "end" and
+    process.code_signature.trusted != true and
+    not process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe", "C:\\Windows\\WinSxS\\*.exe")
+   ] by process.executable
+   [file where host.os.type == "windows" and event.type == "deletion" and file.extension : ("exe", "scr", "com") and
+    not process.executable :
+             ("?:\\Program Files\\*.exe",
+              "?:\\Program Files (x86)\\*.exe",
+              "?:\\Windows\\System32\\svchost.exe",
+              "?:\\Windows\\System32\\drvinst.exe") and
+    not file.path : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")
+   ] by file.path
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,65 +123,10 @@ file.path
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[process-termination-followed-by-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type ==
-"end" and process.code_signature.trusted == false and not
-process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe",
-"C:\\Windows\\WinSxS\\*.exe") ] by process.executable [file
-where event.type == "deletion" and file.extension : ("exe", "scr",
-"com") and not process.executable : ("?:\\Program
-Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\drvinst.exe") and not file.path :
-("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") ] by
-file.path
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type ==
-"end" and process.code_signature.trusted == false and not
-process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe",
-"C:\\Windows\\WinSxS\\*.exe") ] by process.executable [file
-where event.type == "deletion" and file.extension : ("exe", "scr",
-"com") and not process.executable : ("?:\\Program
-Files\\*.exe", "?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\drvinst.exe") and not file.path :
-("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") ] by
-file.path
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type ==
-"end" and process.code_signature.trusted == false and not
-process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe",
-"C:\\Windows\\WinSxS\\*.exe") ] by process.executable [file
-where event.type == "deletion" and file.extension : ("exe", "scr",
-"com")] by file.path
-----------------------------------
-
-Version 3 (7.16.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
index ed8964b57f..104cb4a5cd 100644
--- a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
@@ -5,7 +5,7 @@ Identifies execution from a directory masquerading as the Windows Program Files
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,52 +16,49 @@ Identifies execution from a directory masquerading as the Windows Program Files
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<program-files-directory-masquerading-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.executable :
-"C:\\*Program*Files*\\*.exe" and not process.executable :
-("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe",
-"C:\\Users\\*.exe", "C:\\ProgramData\\*.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : "C:\\*Program*Files*\\*.exe" and
+ not process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe", "C:\\Users\\*.exe", "C:\\ProgramData\\*.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,43 +70,7 @@ process where event.type == "start" and process.executable :
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[program-files-directory-masquerading-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-/* capture both fake program files directory in process executable as
-well as if passed in process args as a dll*/ process.args :
-("C:\\*Program*Files*\\*", "C:\\*Program*Files*\\*") and not
-process.args : ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc b/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
index c7cda5ea6f..18d5379a16 100644
--- a/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of osascript to execute scripts via standard input that may p
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,50 @@ Identifies the use of osascript to execute scripts via standard input that may p
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py
 * https://ss64.com/osx/osascript.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<prompt-for-credentials-with-osascript-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "osascript" and process.command_line :
-"osascript*display dialog*password*"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
+ process.command_line : "osascript*display dialog*password*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,29 +69,7 @@ process.name : "osascript" and process.command_line :
 ** Name: Input Capture
 ** ID: T1056
 ** Reference URL: https://attack.mitre.org/techniques/T1056/
-
-[[prompt-for-credentials-with-osascript-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name:"osascript" and process.args:"-e" and
-process.args:"password"
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: GUI Input Capture
+** ID: T1056.002
+** Reference URL: https://attack.mitre.org/techniques/T1056/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc
index b55fa21ea2..55b449fa29 100644
--- a/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the SysInternals tool PsExec.exe making a network connection.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,106 +15,90 @@ Identifies use of the SysInternals tool PsExec.exe making a network connection.
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<psexec-network-connection-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating PsExec Network Connection
 
-PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges
-on Windows systems. Microsoft develops it as part of the Sysinternals Suite. Although commonly used by administrators,
-PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and
-bypass security protections.
+PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. Microsoft develops it as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
 
-This rule identifies PsExec execution by looking for the creation of `PsExec.exe`, the default name for the
-utility, followed by a network connection done by the process.
+This rule identifies PsExec execution by looking for the creation of `PsExec.exe`, the default name for the utility, followed by a network connection done by the process.
 
 #### Possible investigation steps
 
 - Check if the usage of this tool complies with the organization's administration policy.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Identify the target computer and its role in the IT environment.
-- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for
-similar occurrences across hosts.
+- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the
-user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
+- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-  - Prioritize accordingly with the role of the servers and users involved.
+  - Prioritize cases involving critical servers and users.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"PsExec.exe" and event.type == "start" and /* This flag suppresses
-the display of the license dialog and may indicate that psexec
-executed for the first time in the machine */ process.args :
-"-accepteula" and not process.executable : ("?:\\ProgramData\\Docu
-snap\\Discovery\\discovery\\plugins\\17\\Bin\\psexec.exe",
-"?:\\Docusnap 11\\Bin\\psexec.exe",
-"?:\\Program Files\\Docusnap X\\Bin\\psexec.exe",
-"?:\\Program Files\\Docusnap X\\Tools\\dsDNS.exe") and not
-process.parent.executable : "?:\\Program Files (x86)\\Cynet\\Cynet
-Scanner\\CynetScanner.exe"] [network where process.name :
-"PsExec.exe"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and process.name : "PsExec.exe" and event.type == "start" and
+
+   /* This flag suppresses the display of the license dialog and may
+      indicate that psexec executed for the first time in the machine */
+   process.args : "-accepteula" and
 
-==== Threat mapping
+   not process.executable : ("?:\\ProgramData\\Docusnap\\Discovery\\discovery\\plugins\\17\\Bin\\psexec.exe",
+                             "?:\\Docusnap 11\\Bin\\psexec.exe",
+                             "?:\\Program Files\\Docusnap X\\Bin\\psexec.exe",
+                             "?:\\Program Files\\Docusnap X\\Tools\\dsDNS.exe") and
+   not process.parent.executable : "?:\\Program Files (x86)\\Cynet\\Cynet Scanner\\CynetScanner.exe"]
+  [network where host.os.type == "windows" and process.name : "PsExec.exe"]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -126,65 +110,11 @@ Scanner\\CynetScanner.exe"] [network where process.name :
 ** Name: System Services
 ** ID: T1569
 ** Reference URL: https://attack.mitre.org/techniques/T1569/
-
-
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
 ** Reference URL: https://attack.mitre.org/tactics/TA0008/
-
-[[psexec-network-connection-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"PsExec.exe" and event.type == "start"] [network where process.name
-: "PsExec.exe"]
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:PsExec.exe
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:PsExec.exe and event.action:"Network connection detected
-(rule: NetworkConnect)"
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:PsExec.exe and event.action:"Network connection detected
-(rule: NetworkConnect)"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc
new file mode 100644
index 0000000000..c2a8edb03d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc
@@ -0,0 +1,78 @@
+[[python-script-execution-via-command-line]]
+=== Python Script Execution via Command Line
+
+Identifies when a Python script is executed using command line input and imports the sys module. Attackers often use this method to execute malicious scripts and avoiding writing it to disk.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type in ("start", "process_started") and
+ process.name : "python*" and process.args : "-c" and process.args : "*import*sys*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Python
+** ID: T1059.006
+** Reference URL: https://attack.mitre.org/techniques/T1059/006/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/ransomware-detected-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/ransomware-detected-elastic-endgame.asciidoc
index d3d39402bd..b0ae88f2d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/ransomware-detected-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ransomware-detected-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame detected ransomware. Click the Elastic Endgame icon in the event
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,65 +13,32 @@ Elastic Endgame detected ransomware. Click the Elastic Endgame icon in the event
 
 *Risk score*: 99
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 100 (<<ransomware-detected-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:detection and (event.action:ransomware_event or
-endgame.event_subtype_full:ransomware_event)
-----------------------------------
-
-
-[[ransomware-detected-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
 
-Version 8 (8.0.0 release)::
-* Formatting only
+==== Rule query
 
-Version 6 (7.12.1 release)::
-* Formatting only
 
-Version 5 (7.12.0 release)::
-* Rule name changed from: Ransomware - Detected - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Ransomware - Detected - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Ransomware - Detected - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:ransomware_event and endgame.metadata.type:detection
-----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/ransomware-prevented-elastic-endgame.asciidoc b/docs/detections/prebuilt-rules/rule-details/ransomware-prevented-elastic-endgame.asciidoc
index 483fa6bb1b..277d60ad01 100644
--- a/docs/detections/prebuilt-rules/rule-details/ransomware-prevented-elastic-endgame.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ransomware-prevented-elastic-endgame.asciidoc
@@ -5,7 +5,7 @@ Elastic Endgame prevented ransomware. Click the Elastic Endgame icon in the even
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * endgame-*
 
@@ -13,65 +13,32 @@ Elastic Endgame prevented ransomware. Click the Elastic Endgame icon in the even
 
 *Risk score*: 73
 
-*Runs every*: 10 minutes
+*Runs every*: 10m
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 10000
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 100 (<<ransomware-prevented-elastic-endgame-history, version history>>)
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:alert and event.module:endgame and
-endgame.metadata.type:prevention and (event.action:ransomware_event or
-endgame.event_subtype_full:ransomware_event)
-----------------------------------
-
-
-[[ransomware-prevented-elastic-endgame-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
 
-Version 8 (8.0.0 release)::
-* Formatting only
+==== Rule query
 
-Version 6 (7.12.1 release)::
-* Formatting only
 
-Version 5 (7.12.0 release)::
-* Rule name changed from: Ransomware - Prevented - Endpoint Security
-Version 4 (7.10.0 release)::
-* Rule name changed from: Ransomware - Prevented - Elastic Endpoint Security
-Version 3 (7.9.0 release)::
-* Rule name changed from: Ransomware - Prevented - Elastic Endpoint
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.kind:alert and event.module:endgame and
-event.action:ransomware_event and endgame.metadata.type:prevention
-----------------------------------
+event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:ransomware_event or endgame.event_subtype_full:ransomware_event)
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc b/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc
index 33f1bd465a..7f9312a3f5 100644
--- a/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc
@@ -5,92 +5,73 @@ A machine learning job detected an unusual error in a CloudTrail message. These
 
 *Rule type*: machine_learning
 
-*Machine learning job*: rare_error_code
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* ML
-* Investigation Guide
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Resources: Investigation Guide
 
-*Version*: 102 (<<rare-aws-error-code-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 7.9.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Rare and unusual errors may indicate an impending service failure state. Rare and unusual user error activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to IAM privileges.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Rare AWS Error Code
 
-CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and
-understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity
-when deviations occur.
+CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
-This rule uses a machine learning job to detect an unusual error in a CloudTrail message. This can be byproducts of
-attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.
+This rule uses a machine learning job to detect an unusual error in a CloudTrail message. This can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.
 
-Detection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS
-API command or method call.
+Detection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call.
 
 #### Possible investigation steps
 
-- Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an
-automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.
+- Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Validate the activity is not related to planned patches, updates, or network administrator activity.
-- Examine the request parameters. These may indicate the source of the program or the nature of the task being performed
-when the error occurred.
+- Examine the request parameters. These may indicate the source of the program or the nature of the task being performed when the error occurred.
     - Check whether the error is related to unsuccessful attempts to enumerate or access objects, data, or secrets.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal
-time of day?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- Examine the history of the command. If the command only manifested recently, it might be part of a new automation
-module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence),
-it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
+- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 - The adoption of new services or the addition of new functionality to scripts may generate false positives.
 
 ### Related Rules
@@ -110,47 +91,12 @@ it might be part of a housekeeping or maintenance process. You can find the comm
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-
-
-[[rare-aws-error-code-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.16.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc b/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc
index 949e8cdf0c..606995822d 100644
--- a/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc
@@ -5,47 +5,69 @@ A machine learning job found an unusual user name in the authentication logs. An
 
 *Rule type*: machine_learning
 
-*Machine learning job*: auth_rare_user
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 103
+
+*Rule authors*: 
 
 * Elastic
-* Authentication
-* Threat Detection
-* ML
-* Initial Access
 
-*Version*: 100 (<<rare-user-logon-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.14.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Rare User Logon
+
+This rule uses a machine learning job to detect an unusual user name in authentication logs, which could detect new accounts created for persistence.
+
+#### Possible investigation steps
 
-==== Potential false positives
+- Check if the user was newly created and if the company policies were followed.
+  - Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the involved users during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-User accounts that are rarely active, such as a site reliability engineer (SRE) or developer logging into a production server for troubleshooting, may trigger this alert. Under some conditions, a newly created user account may briefly trigger this alert while the model is learning.
-==== Threat mapping
+### False positive analysis
+
+- Accounts that are used for specific purposes — and therefore not normally active — may trigger the alert.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,19 +79,11 @@ User accounts that are rarely active, such as a site reliability engineer (SRE)
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[rare-user-logon-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Domain Accounts
+** ID: T1078.002
+** Reference URL: https://attack.mitre.org/techniques/T1078/002/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
index 05a786c1e2..0849943cfd 100644
--- a/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
@@ -5,65 +5,63 @@ Identifies registry write modifications to enable Remote Desktop Protocol (RDP)
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<rdp-enabled-via-registry-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating RDP Enabled via Registry
 
-Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other
-computers, typically over TCP port 3389.
+Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.
 
-Attackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access
-victim servers, often using privileged accounts.
+Attackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.
 
-This rule detects modification of the fDenyTSConnections registry key to the value `0`, which specifies that remote
-desktop connections are enabled. Attackers can abuse remote registry, use psexec, etc., to enable RDP and move laterally.
+This rule detects modification of the fDenyTSConnections registry key to the value `0`, which specifies that remote desktop connections are enabled. Attackers can abuse remote registry, use psexec, etc., to enable RDP and move laterally.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user to check if they are aware of the operation.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check whether it makes sense to enable RDP to this host, given its role in the environment.
 - Check if the host is directly exposed to the internet.
@@ -72,8 +70,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Check whether the user should be performing this kind of activity, whether
-they are aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
+- This mechanism can be used legitimately. Check whether the user should be performing this kind of activity, whether they are aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
 
 ### Response and remediation
 
@@ -84,25 +81,26 @@ they are aware of it, whether RDP should be open, and whether the action exposes
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Control\\Terminal
-Server\\fDenyTSConnections" and registry.data.strings : ("0",
-"0x00000000") and not (process.name : "svchost.exe" and user.domain ==
-"NT AUTHORITY") and not process.executable :
-"C:\\Windows\\System32\\SystemPropertiesRemote.exe"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and 
+ event.type in ("creation", "change") and
+  registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Control\\Terminal Server\\fDenyTSConnections" and
+  registry.data.strings : ("0", "0x00000000") and
+  not process.executable : ("?:\\Windows\\System32\\SystemPropertiesRemote.exe", 
+                            "?:\\Windows\\System32\\SystemPropertiesComputerName.exe", 
+                            "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe", 
+                            "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe", 
+                            "?:\\Windows\\WinSxS\\*\\TiWorker.exe", 
+                            "?:\\Windows\\system32\\svchost.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -114,44 +112,7 @@ Server\\fDenyTSConnections" and registry.data.strings : ("0",
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[rdp-enabled-via-registry-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal
-Server\\fDenyTSConnections" and registry.data.strings == "0" and not
-(process.name : "svchost.exe" and user.domain == "NT AUTHORITY") and
-not process.executable :
-"C:\\Windows\\System32\\SystemPropertiesRemote.exe"
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/rdp-remote-desktop-protocol-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/rdp-remote-desktop-protocol-from-the-internet.asciidoc
index d46854d65f..9b44500232 100644
--- a/docs/detections/prebuilt-rules/rule-details/rdp-remote-desktop-protocol-from-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rdp-remote-desktop-protocol-from-the-internet.asciidoc
@@ -5,70 +5,82 @@ This rule detects network events that may indicate the use of RDP traffic from t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<rdp-remote-desktop-protocol-from-the-internet-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:3389 or event.dataset:zeek.rdp) and not
-source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.0.0.0/24 or 192.0.0.0/29 or
-192.0.0.8/32 or 192.0.0.9/32 or 192.0.0.10/32 or
-192.0.0.170/32 or 192.0.0.171/32 or 192.0.2.0/24 or
-192.31.196.0/24 or 192.52.193.0/24 or 192.168.0.0/16 or
-192.88.99.0/24 or 224.0.0.0/4 or 100.64.0.0/10 or
-192.175.48.0/24 or 198.18.0.0/15 or 198.51.100.0/24 or
-203.0.113.0/24 or 240.0.0.0/4 or "::1" or "FE80::/10" or
-"FF00::/8" ) and destination.ip:( 10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16 )
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,8 +88,6 @@ source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
 ** Name: Command and Control
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
-
-
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -86,8 +96,6 @@ source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -96,81 +104,3 @@ source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[rdp-remote-desktop-protocol-from-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 15 (8.4.0 release)::
-* Formatting only
-
-Version 14 (8.3.0 release)::
-* Formatting only
-
-Version 12 (8.2.0 release)::
-* Formatting only
-
-Version 11 (7.15.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:3389 or event.dataset:zeek.rdp) and not
-source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or "::1" or "FE80::/10"
-or "FF00::/8" ) and destination.ip:( 10.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 )
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:3389 or event.dataset:zeek.rdp) and not
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port:3389 and not
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 3 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport: tcp and destination.port: 3389 and (
-network.direction: inbound or ( not source.ip: (10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16) and destination.ip: (10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16) ) )
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
index 728ad44633..e8a8921d05 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
@@ -5,60 +5,63 @@ Detects attempts to maintain persistence by creating registry keys using AppCert
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<registry-persistence-via-appcert-dll-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where /* uncomment once stable length(bytes_written_string) >
-0 and */ registry.path :
-"HKLM\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+/* uncomment once stable length(bytes_written_string) > 0 and */
+  registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,32 +73,7 @@ registry where /* uncomment once stable length(bytes_written_string) >
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[registry-persistence-via-appcert-dll-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where /* uncomment once stable length(bytes_written_string) >
-0 and */ registry.path :
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: AppCert DLLs
+** ID: T1546.009
+** Reference URL: https://attack.mitre.org/techniques/T1546/009/
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index 4618f979af..a3b582ad70 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -1,7 +1,7 @@
 [[registry-persistence-via-appinit-dll]]
 === Registry Persistence via AppInit DLL
 
-Attackers may maintain persistence by creating registry keys using AppInit DLLs. AppInit DLLs are loaded by every process using the common library, user32.dll.
+AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.
 
 *Rule type*: eql
 
@@ -10,60 +10,115 @@ Attackers may maintain persistence by creating registry keys using AppInit DLLs.
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*:
 
-*Version*: 100 (<<registry-persistence-via-appinit-dll-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Registry Persistence via AppInit DLL
+
+AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads `user32.dll`) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications.
+
+Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.
+
+This rule identifies modifications on the AppInit registry keys.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Review the source process and related DLL file tied to the Windows Registry entry.
+  - Check whether the DLL is signed, and tied to a authorized program used on your environment.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Retrieve all DLLs under the AppInit registry keys:
+  - !{osquery{"label":"Osquery - Retrieve AppInit Registry Value","query":"SELECT * FROM registry r where (r.key == 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows' or\nr.key == 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows') and r.name ==\n'AppInit_DLLs'\n"}}
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable and the DLLs using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path : ("HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\AppInit_Dlls",
-"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\AppInit_Dlls") and not
-process.executable : ("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe",
-"C:\\Program Files\\Commvault\\ContentStore*\\Base\\cvd.exe",
-"C:\\Program Files (x86)\\Commvault\\ContentStore*\\Base\\cvd.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+   registry.path : (
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
+      "HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls"
+   ) and not process.executable : (
+      "C:\\Windows\\System32\\msiexec.exe",
+      "C:\\Windows\\SysWOW64\\msiexec.exe",
+      "C:\\Program Files\\Commvault\\ContentStore*\\Base\\cvd.exe",
+      "C:\\Program Files (x86)\\Commvault\\ContentStore*\\Base\\cvd.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,34 +130,7 @@ process.executable : ("C:\\Windows\\System32\\msiexec.exe",
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[registry-persistence-via-appinit-dll-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path : ("HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\AppInit_Dlls",
-"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\AppInit_Dlls") and not
-process.executable : ("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe",
-"C:\\Program Files\\Commvault\\ContentStore*\\Base\\cvd.exe",
-"C:\\Program Files (x86)\\Commvault\\ContentStore*\\Base\\cvd.exe")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: AppInit DLLs
+** ID: T1546.010
+** Reference URL: https://attack.mitre.org/techniques/T1546/010/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-computer-account-dnshostname-update.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-computer-account-dnshostname-update.asciidoc
index f35dc1fa02..208c4113e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-computer-account-dnshostname-update.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-computer-account-dnshostname-update.asciidoc
@@ -5,67 +5,68 @@ Identifies the remote update to a computer account's DnsHostName attribute. If t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4
 * https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Active Directory
-
-*Version*: 101 (<<remote-computer-account-dnshostname-update-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where
-event.action == "logged-in" and winlog.logon.type == "Network" and
-event.outcome == "success" and not user.name == "ANONYMOUS LOGON"
-and not winlog.event_data.SubjectUserName : "*$" and not
-user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1" and
-source.ip !="::1"] by winlog.event_data.TargetLogonId [iam where
-event.action == "changed-computer-account" and /* if DnsHostName
-value equal a DC DNS hostname then it's highly suspicious */
-winlog.event_data.DnsHostName : "??*" and /* exclude FPs
-where DnsHostName starts with the ComputerName that was changed */
-not startswith~(winlog.event_data.DnsHostName,
-substring(winlog.event_data.TargetUserName, 0,
-length(winlog.event_data.TargetUserName) - 1)) ] by
-winlog.event_data.SubjectLogonId
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name with maxspan=5m
+
+  [authentication where event.action == "logged-in" and
+   winlog.logon.type == "Network" and event.outcome == "success" and
+   not user.name == "ANONYMOUS LOGON" and not winlog.event_data.SubjectUserName : "*$" and
+   not user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1" and source.ip !="::1"] by winlog.event_data.TargetLogonId
+
+  [iam where event.action == "changed-computer-account" and
+
+    /* if DnsHostName value equal a DC DNS hostname then it's highly suspicious */
+    winlog.event_data.DnsHostName : "??*" and
+
+    /* exclude FPs where DnsHostName starts with the ComputerName that was changed */
+    not startswith~(winlog.event_data.DnsHostName, substring(winlog.event_data.TargetUserName, 0, length(winlog.event_data.TargetUserName) - 1))
+    ] by winlog.event_data.SubjectLogonId
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,30 +78,11 @@ winlog.event_data.SubjectLogonId
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[remote-computer-account-dnshostname-update-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where
-event.action == "logged-in" and winlog.logon.type == "Network" and
-event.outcome == "success" and not user.name == "ANONYMOUS LOGON"
-and not winlog.event_data.SubjectUserName : "*$" and not
-user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1" and
-source.ip !="::1"] by winlog.event_data.TargetLogonId [iam where
-event.action == "changed-computer-account" and /* if DnsHostName
-value equal a DC DNS hostname then it's highly suspicious */
-winlog.event_data.DnsHostName : "??*"] by
-winlog.event_data.SubjectLogonId
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Domain Accounts
+** ID: T1078.002
+** Reference URL: https://attack.mitre.org/techniques/T1078/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
index 4169659ef0..cec530a71d 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
@@ -5,7 +5,7 @@ Identifies use of the network shell utility (netsh.exe) to enable inbound Remote
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,52 @@ Identifies use of the network shell utility (netsh.exe) to enable inbound Remote
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<remote-desktop-enabled-in-windows-firewall-by-netsh-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote Desktop Enabled in Windows Firewall by Netsh
 
-Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other
-computers, typically over TCP port 3389.
+Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.
 
-Attackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access
-victim servers, often using privileged accounts.
+Attackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.
 
-This rule detects the creation of a Windows Firewall inbound rule that would allow inbound RDP traffic using the
-`netsh.exe` utility.
+This rule detects the creation of a Windows Firewall inbound rule that would allow inbound RDP traffic using the `netsh.exe` utility.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user to check if they are aware of the operation.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check whether it makes sense to enable RDP to this host, given its role in the environment.
 - Check if the host is directly exposed to the internet.
@@ -74,8 +70,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- The `netsh.exe` utility can be used legitimately. Check whether the user should be performing this kind of activity, whether the user is aware
-of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
+- The `netsh.exe` utility can be used legitimately. Check whether the user should be performing this kind of activity, whether the user is aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
 
 ### Response and remediation
 
@@ -86,23 +81,20 @@ of it, whether RDP should be open, and whether the action exposes the environmen
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "netsh.exe"
-or process.pe.original_file_name == "netsh.exe") and process.args :
-("localport=3389", "RemoteDesktop", "group=\"remote desktop\"") and
-process.args : ("action=allow", "enable=Yes", "enable")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "netsh.exe" or process.pe.original_file_name == "netsh.exe") and
+ process.args : ("localport=3389", "RemoteDesktop", "group=\"remote desktop\"") and
+ process.args : ("action=allow", "enable=Yes", "enable")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -114,39 +106,7 @@ process.args : ("action=allow", "enable=Yes", "enable")
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[remote-desktop-enabled-in-windows-firewall-by-netsh-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "netsh.exe" or process.pe.original_file_name ==
-"netsh.exe") and process.args : ("localport=3389", "RemoteDesktop",
-"group=\"remote desktop\"") and process.args : ("action=allow",
-"enable=Yes", "enable")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Rule name changed from: Remote Desktop Enabled in Windows Firewall
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index 2d4c168833..a269b31299 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -10,12 +10,13 @@ Identifies the execution of a file that was created by the virtual system proces
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,60 +28,55 @@ Identifies the execution of a file that was created by the virtual system proces
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
-
-*Version*: 102 (<<remote-execution-via-file-shares-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote Execution via File Shares
 
-Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These
-tools can include discovery utilities, credential dumpers, malware, etc.
+Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Review adjacent login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -94,31 +90,25 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - Review the privileges needed to write to the network share and restrict write access as needed.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=1m [file where event.type in ("creation",
-"change") and process.pid == 4 and file.extension : "exe"] by host.id,
-file.path [process where event.type == "start"] by host.id,
-process.executable
+[source, js]
 ----------------------------------
+sequence with maxspan=1m
+  [file where host.os.type == "windows" and event.type in ("creation", "change") and process.pid == 4 and file.extension : "exe"] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -130,27 +120,7 @@ process.executable
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[remote-execution-via-file-shares-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1m [file where event.type in ("creation",
-"change") and process.pid == 4 and file.extension : "exe"] by host.id,
-file.path [process where event.type in ("start", "process_started")]
-by host.id, process.executable
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
index dfab4375eb..d865b62c4f 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
@@ -5,60 +5,60 @@ Identifies a remote file copy attempt to a hidden network share. This may indica
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
+*Tags*: 
 
-*Version*: 101 (<<remote-file-copy-to-a-hidden-share-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : ("cmd.exe",
-"powershell.exe", "robocopy.exe", "xcopy.exe") and process.args :
-("copy*", "move*", "cp", "mv") and process.args : "*$*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("cmd.exe", "powershell.exe", "robocopy.exe", "xcopy.exe") and
+  process.args : ("copy*", "move*", "cp", "mv") and process.args : "*$*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,38 +70,7 @@ process where event.type == "start" and process.name : ("cmd.exe",
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[remote-file-copy-to-a-hidden-share-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("cmd.exe", "powershell.exe", "robocopy.exe",
-"xcopy.exe") and process.args : ("copy*", "move*", "cp", "mv") and
-process.args : "*$*"
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("cmd.exe", "powershell.exe", "robocopy.exe",
-"xcopy.exe") and process.args : ("copy*", "move*", "cp", "mv") and
-process.args : "*$*"
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index bed026b7db..898c186615 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -16,7 +16,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -28,72 +28,62 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<remote-file-copy-via-teamviewer-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote File Copy via TeamViewer
 
-Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command
-and control channel. However, they can also abuse legitimate utilities to drop these files.
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse legitimate utilities to drop these files.
 
-TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various
-support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other
-malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
+TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Contact the user to gather information about who and why was conducting the remote access.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Check whether the company uses TeamViewer for the support activities and if there is a support ticket related to this
-access.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Check whether the company uses TeamViewer for the support activities and if there is a support ticket related to this access.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct
-remote access and the triage has not identified suspicious or malicious files.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct remote access and the triage has not identified suspicious or malicious files.
 
 ### Response and remediation
 
@@ -103,30 +93,22 @@ remote access and the triage has not identified suspicious or malicious files.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "creation" and process.name :
-"TeamViewer.exe" and file.extension : ("exe", "dll", "scr", "com",
-"bat", "ps1", "vbs", "vbe", "js", "wsh", "hta")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and process.name : "TeamViewer.exe" and
+  file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -138,41 +120,7 @@ file where event.type == "creation" and process.name :
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[remote-file-copy-via-teamviewer-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:creation and
-process.name:TeamViewer.exe and file.extension:(exe or dll or scr or
-com or bat or ps1 or vbs or vbe or js or wsh or hta)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index 0a1089fc9b..a66aa79493 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -16,7 +16,7 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -28,73 +28,64 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<remote-file-download-via-desktopimgdownldr-utility-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote File Download via Desktopimgdownldr Utility
 
-Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command
-and control channel. However, they can also abuse signed utilities to drop these files.
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
 
-The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the
-`lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
+The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Check the reputation of the domain or IP address used to host the downloaded file or if the user downloaded the file
-from an internal system.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Check the reputation of the domain or IP address used to host the downloaded file or if the user downloaded the file from an internal system.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions
-if necessary.
+- This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions if necessary.
 - Analysts can dismiss the alert if the downloaded file is a legitimate image.
 
 ### Response and remediation
@@ -105,31 +96,24 @@ if necessary.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"desktopimgdownldr.exe" or process.pe.original_file_name ==
-"desktopimgdownldr.exe") and process.args : "/lockscreenurl:http*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "desktopimgdownldr.exe" or process.pe.original_file_name == "desktopimgdownldr.exe") and
+  process.args : "/lockscreenurl:http*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -141,59 +125,3 @@ process where event.type == "start" and (process.name :
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[remote-file-download-via-desktopimgdownldr-utility-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "desktopimgdownldr.exe" or
-process.pe.original_file_name == "desktopimgdownldr.exe") and
-process.args : "/lockscreenurl:http*"
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:desktopimgdownldr.exe or
-process.pe.original_file_name:desktopimgdownldr.exe) and
-process.args:/lockscreenurl\:http*
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:desktopimgdownldr.exe or
-process.pe.original_file_name:desktopimgdownldr.exe or
-winlog.event_data.OriginalFileName:desktopimgdownldr.exe) and
-process.args:/lockscreenurl\:http*
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index 92ba19b86c..db61e70f33 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -16,7 +16,7 @@ Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -29,67 +29,59 @@ Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<remote-file-download-via-mpcmdrun-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote File Download via MpCmdRun
 
-Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command
-and control channel. However, they can also abuse signed utilities to drop these files.
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
 
-The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows
-Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files,
-including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
+The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check the reputation of the domain or IP address used to host the downloaded file.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -103,32 +95,24 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"MpCmdRun.exe" or process.pe.original_file_name == "MpCmdRun.exe") and
-process.args : "-DownloadFile" and process.args : "-url" and
-process.args : "-path"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "MpCmdRun.exe" or process.pe.original_file_name == "MpCmdRun.exe") and
+   process.args : "-DownloadFile" and process.args : "-url" and process.args : "-path"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -140,53 +124,3 @@ process.args : "-path"
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[remote-file-download-via-mpcmdrun-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:MpCmdRun.exe or
-process.pe.original_file_name:MpCmdRun.exe) and
-process.args:(("-DownloadFile" or "-downloadfile") and "-url" and
-"-path")
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.name:MpCmdRun.exe or
-process.pe.original_file_name:MpCmdRun.exe or
-winlog.event_data.OriginalFileName:MpCmdRun.exe) and
-process.args:(("-DownloadFile" or "-downloadfile") and "-url" and
-"-path")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index 77f28c529d..cb9823923e 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -15,80 +15,72 @@ Identifies powershell.exe being used to download an executable file from an untr
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<remote-file-download-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote File Download via PowerShell
 
-Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command
-and control channel. However, they can also abuse signed utilities to drop these files.
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
 
-PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it
-available for use in various environments and creates an attractive way for attackers to execute code and perform
-actions. This rule correlates network and file events to detect downloads of executable and script files performed using
-PowerShell.
+PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check the reputation of the domain or IP address used to host the downloaded file.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- Administrators can use PowerShell legitimately to download executable and script files. Analysts can dismiss the alert
-if the Administrator is aware of the activity and the triage has not identified suspicious or malicious files.
+- Administrators can use PowerShell legitimately to download executable and script files. Analysts can dismiss the alert if the Administrator is aware of the activity and the triage has not identified suspicious or malicious files.
 
 ### Response and remediation
 
@@ -98,38 +90,28 @@ if the Administrator is aware of the activity and the triage has not identified
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=30s [network
-where process.name : ("powershell.exe", "pwsh.exe",
-"powershell_ise.exe") and network.protocol == "dns" and not
-dns.question.name : ("localhost", "*.microsoft.com",
-"*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com",
-"metadata.google.internal") and not user.domain : "NT AUTHORITY"]
-[file where process.name : "powershell.exe" and event.type ==
-"creation" and file.extension : ("exe", "dll", "ps1", "bat") and
-not file.name : "__PSScriptPolicy*.ps1"]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id with maxspan=30s
+  [network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and network.protocol == "dns" and
+   not dns.question.name : ("localhost", "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com", "metadata.google.internal") and
+   not user.domain : "NT AUTHORITY"]
+    [file where host.os.type == "windows" and process.name : "powershell.exe" and event.type == "creation" and file.extension : ("exe", "dll", "ps1", "bat") and
+   not file.name : "__PSScriptPolicy*.ps1"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -141,8 +123,6 @@ not file.name : "__PSScriptPolicy*.ps1"]
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -151,53 +131,7 @@ not file.name : "__PSScriptPolicy*.ps1"]
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[remote-file-download-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=30s [network
-where process.name : ("powershell.exe", "pwsh.exe",
-"powershell_ise.exe") and network.protocol == "dns" and not
-dns.question.name : ("localhost", "*.microsoft.com",
-"*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com",
-"metadata.google.internal") and not user.domain : "NT AUTHORITY"]
-[file where process.name : "powershell.exe" and event.type ==
-"creation" and file.extension : ("exe", "dll", "ps1", "bat") and
-not file.name : "__PSScriptPolicy*.ps1"]
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=30s [network
-where process.name : "powershell.exe" and network.protocol == "dns"
-and not dns.question.name : ("localhost", "*.microsoft.com",
-"*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com",
-"metadata.google.internal") and not user.domain : "NT AUTHORITY"]
-[file where process.name : "powershell.exe" and event.type ==
-"creation" and file.extension : ("exe", "dll", "ps1", "bat") and
-not file.name : "__PSScriptPolicy*.ps1"]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
index f40d1395bb..60fc764a9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
@@ -15,76 +15,70 @@ Identifies built-in Windows script interpreters (cscript.exe or wscript.exe) bei
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<remote-file-download-via-script-interpreter-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote File Download via Script Interpreter
 
-The Windows Script Host (WSH) is a Windows automation technology, which is ideal for non-interactive scripting needs,
-such as logon scripting, administrative scripting, and machine automation.
+The Windows Script Host (WSH) is a Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.
 
-Attackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but
-can also use them to download tools and utilities needed to accomplish their goals.
+Attackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but can also use them to download tools and utilities needed to accomplish their goals.
 
 This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze both the script and the executable involved using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives
-(B-TPs), exceptions can be added.
+- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
 ### Response and remediation
 
@@ -94,34 +88,27 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id [network where process.name :
-("wscript.exe", "cscript.exe") and network.protocol != "dns" and
-network.direction : ("outgoing", "egress") and network.type == "ipv4"
-and destination.ip != "127.0.0.1" ] [file where event.type ==
-"creation" and file.extension : ("exe", "dll")]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id
+  [network where host.os.type == "windows" and process.name : ("wscript.exe", "cscript.exe") and network.protocol != "dns" and
+   network.direction : ("outgoing", "egress") and network.type == "ipv4" and destination.ip != "127.0.0.1"
+  ]
+  [file where host.os.type == "windows" and event.type == "creation" and file.extension : ("exe", "dll")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,37 +120,3 @@ and destination.ip != "127.0.0.1" ] [file where event.type ==
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[remote-file-download-via-script-interpreter-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id [network where process.name :
-("wscript.exe", "cscript.exe") and network.protocol != "dns" and
-network.direction == "outgoing" and network.type == "ipv4" and
-destination.ip != "127.0.0.1" ] [file where event.type ==
-"creation" and file.extension : ("exe", "dll")]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-logon-followed-by-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-logon-followed-by-scheduled-task-creation.asciidoc
index af72d31b37..c0e2518942 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-logon-followed-by-scheduled-task-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-logon-followed-by-scheduled-task-creation.asciidoc
@@ -5,67 +5,60 @@ Identifies a remote logon followed by a scheduled task creation on the target ho
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Version*: 1
+*Version*: 6
 
-*Added ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote Scheduled Task Creation
 
-[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism
-for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at
-the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the
-first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to
-benign behavior such as software installation or any kind of network administrator work. One objective for these alerts
-is to understand the configured action within the scheduled task. This is captured within the registry event data for
-this rule and can be base64 decoded to view the value.
+[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.
 
 #### Possible investigation steps
 
 - Review the TaskContent value to investigate the task configured action.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software
-installations.
-- Further examination should include review of host-based artifacts and network logs from around when the scheduled task
-was created, on both the source and target machines.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Further examination should include review of host-based artifacts and network logs from around when the scheduled task was created, on both the source and target machines.
 
 ### False positive analysis
 
-- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature
-within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to
-further understand the source of the activity and determine the intent based on the scheduled task's contents.
+- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to further understand the source of the activity and determine the intent based on the scheduled task's contents.
 
 ### Related rules
 
@@ -78,28 +71,26 @@ further understand the source of the activity and determine the intent based on
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Remove scheduled task and any other related artifacts.
-- Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further
-restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.
+- Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* Network Logon followed by Scheduled Task creation */ sequence by
-host.id with maxspan=1m [authentication where event.action ==
-"logged-in" and winlog.logon.type == "Network" and event.outcome ==
-"success" and not user.name == "ANONYMOUS LOGON" and not
-winlog.event_data.SubjectUserName : "*$" and not user.domain == "NT
-AUTHORITY" and source.ip != "127.0.0.1" and source.ip !="::1"] by
-winlog.event_data.TargetLogonId [iam where event.action ==
-"scheduled-task-created"] by winlog.event_data.SubjectLogonId
+[source, js]
 ----------------------------------
+/* Network Logon followed by Scheduled Task creation  */
 
-==== Threat mapping
+sequence by winlog.computer_name with maxspan=1m
+  [authentication where event.action == "logged-in" and
+   winlog.logon.type == "Network" and event.outcome == "success" and
+   not user.name == "ANONYMOUS LOGON" and not winlog.event_data.SubjectUserName : "*$" and
+   not user.domain == "NT AUTHORITY" and source.ip != "127.0.0.1" and source.ip !="::1"] by winlog.event_data.TargetLogonId
+
+  [iam where event.action == "scheduled-task-created"] by winlog.event_data.SubjectLogonId
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -111,8 +102,6 @@ winlog.event_data.TargetLogonId [iam where event.action ==
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -121,3 +110,7 @@ winlog.event_data.TargetLogonId [iam where event.action ==
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc
index 8c0678cc44..cea5b91965 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies remote scheduled task creations on a target host. This could be indic
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,61 +15,51 @@ Identifies remote scheduled task creations on a target host. This could be indic
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<remote-scheduled-task-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote Scheduled Task Creation
 
-[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism
-for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at
-the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the
-first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to
-benign behavior such as software installation or any kind of network administrator work. One objective for these alerts
-is to understand the configured action within the scheduled task. This is captured within the registry event data for
-this rule and can be base64 decoded to view the value.
+[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.
 
 #### Possible investigation steps
 
 - Review the base64 encoded tasks actions registry value to investigate the task configured action.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software
-installations.
-- Further examination should include review of host-based artifacts and network logs from around when the scheduled task
-was created, on both the source and target machines.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Further examination should include review of host-based artifacts and network logs from around when the scheduled task was created, on both the source and target machines.
 
 ### False positive analysis
 
-- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature
-within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to
-further understand the source of the activity and determine the intent based on the scheduled task's contents.
+- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to further understand the source of the activity and determine the intent based on the scheduled task's contents.
 
 ### Related rules
 
@@ -81,28 +71,25 @@ further understand the source of the activity and determine the intent based on
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Remove scheduled task and any other related artifacts.
-- Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further
-restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.
+- Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-/* Task Scheduler service incoming connection followed by TaskCache
-registry modification */ sequence by host.id, process.entity_id with
-maxspan = 1m [network where process.name : "svchost.exe" and
-network.direction : ("incoming", "ingress") and source.port >= 49152
-and destination.port >= 49152 and source.ip != "127.0.0.1" and
-source.ip != "::1" ] [registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
+[source, js]
 ----------------------------------
+/* Task Scheduler service incoming connection followed by TaskCache registry modification  */
+
+sequence by host.id, process.entity_id with maxspan = 1m
+   [network where host.os.type == "windows" and process.name : "svchost.exe" and
+   network.direction : ("incoming", "ingress") and source.port >= 49152 and destination.port >= 49152 and
+   source.ip != "127.0.0.1" and source.ip != "::1"
+   ]
+   [registry where host.os.type == "windows" and registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -114,8 +101,6 @@ NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -124,58 +109,7 @@ NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[remote-scheduled-task-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 7 (8.1.0 release)::
-* Formatting only
-
-Version 6 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Task Scheduler service incoming connection followed by TaskCache
-registry modification */ sequence by host.id, process.entity_id with
-maxspan = 1m [network where process.name : "svchost.exe" and
-network.direction : ("incoming", "ingress") and source.port >= 49152
-and destination.port >= 49152 and source.address != "127.0.0.1" and
-source.address != "::1" ] [registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
-----------------------------------
-
-Version 5 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* Task Scheduler service incoming connection followed by TaskCache
-registry modification */ sequence by host.id, process.entity_id with
-maxspan = 1m [network where process.name : "svchost.exe" and
-network.direction == "incoming" and source.port >= 49152 and
-destination.port >= 49152 and source.address != "127.0.0.1" and
-source.address != "::1" ] [registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
-----------------------------------
-
-Version 3 (7.13.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
index 338820c9ab..dabbaef9fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
@@ -5,7 +5,7 @@ Detects use of the systemsetup command to enable remote SSH Login.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,47 +14,45 @@ Detects use of the systemsetup command to enable remote SSH Login.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf
 * https://ss64.com/osx/systemsetup.html
 * https://support.apple.com/guide/remote-desktop/about-systemsetup-apd95406b8d/mac
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<remote-ssh-login-enabled-via-systemsetup-command-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:systemsetup and process.args:("-setremotelogin" and on)
-and not process.parent.executable : /usr/local/jamf/bin/jamf
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:systemsetup and
+ process.args:("-setremotelogin" and on) and
+ not process.parent.executable : /usr/local/jamf/bin/jamf
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,32 +64,7 @@ and not process.parent.executable : /usr/local/jamf/bin/jamf
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[remote-ssh-login-enabled-via-systemsetup-command-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:systemsetup and process.args:("-setremotelogin" and on)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:systemsetup and process.args:("-f" and "-setremotelogin"
-and on)
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc
index 656842571d..24cec450ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc
@@ -5,7 +5,7 @@ Discovery of remote system information using built-in commands, which may be use
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,88 +16,83 @@ Discovery of remote system information using built-in commands, which may be use
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<remote-system-discovery-commands-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remote System Discovery Commands
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `arp` or `nbstat` utilities to enumerate remote systems in the environment,
-which is useful for attackers to identify lateral movement targets.
+This rule looks for the execution of the `arp` or `nbstat` utilities to enumerate remote systems in the environment, which is useful for attackers to identify lateral movement targets.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ((process.name :
-"nbtstat.exe" and process.args : ("-n", "-s")) or (process.name :
-"arp.exe" and process.args : "-a"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  ((process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
+  (process.name : "arp.exe" and process.args : "-a") or
+  (process.name : "nltest.exe" and process.args : ("/dclist", "/dsgetdc")) or
+  (process.name : "nslookup.exe" and process.args : "*_ldap._tcp.dc.*") or
+  (process.name: ("dsquery.exe", "dsget.exe") and process.args: "subnet") or
+  ((((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or
+    ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and not 
+       process.parent.name : "net.exe")) and 
+       process.args : "group" and process.args : "/domain" and not process.args : "/add")))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -109,42 +104,7 @@ process where event.type == "start" and ((process.name :
 ** Name: System Network Configuration Discovery
 ** ID: T1016
 ** Reference URL: https://attack.mitre.org/techniques/T1016/
-
-[[remote-system-discovery-commands-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
-(process.name : "arp.exe" and process.args : "-a"))
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
-(process.name : "arp.exe" and process.args : "-a")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-windows-service-installed.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-windows-service-installed.asciidoc
index 9cf7f704b5..9530359e38 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-windows-service-installed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-windows-service-installed.asciidoc
@@ -5,76 +5,79 @@ Identifies a network logon followed by Windows service creation with same LogonI
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Persistence
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Persistence
 
-*Version*: 1
+*Version*: 6
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by winlog.logon.id, host.id with maxspan=1m [authentication
-where event.action == "logged-in" and winlog.logon.type : "Network"
-and event.outcome=="success" and source.ip != null and source.ip !=
-"127.0.0.1" and source.ip != "::1"] [iam where event.action ==
-"service-installed" and not winlog.event_data.SubjectLogonId :
-"0x3e7" and not winlog.event_data.ServiceFileName :
-("?:\\Windows\\ADCR_Agent\\adcrsvc.exe",
-"?:\\Windows\\System32\\VSSVC.exe",
-"?:\\Windows\\servicing\\TrustedInstaller.exe",
-"?:\\Windows\\System32\\svchost.exe", "?:\\Program
-Files (x86)\\*.exe", "?:\\Program Files\\*.exe",
-"?:\\Windows\\PSEXESVC.EXE",
-"?:\\Windows\\System32\\sppsvc.exe",
-"?:\\Windows\\System32\\wbem\\WmiApSrv.exe",
-"?:\\WINDOWS\\RemoteAuditService.exe",
-"?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
-"?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
-"?:\\Windows\\CAInvokerService.exe",
-"?:\\Windows\\System32\\upfc.exe",
-"?:\\Windows\\AdminArsenal\\PDQ*.exe",
-"?:\\Windows\\System32\\vds.exe",
-"?:\\Windows\\Veeam\\Backup\\VeeamDeploymentSvc.exe",
-"?:\\Windows\\ProPatches\\Scheduler\\STSchedEx.exe",
-"?:\\Windows\\System32\\certsrv.exe",
-"?:\\Windows\\eset-remote-install-service.exe",
-"?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
-"?:\\Pella Corporation\\OSCToGPAutoService\\OSCToGPAutoSvc.exe",
-"?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
-"?:\\Windows\\SysWOW64\\NwxExeSvc\\NwxExeSvc.exe",
-"?:\\Windows\\System32\\taskhostex.exe")]
+[source, js]
 ----------------------------------
+sequence by winlog.logon.id, winlog.computer_name with maxspan=1m
+[authentication where event.action == "logged-in" and winlog.logon.type : "Network" and
+event.outcome=="success" and source.ip != null and source.ip != "127.0.0.1" and source.ip != "::1"]
+[iam where event.action == "service-installed" and
+ not winlog.event_data.SubjectLogonId : "0x3e7" and
+ not winlog.event_data.ServiceFileName :
+               ("?:\\Windows\\ADCR_Agent\\adcrsvc.exe",
+                "?:\\Windows\\System32\\VSSVC.exe",
+                "?:\\Windows\\servicing\\TrustedInstaller.exe",
+                "?:\\Windows\\System32\\svchost.exe",
+                "?:\\Program Files (x86)\\*.exe",
+                "?:\\Program Files\\*.exe",
+                "?:\\Windows\\PSEXESVC.EXE",
+                "?:\\Windows\\System32\\sppsvc.exe",
+                "?:\\Windows\\System32\\wbem\\WmiApSrv.exe",
+                "?:\\WINDOWS\\RemoteAuditService.exe",
+                "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
+                "?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
+                "?:\\Windows\\CAInvokerService.exe",
+                "?:\\Windows\\System32\\upfc.exe",
+                "?:\\Windows\\AdminArsenal\\PDQ*.exe",
+                "?:\\Windows\\System32\\vds.exe",
+                "?:\\Windows\\Veeam\\Backup\\VeeamDeploymentSvc.exe",
+                "?:\\Windows\\ProPatches\\Scheduler\\STSchedEx.exe",
+                "?:\\Windows\\System32\\certsrv.exe",
+                "?:\\Windows\\eset-remote-install-service.exe",
+                "?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
+                "?:\\Pella Corporation\\OSCToGPAutoService\\OSCToGPAutoSvc.exe",
+                "?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
+                "?:\\Windows\\SysWOW64\\NwxExeSvc\\NwxExeSvc.exe",
+                "?:\\Windows\\System32\\taskhostex.exe")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -86,8 +89,6 @@ Files (x86)\\*.exe", "?:\\Program Files\\*.exe",
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -96,3 +97,7 @@ Files (x86)\\*.exe", "?:\\Program Files\\*.exe",
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index 62ce906cf4..c86dba95a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -15,7 +15,7 @@ Identifies remote execution of Windows services over remote procedure call (RPC)
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,73 +27,59 @@ Identifies remote execution of Windows services over remote procedure call (RPC)
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Investigation Guide
-
-*Version*: 102 (<<remotely-started-services-via-rpc-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Remotely Started Services via RPC
 
-The Service Control Manager Remote Protocol is a client/server protocol used for configuring and controlling service
-programs running on a remote computer. A remote service management session begins with the client initiating the
-connection request to the server. If the server grants the request, the connection is established. The client can then
-make multiple requests to modify, query the configuration, or start and stop services on the server by using the same
-session until the session is terminated.
+The Service Control Manager Remote Protocol is a client/server protocol used for configuring and controlling service programs running on a remote computer. A remote service management session begins with the client initiating the connection request to the server. If the server grants the request, the connection is established. The client can then make multiple requests to modify, query the configuration, or start and stop services on the server by using the same session until the session is terminated.
 
-This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the
-spawn of a child process.
+This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Review login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action. Use the
-`source.address` field to help identify the source system.
-- Review network events from the source system using the source port identified on the alert and try to identify the
-program used to initiate the action.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
+- Review login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action. Use the `source.address` field to help identify the source system.
+- Review network events from the source system using the source port identified on the alert and try to identify the program used to initiate the action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
@@ -108,63 +94,58 @@ software installations.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=1s [network where process.name :
-"services.exe" and network.direction : ("incoming", "ingress")
-and network.transport == "tcp" and source.port >= 49152 and
-destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip
-!= "::1" ] by host.id, process.entity_id [process where
-event.type == "start" and process.parent.name : "services.exe" and
-not (process.name : "svchost.exe" and process.args :
-"tiledatamodelsvc") and not (process.name : "msiexec.exe" and
-process.args : "/V") and not process.executable :
-("?:\\Windows\\ADCR_Agent\\adcrsvc.exe",
-"?:\\Windows\\System32\\VSSVC.exe",
-"?:\\Windows\\servicing\\TrustedInstaller.exe",
-"?:\\Windows\\System32\\svchost.exe", "?:\\Program
-Files (x86)\\*.exe", "?:\\Program Files\\*.exe",
-"?:\\Windows\\PSEXESVC.EXE",
-"?:\\Windows\\System32\\sppsvc.exe",
-"?:\\Windows\\System32\\wbem\\WmiApSrv.exe",
-"?:\\WINDOWS\\RemoteAuditService.exe",
-"?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
-"?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
-"?:\\Windows\\CAInvokerService.exe",
-"?:\\Windows\\System32\\upfc.exe",
-"?:\\Windows\\AdminArsenal\\PDQ*.exe",
-"?:\\Windows\\System32\\vds.exe",
-"?:\\Windows\\Veeam\\Backup\\VeeamDeploymentSvc.exe",
-"?:\\Windows\\ProPatches\\Scheduler\\STSchedEx.exe",
-"?:\\Windows\\System32\\certsrv.exe",
-"?:\\Windows\\eset-remote-install-service.exe",
-"?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
-"?:\\Pella Corporation\\OSCToGPAutoService\\OSCToGPAutoSvc.exe",
-"?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
-"?:\\Windows\\SysWOW64\\NwxExeSvc\\NwxExeSvc.exe",
-"?:\\Windows\\System32\\taskhostex.exe") ] by host.id,
-process.parent.entity_id
+[source, js]
 ----------------------------------
+sequence with maxspan=1s
+   [network where host.os.type == "windows" and process.name : "services.exe" and
+      network.direction : ("incoming", "ingress") and network.transport == "tcp" and
+      source.port >= 49152 and destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip != "::1"
+   ] by host.id, process.entity_id
+   [process where host.os.type == "windows" and
+       event.type == "start" and process.parent.name : "services.exe" and
+       not (process.executable : "?:\\Windows\\System32\\svchost.exe" and process.args : "tiledatamodelsvc") and
+       not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.args : "/V") and
+       not process.executable :
+               ("?:\\Windows\\ADCR_Agent\\adcrsvc.exe",
+                "?:\\Windows\\System32\\VSSVC.exe",
+                "?:\\Windows\\servicing\\TrustedInstaller.exe",
+                "?:\\Windows\\System32\\svchost.exe",
+                "?:\\Program Files (x86)\\*.exe",
+                "?:\\Program Files\\*.exe",
+                "?:\\Windows\\PSEXESVC.EXE",
+                "?:\\Windows\\System32\\sppsvc.exe",
+                "?:\\Windows\\System32\\wbem\\WmiApSrv.exe",
+                "?:\\WINDOWS\\RemoteAuditService.exe",
+                "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
+                "?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
+                "?:\\Windows\\CAInvokerService.exe",
+                "?:\\Windows\\System32\\upfc.exe",
+                "?:\\Windows\\AdminArsenal\\PDQ*.exe",
+                "?:\\Windows\\System32\\vds.exe",
+                "?:\\Windows\\Veeam\\Backup\\VeeamDeploymentSvc.exe",
+                "?:\\Windows\\ProPatches\\Scheduler\\STSchedEx.exe",
+                "?:\\Windows\\System32\\certsrv.exe",
+                "?:\\Windows\\eset-remote-install-service.exe",
+                "?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
+                "?:\\Pella Corporation\\OSCToGPAutoService\\OSCToGPAutoSvc.exe",
+                "?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
+                "?:\\Windows\\SysWOW64\\NwxExeSvc\\NwxExeSvc.exe",
+                "?:\\Windows\\System32\\taskhostex.exe")
+   ] by host.id, process.parent.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -176,109 +157,3 @@ process.parent.entity_id
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[remotely-started-services-via-rpc-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1s [network where process.name :
-"services.exe" and network.direction : ("incoming", "ingress")
-and network.transport == "tcp" and source.port >= 49152 and
-destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip
-!= "::1" ] by host.id, process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"services.exe" and not (process.name : "svchost.exe" and
-process.args : "tiledatamodelsvc") and not (process.name :
-"msiexec.exe" and process.args : "/V") and not
-process.executable :
-("?:\\Windows\\ADCR_Agent\\adcrsvc.exe",
-"?:\\Windows\\System32\\VSSVC.exe",
-"?:\\Windows\\servicing\\TrustedInstaller.exe",
-"?:\\Windows\\System32\\svchost.exe", "?:\\Program
-Files (x86)\\*.exe", "?:\\Program Files\\*.exe",
-"?:\\Windows\\PSEXESVC.EXE",
-"?:\\Windows\\System32\\sppsvc.exe",
-"?:\\Windows\\System32\\wbem\\WmiApSrv.exe",
-"?:\\WINDOWS\\RemoteAuditService.exe",
-"?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
-"?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
-"?:\\Windows\\CAInvokerService.exe",
-"?:\\Windows\\System32\\upfc.exe",
-"?:\\Windows\\AdminArsenal\\PDQ*.exe",
-"?:\\Windows\\System32\\vds.exe",
-"?:\\Windows\\Veeam\\Backup\\VeeamDeploymentSvc.exe",
-"?:\\Windows\\ProPatches\\Scheduler\\STSchedEx.exe",
-"?:\\Windows\\System32\\certsrv.exe",
-"?:\\Windows\\eset-remote-install-service.exe",
-"?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
-"?:\\Pella Corporation\\OSCToGPAutoService\\OSCToGPAutoSvc.exe",
-"?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
-"?:\\Windows\\SysWOW64\\NwxExeSvc\\NwxExeSvc.exe",
-"?:\\Windows\\System32\\taskhostex.exe") ] by host.id,
-process.parent.entity_id
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1s [network where process.name :
-"services.exe" and network.direction : ("incoming", "ingress")
-and network.transport == "tcp" and source.port >= 49152 and
-destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip
-!= "::1" ] by host.id, process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"services.exe" and not (process.name : "svchost.exe" and
-process.args : "tiledatamodelsvc") and not (process.name :
-"msiexec.exe" and process.args : "/V") /* uncomment if psexec
-is noisy in your environment */ /* and not process.name :
-"PSEXESVC.exe" */ ] by host.id, process.parent.entity_id
-----------------------------------
-
-Version 4 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1s [network where process.name :
-"services.exe" and network.direction : ("incoming", "ingress")
-and network.transport == "tcp" and source.port >= 49152 and
-destination.port >= 49152 and source.address not in ("127.0.0.1",
-"::1") ] by host.id, process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"services.exe" and not (process.name : "svchost.exe" and
-process.args : "tiledatamodelsvc") and not (process.name :
-"msiexec.exe" and process.args : "/V") /* uncomment if psexec
-is noisy in your environment */ /* and not process.name :
-"PSEXESVC.exe" */ ] by host.id, process.parent.entity_id
-----------------------------------
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1s [network where process.name :
-"services.exe" and network.direction == "incoming" and
-network.transport == "tcp" and source.port >= 49152 and
-destination.port >= 49152 and source.address not in ("127.0.0.1",
-"::1") ] by host.id, process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"services.exe" and not (process.name : "svchost.exe" and
-process.args : "tiledatamodelsvc") and not (process.name :
-"msiexec.exe" and process.args : "/V") /* uncomment if psexec
-is noisy in your environment */ /* and not process.name :
-"PSEXESVC.exe" */ ] by host.id, process.parent.entity_id
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index ca1b4fdf0e..8f0ffe08d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -16,51 +16,97 @@ Identifies a suspicious AutoIt process execution. Malware written as an AutoIt s
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<renamed-autoit-scripts-interpreter-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
-
+## Triage and analysis
+
+### Investigating Renamed AutoIt Scripts Interpreter
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+AutoIt is a scripting language and tool for automating tasks on Microsoft Windows operating systems. Due to its capabilities, malicious threat actors can abuse it to create malicious scripts and distribute malware.
+
+This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-process.pe.original_file_name : "AutoIt*.exe" and not process.name :
-"AutoIt*.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,47 +118,7 @@ process.pe.original_file_name : "AutoIt*.exe" and not process.name :
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[renamed-autoit-scripts-interpreter-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.pe.original_file_name : "AutoIt*.exe" and not process.name :
-"AutoIt*.exe"
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process AND event.type:(start OR process_started) AND (
-process.pe.original_file_name:/[aA][uU][tT][oO][iI][tT]\d\.[eE][xX][eE
-]/ OR winlog.event_data.OriginalFileName:/[aA][uU][tT][oO][iI][tT]\d\.
-[eE][xX][eE]/) AND NOT
-process.name:/[aA][uU][tT][oO][iI][tT]\d{1,3}\.[eE][xX][eE]/
-----------------------------------
-
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
new file mode 100644
index 0000000000..cf45d2c3ea
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -0,0 +1,123 @@
+[[renamed-utility-executed-with-short-program-name]]
+=== Renamed Utility Executed with Short Program Name
+
+Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 106
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Renamed Utility Executed with Short Program Name
+
+Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and length(process.name) > 0 and
+ length(process.name) == 5 and length(process.pe.original_file_name) > 5
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
index a15dd3880b..78c29e4acf 100644
--- a/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
@@ -5,83 +5,94 @@ Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the int
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
 * https://www.justice.gov/opa/press-release/file/1084361/download
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<roshal-archive-rar-or-powershell-file-downloaded-from-the-internet-history, version history>>)
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Downloading RAR or PowerShell files from the Internet may be expected for certain systems. This rule should be tailored to either exclude systems as sources or destinations in which this behavior is expected.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Threat intel
 
 This activity has been observed in FIN7 campaigns.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.protocol:http
-and (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and
-not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or
-169.254.0.0/16 or 172.16.0.0/12 or 192.0.0.0/24 or
-192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or
-192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or
-192.0.2.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or
-192.168.0.0/16 or 192.88.99.0/24 or 224.0.0.0/4 or
-100.64.0.0/10 or 192.175.48.0/24 or 198.18.0.0/15 or
-198.51.100.0/24 or 203.0.113.0/24 or 240.0.0.0/4 or
-"::1" or "FE80::/10" or "FF00::/8" ) and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 )
+[source, js]
 ----------------------------------
+event.dataset: (network_traffic.http or network_traffic.tls) and
+  (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and
+    not destination.ip:(
+      10.0.0.0/8 or
+      127.0.0.0/8 or
+      169.254.0.0/16 or
+      172.16.0.0/12 or
+      192.0.0.0/24 or
+      192.0.0.0/29 or
+      192.0.0.8/32 or
+      192.0.0.9/32 or
+      192.0.0.10/32 or
+      192.0.0.170/32 or
+      192.0.0.171/32 or
+      192.0.2.0/24 or
+      192.31.196.0/24 or
+      192.52.193.0/24 or
+      192.168.0.0/16 or
+      192.88.99.0/24 or
+      224.0.0.0/4 or
+      100.64.0.0/10 or
+      192.175.48.0/24 or
+      198.18.0.0/15 or
+      198.51.100.0/24 or
+      203.0.113.0/24 or
+      240.0.0.0/4 or
+      "::1" or
+      "FE80::/10" or
+      "FF00::/8"
+    ) and
+    source.ip:(
+      10.0.0.0/8 or
+      172.16.0.0/12 or
+      192.168.0.0/16
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -93,41 +104,3 @@ source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or
 ** Name: Ingress Tool Transfer
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
-
-[[roshal-archive-rar-or-powershell-file-downloaded-from-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.0.0 release)::
-* Formatting only
-
-Version 8 (7.16.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network OR network_traffic) AND network.protocol:http
-AND url.path:/.*(rar|ps1)/ AND source.ip:(10.0.0.0\/8 OR
-172.16.0.0\/12 OR 192.168.0.0\/16)
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-from-the-internet.asciidoc
index b4c4dd8e00..da0bfd7abf 100644
--- a/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-from-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-from-the-internet.asciidoc
@@ -5,66 +5,82 @@ This rule detects network events that may indicate the use of RPC traffic from t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Initial Access
-* Host
-
-*Version*: 100 (<<rpc-remote-procedure-call-from-the-internet-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:135 or event.dataset:zeek.dce_rpc) and not
-source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.0.0.0/24 or 192.0.0.0/29 or
-192.0.0.8/32 or 192.0.0.9/32 or 192.0.0.10/32 or
-192.0.0.170/32 or 192.0.0.171/32 or 192.0.2.0/24 or
-192.31.196.0/24 or 192.52.193.0/24 or 192.168.0.0/16 or
-192.88.99.0/24 or 224.0.0.0/4 or 100.64.0.0/10 or
-192.175.48.0/24 or 198.18.0.0/15 or 198.51.100.0/24 or
-203.0.113.0/24 or 240.0.0.0/4 or "::1" or "FE80::/10" or
-"FF00::/8" ) and destination.ip:( 10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16 )
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,75 +92,3 @@ source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[rpc-remote-procedure-call-from-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 11 (7.15.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:135 or event.dataset:zeek.dce_rpc) and not
-source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or "::1" or "FE80::/10"
-or "FF00::/8" ) and destination.ip:( 10.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 )
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:135 or event.dataset:zeek.dce_rpc) and not
-source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1") and destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port:135 and not
-source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1") and destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 3 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport: tcp and destination.port: 135 and (
-network.direction: inbound or ( not source.ip: (10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16) and destination.ip: (10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16) ) )
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-to-the-internet.asciidoc
index 4d02fea61e..ec04b3565a 100644
--- a/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-to-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rpc-remote-procedure-call-to-the-internet.asciidoc
@@ -5,66 +5,82 @@ This rule detects network events that may indicate the use of RPC traffic to the
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Initial Access
-* Host
-
-*Version*: 100 (<<rpc-remote-procedure-call-to-the-internet-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:135 or event.dataset:zeek.dce_rpc) and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16
-) and not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or
-169.254.0.0/16 or 172.16.0.0/12 or 192.0.0.0/24 or
-192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or
-192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or
-192.0.2.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or
-192.168.0.0/16 or 192.88.99.0/24 or 224.0.0.0/4 or
-100.64.0.0/10 or 192.175.48.0/24 or 198.18.0.0/15 or
-198.51.100.0/24 or 203.0.113.0/24 or 240.0.0.0/4 or "::1"
-or "FE80::/10" or "FF00::/8" )
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,75 +92,3 @@ or "FE80::/10" or "FF00::/8" )
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[rpc-remote-procedure-call-to-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 11 (7.15.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:135 or event.dataset:zeek.dce_rpc) and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 ) and not
-destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or "::1" or "FE80::/10"
-or "FF00::/8" )
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:135 or event.dataset:zeek.dce_rpc) and
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port:135 and
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 3 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport: tcp and destination.port: 135 and (
-network.direction: outbound or ( source.ip: (10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16) and not destination.ip: (10.0.0.0/8
-or 172.16.0.0/12 or 192.168.0.0/16) ) )
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc
index aa5331763e..e0603961e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc
@@ -5,70 +5,67 @@ A scheduled task was created by a Windows script via cscript.exe, wscript.exe or
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<scheduled-task-created-by-a-windows-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks may be created during installation of new software.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 Decode the base64 encoded Tasks Actions registry value to investigate the task's configured action.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan = 30s [any where (event.category ==
-"library" or (event.category == "process" and event.action : "Image
-loaded*")) and (dll.name : "taskschd.dll" or file.name :
-"taskschd.dll") and process.name : ("cscript.exe", "wscript.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe")] [registry where
-registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan = 30s
+  [any where host.os.type == "windows" and 
+    (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+    (dll.name : "taskschd.dll" or file.name : "taskschd.dll") and
+    process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe")]
+  [registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,49 +77,7 @@ NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[scheduled-task-created-by-a-windows-script-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 30s [library where dll.name :
-"taskschd.dll" and process.name : ("cscript.exe", "wscript.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe")] [registry where
-registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
-----------------------------------
-
-Version 5 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 30s [library where dll.name :
-"taskschd.dll" and process.name : ("cscript.exe", "wscript.exe",
-"powershell.exe")] [registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
-----------------------------------
-
-Version 3 (7.13.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 30s [library where file.name :
-"taskschd.dll" and process.name : ("cscript.exe", "wscript.exe",
-"powershell.exe")] [registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc
index b9ef549dda..6adaa08cab 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc
@@ -5,22 +5,23 @@ Detects the modification of Group Policy Object attributes to execute a schedule
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md
 * https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md
@@ -28,45 +29,40 @@ Detects the modification of Group Policy Object attributes to execute a schedule
 * https://twitter.com/menasec1/status/1106899890377052160
 * https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_gpo_scheduledtasks.yml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<scheduled-task-execution-at-scale-via-gpo-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Scheduled Task Execution at Scale via GPO
 
-Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks at scale to compromise objects controlled
-by a given GPO. This is done by changing the contents of the `<GPOPath>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml`
-file.
+Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks at scale to compromise objects controlled by a given GPO. This is done by changing the contents of the `<GPOPath>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml` file.
 
 #### Possible investigation steps
 
-- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity
-is legitimate and the administrator is authorized to perform this operation.
-- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any
-potentially malicious commands or binaries.
+- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
+- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any potentially malicious commands or binaries.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.
 
@@ -86,27 +82,21 @@ potentially malicious commands or binaries.
 - Remove the script from the GPO.
 - Check if other GPOs have suspicious scheduled tasks attached.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-(event.code: "5136" and
-winlog.event_data.AttributeLDAPDisplayName:("gPCMachineExtensionNames"
-or "gPCUserExtensionNames") and winlog.event_data.AttributeValue:(*
-CAB54552-DEEA-4691-817E-ED4A4D1AFC72* and
-*AADCED64-746C-4633-A97C-D61349046527*)) or (event.code: "5145" and
-winlog.event_data.ShareName: "\\\\*\\SYSVOL" and
-winlog.event_data.RelativeTargetName: *ScheduledTasks.xml and
-(message: WriteData or winlog.event_data.AccessList: *%%4417*))
+[source, js]
 ----------------------------------
+(event.code: "5136" and winlog.event_data.AttributeLDAPDisplayName:("gPCMachineExtensionNames" or "gPCUserExtensionNames") and
+   winlog.event_data.AttributeValue:(*CAB54552-DEEA-4691-817E-ED4A4D1AFC72* and *AADCED64-746C-4633-A97C-D61349046527*))
+or
+(event.code: "5145" and winlog.event_data.ShareName: "\\\\*\\SYSVOL" and winlog.event_data.RelativeTargetName: *ScheduledTasks.xml and
+  (message: WriteData or winlog.event_data.AccessList: *%%4417*))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,37 +108,15 @@ winlog.event_data.RelativeTargetName: *ScheduledTasks.xml and
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[scheduled-task-execution-at-scale-via-gpo-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-(event.code: "5136" and
-winlog.event_data.AttributeLDAPDisplayName:("gPCMachineExtensionNames"
-or "gPCUserExtensionNames") and winlog.event_data.AttributeValue:(
-*CAB54552-DEEA-4691-817E-ED4A4D1AFC72* and
-*AADCED64-746C-4633-A97C-D61349046527*)) or (event.code: "5145" and
-winlog.event_data.ShareName: "\\\\*\\SYSVOL" and
-winlog.event_data.RelativeTargetName: *ScheduledTasks.xml and
-(message: WriteData or winlog.event_data.AccessList: *%%4417*))
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
+* Technique:
+** Name: Domain Policy Modification
+** ID: T1484
+** Reference URL: https://attack.mitre.org/techniques/T1484/
+* Sub-technique:
+** Name: Group Policy Modification
+** ID: T1484.001
+** Reference URL: https://attack.mitre.org/techniques/T1484/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
index 65ad3f08dc..d0a8cfe9c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to enable the Windows scheduled tasks AT command via the reg
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,58 +16,53 @@ Identifies attempts to enable the Windows scheduled tasks AT command via the reg
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 101 (<<scheduled-tasks-at-command-enabled-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path : (
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt",
-"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt" ) and
-registry.data.strings : ("1", "0x00000001")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+  registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt"
+  ) and registry.data.strings : ("1", "0x00000001")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,49 +74,7 @@ registry.data.strings : ("1", "0x00000001")
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[scheduled-tasks-at-command-enabled-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt" and
-registry.data.strings : ("1", "0x00000001")
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt" and
-registry.data.strings : ("1", "0x00000001")
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt" and
-registry.data.strings == "1"
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
index 167bb82f56..b9798e5386 100644
--- a/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
@@ -5,7 +5,7 @@ Identifies when a screensaver plist file is modified by an unexpected process. A
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,39 +14,37 @@ Identifies when a screensaver plist file is modified by an unexpected process. A
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/saving-your-access-d562bf5bf90b
 * https://github.com/D00MFist/PersistentJXA
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<screensaver-plist-file-modified-by-unexpected-process-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -55,24 +53,43 @@ Identifies when a screensaver plist file is modified by an unexpected process. A
 - Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.name:
-"com.apple.screensaver.*.plist" and file.path : (
-"/Users/*/Library/Preferences/ByHost/*", "/Library/Managed
-Preferences/*", "/System/Library/Preferences/*" ) and /*
-Filter OS processes modifying screensaver plist files */ not
-process.executable : ( "/usr/sbin/cfprefsd",
-"/usr/libexec/xpcproxy", "/System/Library/CoreServices/ManagedClie
-nt.app/Contents/Resources/MCXCompositor", "/System/Library/CoreSer
-vices/ManagedClient.app/Contents/MacOS/ManagedClient" )
+[source, js]
 ----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and
+  file.name: "com.apple.screensaver.*.plist" and
+   file.path : (
+      "/Users/*/Library/Preferences/ByHost/*",
+      "/Library/Managed Preferences/*",
+      "/System/Library/Preferences/*"
+      ) and
+  (
+    process.code_signature.trusted == false or
+    process.code_signature.exists == false or
+
+    /* common script interpreters and abused native macOS bins */
+    process.name : (
+      "curl",
+      "mktemp",
+      "tail",
+      "funzip",
+      "python*",
+      "osascript",
+      "perl"
+      )
+   ) and
+
+  /* Filter OS processes modifying screensaver plist files */
+  not process.executable : (
+    "/usr/sbin/cfprefsd",
+    "/usr/libexec/xpcproxy",
+    "/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor",
+    "/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,16 +101,3 @@ vices/ManagedClient.app/Contents/MacOS/ManagedClient" )
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[screensaver-plist-file-modified-by-unexpected-process-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
index b272cc96f9..4a3a275a6d 100644
--- a/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
@@ -5,7 +5,7 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,57 +16,53 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
 * https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Elastic Endgame
-
-*Version*: 102 (<<searching-for-saved-credentials-via-vaultcmd-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-(process.pe.original_file_name:"vaultcmd.exe" or
-process.name:"vaultcmd.exe") and process.args:"/list*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.pe.original_file_name:"vaultcmd.exe" or process.name:"vaultcmd.exe") and
+  process.args:"/list*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,32 +74,11 @@ process.name:"vaultcmd.exe") and process.args:"/list*"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[searching-for-saved-credentials-via-vaultcmd-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.pe.original_file_name:"vaultcmd.exe" or
-process.name:"vaultcmd.exe") and process.args:"/list*"
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Windows Credential Manager
+** ID: T1555.004
+** Reference URL: https://attack.mitre.org/techniques/T1555/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc
index d3a6cb3e54..24ea6e5cd3 100644
--- a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of Windows Management Instrumentation Command (WMIC) to disco
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,90 +16,76 @@ Identifies the use of Windows Management Instrumentation Command (WMIC) to disco
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<security-software-discovery-using-wmic-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Security Software Discovery using WMIC
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `wmic` utility with arguments compatible to the enumeration of the security
-software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable
-protections, use bypasses, etc.
+This rule looks for the execution of the `wmic` utility with arguments compatible to the enumeration of the security software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable protections, use bypasses, etc.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name:"wmic.exe" or
-process.pe.original_file_name:"wmic.exe") and
-process.args:"/namespace:\\\\root\\SecurityCenter2" and
-process.args:"Get"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+   (process.name:"wmic.exe" or process.pe.original_file_name:"wmic.exe") and
+    process.args:"/namespace:\\\\root\\SecurityCenter2" and process.args:"Get"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -111,39 +97,7 @@ process.args:"Get"
 ** Name: Software Discovery
 ** ID: T1518
 ** Reference URL: https://attack.mitre.org/techniques/T1518/
-
-[[security-software-discovery-using-wmic-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name:"wmic.exe" or process.pe.original_file_name:"wmic.exe")
-and process.args:"/namespace:\\\\root\\SecurityCenter2" and
-process.args:"Get"
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Security Software Discovery
+** ID: T1518.001
+** Reference URL: https://attack.mitre.org/techniques/T1518/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc
index 582f1cc034..b2927e78db 100644
--- a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of the grep command to discover known third-party macOS and L
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * auditbeat-*
@@ -14,108 +14,110 @@ Identifies the use of the grep command to discover known third-party macOS and L
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* macOS
-* Linux
-* Threat Detection
-* Discovery
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<security-software-discovery-via-grep-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Endpoint Security installers, updaters and post installation verification scripts.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Security Software Discovery via Grep
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `grep` utility with arguments compatible to the enumeration of the security
-software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable
-protections, use bypasses, etc.
+This rule looks for the execution of the `grep` utility with arguments compatible to the enumeration of the security software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable protections, use bypasses, etc.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence and whether they are located in expected locations.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
-spawned child processes.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "grep" and
-user.id != "0" and not process.parent.executable :
-"/Library/Application Support/*" and process.args :
-("Little Snitch*", "Avast*", "Avira*",
-"ESET*", "BlockBlock*", "360Sec*",
-"LuLu*", "KnockKnock*", "kav", "KIS",
-"RTProtectionDaemon*", "Malware*",
-"VShieldScanner*", "WebProtection*",
-"webinspectord*", "McAfee*", "isecespd*",
-"macmnsvc*", "masvc*", "kesl*",
-"avscan*", "guard*", "rtvscand*",
-"symcfgd*", "scmdaemon*", "symantec*",
-"sophos*", "osquery*", "elastic-endpoint*"
-) and not (process.args : "Avast" and process.args : "Passwords")
+[source, js]
 ----------------------------------
+process where event.type == "start" and
+process.name : "grep" and user.id != "0" and
+ not process.parent.executable : "/Library/Application Support/*" and
+   process.args :
+         ("Little Snitch*",
+          "Avast*",
+          "Avira*",
+          "ESET*",
+          "BlockBlock*",
+          "360Sec*",
+          "LuLu*",
+          "KnockKnock*",
+          "kav",
+          "KIS",
+          "RTProtectionDaemon*",
+          "Malware*",
+          "VShieldScanner*",
+          "WebProtection*",
+          "webinspectord*",
+          "McAfee*",
+          "isecespd*",
+          "macmnsvc*",
+          "masvc*",
+          "kesl*",
+          "avscan*",
+          "guard*",
+          "rtvscand*",
+          "symcfgd*",
+          "scmdaemon*",
+          "symantec*",
+          "sophos*",
+          "osquery*",
+          "elastic-endpoint*"
+          ) and
+   not (process.args : "Avast" and process.args : "Passwords")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -127,33 +129,7 @@ user.id != "0" and not process.parent.executable :
 ** Name: Software Discovery
 ** ID: T1518
 ** Reference URL: https://attack.mitre.org/techniques/T1518/
-
-[[security-software-discovery-via-grep-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category : process and event.type : (start or process_started)
-and process.name : grep and process.args : ("Little Snitch" or Avast*
-or Avira* or ESET* or esets_* or BlockBlock or 360* or LuLu or
-KnockKnock* or kav or KIS or RTProtectionDaemon or Malware* or
-VShieldScanner or WebProtection or webinspectord or McAfee* or
-isecespd* or macmnsvc* or masvc or kesl or avscan or guard or rtvscand
-or symcfgd or scmdaemon or symantec or elastic-endpoint )
-----------------------------------
-
+* Sub-technique:
+** Name: Security Software Discovery
+** ID: T1518.001
+** Reference URL: https://attack.mitre.org/techniques/T1518/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc
index 8a81211d0f..89ccd0d9ea 100644
--- a/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,69 +14,71 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
 * https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Version*: 1
+*Version*: 4
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where event.provider: "Microsoft-Windows-Security-Auditing" and
-event.action : "Token Right Adjusted Events" and
-winlog.event_data.EnabledPrivilegeList : "SeDebugPrivilege" and /*
-exclude processes with System Integrity */ not
-winlog.event_data.SubjectUserSid : ("S-1-5-18", "S-1-5-19",
-"S-1-5-20") and not winlog.event_data.ProcessName :
-("?:\\Windows\\System32\\msiexec.exe",
-"?:\\Windows\\SysWOW64\\msiexec.exe",
-"?:\\Windows\\System32\\lsass.exe",
-"?:\\Windows\\WinSxS\\*", "?:\\Program Files\\*",
-"?:\\Program Files (x86)\\*",
-"?:\\Windows\\System32\\MRT.exe",
-"?:\\Windows\\System32\\cleanmgr.exe",
-"?:\\Windows\\System32\\taskhostw.exe",
-"?:\\Windows\\System32\\mmc.exe",
-"?:\\Users\\*\\AppData\\Local\\Temp\\*-*\\DismHost.exe",
-"?:\\Windows\\System32\\auditpol.exe",
-"?:\\Windows\\System32\\wbem\\WmiPrvSe.exe",
-"?:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe")
+[source, js]
 ----------------------------------
+any where host.os.type == "windows" and event.provider: "Microsoft-Windows-Security-Auditing" and
+ event.action : "Token Right Adjusted Events" and
+
+ winlog.event_data.EnabledPrivilegeList : "SeDebugPrivilege" and
+
+ /* exclude processes with System Integrity  */
+ not winlog.event_data.SubjectUserSid : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+
+ not winlog.event_data.ProcessName :
+         ("?:\\Windows\\System32\\msiexec.exe",
+          "?:\\Windows\\SysWOW64\\msiexec.exe",
+          "?:\\Windows\\System32\\lsass.exe",
+          "?:\\Windows\\WinSxS\\*",
+          "?:\\Program Files\\*",
+          "?:\\Program Files (x86)\\*",
+          "?:\\Windows\\System32\\MRT.exe",
+          "?:\\Windows\\System32\\cleanmgr.exe",
+          "?:\\Windows\\System32\\taskhostw.exe",
+          "?:\\Windows\\System32\\mmc.exe",
+          "?:\\Users\\*\\AppData\\Local\\Temp\\*-*\\DismHost.exe",
+          "?:\\Windows\\System32\\auditpol.exe",
+          "?:\\Windows\\System32\\wbem\\WmiPrvSe.exe",
+          "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression-inside-a-container.asciidoc
new file mode 100644
index 0000000000..ede4904852
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression-inside-a-container.asciidoc
@@ -0,0 +1,107 @@
+[[sensitive-files-compression-inside-a-container]]
+=== Sensitive Files Compression Inside A Container
+
+Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Collection
+* Tactic: Credential Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type== "start" and 
+
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/  
+(process.name: ("zip", "tar", "gzip", "hdiutil", "7z") or process.args: ("zip", "tar", "gzip", "hdiutil", "7z"))
+and process.args: ( 
+"/root/.ssh/id_rsa", 
+"/root/.ssh/id_rsa.pub", 
+"/root/.ssh/id_ed25519", 
+"/root/.ssh/id_ed25519.pub", 
+"/root/.ssh/authorized_keys", 
+"/root/.ssh/authorized_keys2", 
+"/root/.ssh/known_hosts", 
+"/root/.bash_history", 
+"/etc/hosts", 
+"/home/*/.ssh/id_rsa", 
+"/home/*/.ssh/id_rsa.pub", 
+"/home/*/.ssh/id_ed25519",
+"/home/*/.ssh/id_ed25519.pub",
+"/home/*/.ssh/authorized_keys",
+"/home/*/.ssh/authorized_keys2",
+"/home/*/.ssh/known_hosts",
+"/home/*/.bash_history",
+"/root/.aws/credentials",
+"/root/.aws/config",
+"/home/*/.aws/credentials",
+"/home/*/.aws/config",
+"/root/.docker/config.json",
+"/home/*/.docker/config.json",
+"/etc/group",
+"/etc/passwd",
+"/etc/shadow",
+"/etc/gshadow")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
+* Sub-technique:
+** Name: Credentials In Files
+** ID: T1552.001
+** Reference URL: https://attack.mitre.org/techniques/T1552/001/
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Archive Collected Data
+** ID: T1560
+** Reference URL: https://attack.mitre.org/techniques/T1560/
+* Sub-technique:
+** Name: Archive via Utility
+** ID: T1560.001
+** Reference URL: https://attack.mitre.org/techniques/T1560/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc b/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc
index 554f763b0d..2b11a461de 100644
--- a/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc
@@ -5,67 +5,83 @@ Identifies the use of a compression utility to collect known files containing se
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Collection
-* Credential Access
-
-*Version*: 100 (<<sensitive-files-compression-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Collection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and process.name:(zip or
-tar or gzip or hdiutil or 7z) and process.args: (
-/root/.ssh/id_rsa or /root/.ssh/id_rsa.pub or
-/root/.ssh/id_ed25519 or /root/.ssh/id_ed25519.pub or
-/root/.ssh/authorized_keys or /root/.ssh/authorized_keys2 or
-/root/.ssh/known_hosts or /root/.bash_history or
-/etc/hosts or /home/*/.ssh/id_rsa or
-/home/*/.ssh/id_rsa.pub or /home/*/.ssh/id_ed25519 or
-/home/*/.ssh/id_ed25519.pub or /home/*/.ssh/authorized_keys or
-/home/*/.ssh/authorized_keys2 or /home/*/.ssh/known_hosts or
-/home/*/.bash_history or /root/.aws/credentials or
-/root/.aws/config or /home/*/.aws/credentials or
-/home/*/.aws/config or /root/.docker/config.json or
-/home/*/.docker/config.json or /etc/group or /etc/passwd
-or /etc/shadow or /etc/gshadow )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:start and
+  process.name:(zip or tar or gzip or hdiutil or 7z) and
+  process.args:
+    (
+      /root/.ssh/id_rsa or
+      /root/.ssh/id_rsa.pub or
+      /root/.ssh/id_ed25519 or
+      /root/.ssh/id_ed25519.pub or
+      /root/.ssh/authorized_keys or
+      /root/.ssh/authorized_keys2 or
+      /root/.ssh/known_hosts or
+      /root/.bash_history or
+      /etc/hosts or
+      /home/*/.ssh/id_rsa or
+      /home/*/.ssh/id_rsa.pub or
+      /home/*/.ssh/id_ed25519 or
+      /home/*/.ssh/id_ed25519.pub or
+      /home/*/.ssh/authorized_keys or
+      /home/*/.ssh/authorized_keys2 or
+      /home/*/.ssh/known_hosts or
+      /home/*/.bash_history or
+      /root/.aws/credentials or
+      /root/.aws/config or
+      /home/*/.aws/credentials or
+      /home/*/.aws/config or
+      /root/.docker/config.json or
+      /home/*/.docker/config.json or
+      /etc/group or
+      /etc/passwd or
+      /etc/shadow or
+      /etc/gshadow
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,8 +93,10 @@ or /etc/shadow or /etc/gshadow )
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-
+* Sub-technique:
+** Name: Credentials In Files
+** ID: T1552.001
+** Reference URL: https://attack.mitre.org/techniques/T1552/001/
 * Tactic:
 ** Name: Collection
 ** ID: TA0009
@@ -87,13 +105,7 @@ or /etc/shadow or /etc/gshadow )
 ** Name: Archive Collected Data
 ** ID: T1560
 ** Reference URL: https://attack.mitre.org/techniques/T1560/
-
-[[sensitive-files-compression-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Archive via Utility
+** ID: T1560.001
+** Reference URL: https://attack.mitre.org/techniques/T1560/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/sensitive-keys-or-passwords-searched-for-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/sensitive-keys-or-passwords-searched-for-inside-a-container.asciidoc
new file mode 100644
index 0000000000..e53f511568
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/sensitive-keys-or-passwords-searched-for-inside-a-container.asciidoc
@@ -0,0 +1,77 @@
+[[sensitive-keys-or-passwords-searched-for-inside-a-container]]
+=== Sensitive Keys Or Passwords Searched For Inside A Container
+
+This rule detects the use of system search utilities like grep and find to search for private SSH keys or passwords inside a container. Unauthorized access to these sensitive files could lead to further compromise of the container environment or facilitate a container breakout to the underlying host machine.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://sysdig.com/blog/cve-2021-25741-kubelet-falco/
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type== "start" and
+((
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/  
+  (process.name in ("grep", "egrep", "fgrep") or process.args in ("grep", "egrep", "fgrep")) 
+    and process.args : ("*BEGIN PRIVATE*", "*BEGIN OPENSSH PRIVATE*", "*BEGIN RSA PRIVATE*", 
+"*BEGIN DSA PRIVATE*", "*BEGIN EC PRIVATE*", "*pass*", "*ssh*", "*user*")
+) 
+or 
+(
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
+  (process.name in ("find", "locate", "mlocate") or process.args in ("find", "locate", "mlocate")) 
+    and process.args : ("*id_rsa*", "*id_dsa*")
+))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
+* Sub-technique:
+** Name: Credentials In Files
+** ID: T1552.001
+** Reference URL: https://attack.mitre.org/techniques/T1552/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc
index da238e8261..1976b3f02b 100644
--- a/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc
@@ -5,22 +5,23 @@ Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user rig
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
 * https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_alert_active_directory_user_control.yml
@@ -28,65 +29,51 @@ Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user rig
 * https://www.thehacker.recipes/ad/movement/kerberos/delegations
 * https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0105_windows_audit_authorization_policy_change.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
 
-Kerberos delegation is an Active Directory feature that allows user and computer accounts to impersonate other accounts,
-act on their behalf, and use their privileges. Delegation (constrained and unconstrained) can be configured
-for user and computer objects.
+Kerberos delegation is an Active Directory feature that allows user and computer accounts to impersonate other accounts, act on their behalf, and use their privileges. Delegation (constrained and unconstrained) can be configured for user and computer objects.
 
-Enabling unconstrained delegation for a computer causes the computer to store the ticket-granting ticket
-(TGT) in memory at any time an account connects to the computer, so it can be used by the computer for impersonation
-when needed. Risk is heightened if an attacker compromises computers with unconstrained delegation enabled, as they
-could extract TGTs from memory and then replay them to move laterally on the domain. If the attacker coerces a privileged
-user to connect to the server, or if the user does so routinely, the account will be compromised and the attacker will
-be able to pass-the-ticket to privileged assets.
+Enabling unconstrained delegation for a computer causes the computer to store the ticket-granting ticket (TGT) in memory at any time an account connects to the computer, so it can be used by the computer for impersonation when needed. Risk is heightened if an attacker compromises computers with unconstrained delegation enabled, as they could extract TGTs from memory and then replay them to move laterally on the domain. If the attacker coerces a privileged user to connect to the server, or if the user does so routinely, the account will be compromised and the attacker will be able to pass-the-ticket to privileged assets.
 
-SeEnableDelegationPrivilege is a user right that is controlled within the Local Security Policy of a domain controller
-and is managed through Group Policy. This setting is named **Enable computer and user accounts to be trusted for
-delegation**.
+SeEnableDelegationPrivilege is a user right that is controlled within the Local Security Policy of a domain controller and is managed through Group Policy. This setting is named **Enable computer and user accounts to be trusted for delegation**.
 
-It is critical to control the assignment of this privilege. A user with this privilege and write access to a computer
-can control delegation settings, perform the attacks described above, and harvest TGTs from any user that connects to
-the system.
+It is critical to control the assignment of this privilege. A user with this privilege and write access to a computer can control delegation settings, perform the attacks described above, and harvest TGTs from any user that connects to the system.
 
 #### Possible investigation steps
 
 - Investigate how the privilege was assigned to the user and who assigned it.
-- Investigate other potentially malicious activity that was performed by the user that assigned the privileges using the
-`user.id` and `winlog.activity_id` fields as a filter during the past 48 hours.
+- Investigate other potentially malicious activity that was performed by the user that assigned the privileges using the `user.id` and `winlog.activity_id` fields as a filter during the past 48 hours.
 - Investigate other alerts associated with the users/host during the past 48 hours.
 
 ### False positive analysis
 
-- The SeEnableDelegationPrivilege privilege should not be assigned to users. If this rule is triggered in your
-environment legitimately, the security team should notify the administrators about the risks of using it.
+- The SeEnableDelegationPrivilege privilege should not be assigned to users. If this rule is triggered in your environment legitimately, the security team should notify the administrators about the risks of using it.
 
 ### Related rules
 
@@ -98,21 +85,18 @@ environment legitimately, the security team should notify the administrators abo
 - Remove the privilege from the account.
 - Review the privileges of the administrator account that performed the action.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.action: "Authorization Policy Change" and event.code:4704 and
-winlog.event_data.PrivilegeList:"SeEnableDelegationPrivilege"
+[source, js]
 ----------------------------------
+event.action:"Authorization Policy Change" and event.code:4704 and
+  winlog.event_data.PrivilegeList:"SeEnableDelegationPrivilege"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -120,28 +104,7 @@ winlog.event_data.PrivilegeList:"SeEnableDelegationPrivilege"
 ** Name: Credential Access
 ** ID: TA0006
 ** Reference URL: https://attack.mitre.org/tactics/TA0006/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/service-command-lateral-movement.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-command-lateral-movement.asciidoc
index 625324b44e..1c0d07e67b 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-command-lateral-movement.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-command-lateral-movement.asciidoc
@@ -5,7 +5,7 @@ Identifies use of sc.exe to create, modify, or start services on remote hosts. T
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,44 +15,43 @@ Identifies use of sc.exe to create, modify, or start services on remote hosts. T
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
+*Tags*: 
 
-*Version*: 101 (<<service-command-lateral-movement-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan = 1m [process where
-event.type == "start" and (process.name : "sc.exe" or
-process.pe.original_file_name : "sc.exe") and process.args :
-"\\\\*" and process.args : ("binPath=*", "binpath=*") and
-process.args : ("create", "config", "failure", "start")] [network
-where process.name : "sc.exe" and destination.ip != "127.0.0.1"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan = 1m
+  [process where host.os.type == "windows" and event.type == "start" and
+     (process.name : "sc.exe" or process.pe.original_file_name : "sc.exe") and
+      process.args : "\\\\*" and process.args : ("binPath=*", "binpath=*") and
+      process.args : ("create", "config", "failure", "start")]
+  [network where host.os.type == "windows" and process.name : "sc.exe" and destination.ip != "127.0.0.1"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,8 +63,6 @@ where process.name : "sc.exe" and destination.ip != "127.0.0.1"]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -74,8 +71,10 @@ where process.name : "sc.exe" and destination.ip != "127.0.0.1"]
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -84,43 +83,7 @@ where process.name : "sc.exe" and destination.ip != "127.0.0.1"]
 ** Name: System Services
 ** ID: T1569
 ** Reference URL: https://attack.mitre.org/techniques/T1569/
-
-[[service-command-lateral-movement-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan = 1m [process where
-event.type in ("start", "process_started") and (process.name :
-"sc.exe" or process.pe.original_file_name : "sc.exe") and
-process.args : "\\\\*" and process.args : ("binPath=*", "binpath=*")
-and process.args : ("create", "config", "failure", "start")]
-[network where process.name : "sc.exe" and destination.ip !=
-"127.0.0.1"]
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [process where
-event.type in ("start", "process_started") and
-/* uncomment once in winlogbeat */ (process.name == "sc.exe" /*
-or process.pe.original_file_name == "sc.exe" */ ) and
-/* case insensitive */ wildcard(process.args, "\\\\*") and
-wildcard(process.args, "binPath=*", "binpath=*") and
-(process.args : "create" or process.args : "config" or
-process.args : "failure" or process.args : "start")] [network
-where process.name : "sc.exe" and destination.ip != "127.0.0.1"]
-----------------------------------
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index 0539b16b97..508da0aff6 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -1,7 +1,7 @@
 [[service-control-spawned-via-script-interpreter]]
 === Service Control Spawned via Script Interpreter
 
-Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.
+Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence.
 
 *Rule type*: eql
 
@@ -10,142 +10,113 @@ Identifies Service Control (sc.exe) spawning from script interpreter processes t
 * logs-endpoint.events.*
 * logs-system.*
 * winlogbeat-*
+* logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
+*Tags*:
 
-*Version*: 100 (<<service-control-spawned-via-script-interpreter-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Service Control Spawned via Script Interpreter
 
+Windows services are background processes that run with SYSTEM privileges and provide specific functionality or support to other applications and system components.
 
-==== Rule query
+The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
 
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
-[source,js]
-----------------------------------
-/* This rule is not compatible with Sysmon due to user.id issues */
-process where event.type == "start" and (process.name : "sc.exe" or
-process.pe.original_file_name == "sc.exe") and process.parent.name :
-("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe",
-"wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and
-process.args:("config", "create", "start", "delete", "stop", "pause")
-and /* exclude SYSTEM SID - look for service creations by non-SYSTEM
-user */ not user.id : "S-1-5-18"
-----------------------------------
+#### Possible investigation steps
 
-==== Threat mapping
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the command line, registry changes events, and Windows events related to service activities (for example, 4697 and/or 7045) for suspicious characteristics.
+  - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.
+    - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+    - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+    - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-*Framework*: MITRE ATT&CK^TM^
+### False positive analysis
 
-* Tactic:
-** Name: Lateral Movement
-** ID: TA0008
-** Reference URL: https://attack.mitre.org/tactics/TA0008/
-* Technique:
-** Name: Remote Services
-** ID: T1021
-** Reference URL: https://attack.mitre.org/techniques/T1021/
+- This activity is not inherently malicious if it occurs in isolation. As long as the analyst did not identify suspicious activity related to the user, host, and service, such alerts can be dismissed.
 
-[[service-control-spawned-via-script-interpreter-history]]
-==== Rule version history
+### Response and remediation
 
-Version 100 (8.5.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the service or restore it to the original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 13 (8.4.0 release)::
-* Formatting only
+----------------------------------
 
-Version 11 (8.2.0 release)::
-* Formatting only
+==== Rule query
 
-Version 10 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name : "sc.exe" or
-process.pe.original_file_name == "sc.exe") and process.parent.name :
-("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe",
-"wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and
-process.args:("config", "create", "start", "delete", "stop", "pause")
-and /* exclude SYSTEM SID - look for service creations by non-SYSTEM
-user */ not user.id : "S-1-5-18"
-----------------------------------
 
-Version 9 (7.13.0 release)::
-* Rule name changed from: Local Service Commands
-+
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:sc.exe and process.args:(config or create or failure or
-start)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
+/* This rule is not compatible with Sysmon due to user.id issues */
 
-Version 4 (7.9.1 release)::
-* Formatting only
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "sc.exe" or process.pe.original_file_name == "sc.exe") and
+  process.parent.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe",
+                         "wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and
+  process.args:("config", "create", "start", "delete", "stop", "pause") and
+  /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */
+  not user.id : "S-1-5-18"
 
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:sc.exe and process.args:(config or create or failure or
-start)
 ----------------------------------
 
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:sc.exe and process.args:("create" or "config" or
-"failure" or "start")
-----------------------------------
+*Framework*: MITRE ATT&CK^TM^
 
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/service-creation-via-local-kerberos-authentication.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-creation-via-local-kerberos-authentication.asciidoc
index 176929fcbd..2fb132c537 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-creation-via-local-kerberos-authentication.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-creation-via-local-kerberos-authentication.asciidoc
@@ -5,65 +5,68 @@ Identifies a suspicious local successful logon event where the Logon Package is
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/Dec0ne/KrbRelayUp
 * https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
 * https://github.com/cube0x0/KrbRelay
 * https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Credential Access
-
-*Version*: 100 (<<service-creation-via-local-kerberos-authentication-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Credential Access
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5m [authentication where /* event
-4624 need to be logged */ event.action == "logged-in" and
-event.outcome == "success" and /* authenticate locally using
-relayed kerberos Ticket */
-winlog.event_data.AuthenticationPackageName :"Kerberos" and
-winlog.logon.type == "Network" and cidrmatch(source.ip,
-"127.0.0.0/8", "::1") and source.port > 0] by
-winlog.event_data.TargetLogonId [any where /* event 4697 need to
-be logged */ event.action : "service-installed"] by
-winlog.event_data.SubjectLogonId
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name with maxspan=5m
+ [authentication where
+
+  /* event 4624 need to be logged */
+  event.action == "logged-in" and event.outcome == "success" and
 
-==== Threat mapping
+  /* authenticate locally using relayed kerberos Ticket */
+  winlog.event_data.AuthenticationPackageName :"Kerberos" and winlog.logon.type == "Network" and
+  cidrmatch(source.ip, "127.0.0.0/8", "::1") and source.port > 0] by winlog.event_data.TargetLogonId
+
+  [any where
+   /* event 4697 need to be logged */
+   event.action : "service-installed"] by winlog.event_data.SubjectLogonId
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,8 +78,10 @@ winlog.event_data.SubjectLogonId
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
 * Tactic:
 ** Name: Credential Access
 ** ID: TA0006
@@ -85,13 +90,3 @@ winlog.event_data.SubjectLogonId
 ** Name: Steal or Forge Kerberos Tickets
 ** ID: T1558
 ** Reference URL: https://attack.mitre.org/techniques/T1558/
-
-[[service-creation-via-local-kerberos-authentication-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/setuid-setgid-bit-set-via-chmod.asciidoc b/docs/detections/prebuilt-rules/rule-details/setuid-setgid-bit-set-via-chmod.asciidoc
index 3be9360143..d8b09557f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/setuid-setgid-bit-set-via-chmod.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/setuid-setgid-bit-set-via-chmod.asciidoc
@@ -5,7 +5,7 @@ An adversary may add the setuid or setgid bit to a file or directory in order to
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,59 +14,63 @@ An adversary may add the setuid or setgid bit to a file or directory in order to
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<setuid-setgid-bit-set-via-chmod-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.category:process AND event.type:(start OR process_started) AND
-process.name:chmod AND process.args:("+s" OR "u+s" OR /4[0-9]{3}/ OR
-g+s OR /2[0-9]{3}/) AND NOT process.args: (
-/.*\/Applications\/VirtualBox.app\/.+/ OR
-/\/usr\/local\/lib\/python.+/ OR
-/\/var\/folders\/.+\/FP.*nstallHelper/ OR
-/\/Library\/Filesystems\/.+/ OR
-/\/usr\/lib\/virtualbox\/.+/ OR
-/\/Library\/Application.*/ OR "/run/postgresql" OR
-"/var/crash" OR "/var/run/postgresql" OR
-/\/usr\/bin\/.+/ OR /\/usr\/local\/share\/.+/ OR
-/\/Applications\/.+/ OR /\/usr\/libexec\/.+/ OR
-"/var/metrics" OR /\/var\/lib\/dpkg\/.+/ OR
-/\/run\/log\/journal\/.*/ OR
-\/Users\/*\/.minikube\/bin\/docker-machine-driver-hyperkit
-) AND NOT process.parent.executable: (
-/\/var\/lib\/docker\/.+/ OR "/System/Library/PrivateFrame
-works/PackageKit.framework/Versions/A/XPCServices/package_script_servi
-ce.xpc/Contents/MacOS/package_script_service" OR
-"/var/lib/dpkg/info/whoopsie.postinst" )
-----------------------------------
+ process.name:chmod AND process.args:("+s" OR "u+s" OR /4[0-9]{3}/ OR g+s OR /2[0-9]{3}/) AND
+ NOT process.args:
+           (
+             /.*\/Applications\/VirtualBox.app\/.+/ OR
+             /\/usr\/local\/lib\/python.+/ OR
+             /\/var\/folders\/.+\/FP.*nstallHelper/ OR
+             /\/Library\/Filesystems\/.+/ OR
+             /\/usr\/lib\/virtualbox\/.+/ OR
+             /\/Library\/Application.*/ OR
+             "/run/postgresql" OR
+             "/var/crash" OR
+             "/var/run/postgresql" OR
+             /\/usr\/bin\/.+/ OR /\/usr\/local\/share\/.+/ OR
+             /\/Applications\/.+/ OR /\/usr\/libexec\/.+/ OR
+             "/var/metrics" OR /\/var\/lib\/dpkg\/.+/ OR
+             /\/run\/log\/journal\/.*/ OR
+             \/Users\/*\/.minikube\/bin\/docker-machine-driver-hyperkit
+           ) AND
+ NOT process.parent.executable:
+           (
+             /\/var\/lib\/docker\/.+/ OR
+             "/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service" OR
+             "/var/lib/dpkg/info/whoopsie.postinst"
+           )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,59 +82,11 @@ ce.xpc/Contents/MacOS/package_script_service" OR
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-
+* Sub-technique:
+** Name: Setuid and Setgid
+** ID: T1548.001
+** Reference URL: https://attack.mitre.org/techniques/T1548/001/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-[[setuid-setgid-bit-set-via-chmod-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process AND event.type:(start OR process_started) AND
-process.name:chmod AND process.args:("+s" OR "u+s" OR /4[0-9]{3}/ OR
-g+s OR /2[0-9]{3}/)
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Rule name changed from: Setuid Bit Set via chmod
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process AND event.type:(start or process_started) AND
-process.name:chmod AND process.args:(u+s OR /4[0-9]{3}/) AND NOT
-user.name:root
-----------------------------------
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:(executed OR process_started) AND process.name:chmod AND
-process.args:(u+s OR /4[0-9]{3}/) AND NOT user.name:root
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc
new file mode 100644
index 0000000000..2ff896a6d5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc
@@ -0,0 +1,68 @@
+[[shared-object-created-or-changed-by-previously-unknown-process]]
+=== Shared Object Created or Changed by Previously Unknown Process
+
+This rule monitors the creation of shared object files by previously unknown processes. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime. While this process is typically used for legitimate purposes, malicious actors can leverage shared object files to execute unauthorized code, inject malicious functionality into legitimate processes, or bypass security controls. This allows malware to persist on the system, evade detection, and potentially compromise the integrity and confidentiality of the affected system and its data.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://threatpost.com/sneaky-malware-backdoors-linux/180158/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.action:(creation or file_create_event or file_rename_event or rename) and 
+file.path:(/dev/shm/* or /usr/lib/*) and file.extension:so and 
+process.name:(* and not (5 or dockerd or dpkg or rpm or snapd))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc b/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
index 1bee260ff2..fddf0b5c4b 100644
--- a/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
@@ -5,7 +5,7 @@ Identifies the occurence of files uploaded to SharePoint being detected as Malwa
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-o365*
@@ -14,59 +14,47 @@ Identifies the occurence of files uploaded to SharePoint being detected as Malwa
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Microsoft 365
-* Continuous Monitoring
-* SecOps
-* Lateral Movement
-
-*Version*: 101 (<<sharepoint-malware-file-upload-history, version history>>)
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Benign files can trigger signatures in the built-in virus protection
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:o365.audit and event.provider:SharePoint and
-event.code:SharePointFileOperation and
-event.action:FileMalwareDetected
+[source, js]
 ----------------------------------
+event.dataset:o365.audit and event.provider:SharePoint and event.code:SharePointFileOperation and event.action:FileMalwareDetected
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,19 +66,3 @@ event.action:FileMalwareDetected
 ** Name: Taint Shared Content
 ** ID: T1080
 ** Reference URL: https://attack.mitre.org/techniques/T1080/
-
-[[sharepoint-malware-file-upload-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc b/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
index ee50e096e0..11ac5349ed 100644
--- a/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of the shell process (sh) via scripting (JXA or AppleSc
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,48 +14,43 @@ Identifies the execution of the shell process (sh) via scripting (JXA or AppleSc
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.apple.com/library/archive/technotes/tn2065/_index.html
 * https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Execution
-
-*Version*: 100 (<<shell-execution-via-apple-scripting-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name == "osascript"]
-by process.pid [process where event.type in ("start",
-"process_started") and process.name == "sh" and process.args == "-c"]
-by process.parent.pid
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=5s
+ [process where host.os.type == "macos" and event.type in ("start", "process_started", "info") and process.name == "osascript"] by process.pid
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.parent.pid
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -67,28 +62,3 @@ by process.parent.pid
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[shell-execution-via-apple-scripting-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [process where event.type in
-("start", "process_started", "info") and process.name == "osascript"]
-by process.pid [process where event.type in ("start",
-"process_started") and process.name == "sh" and process.args == "-c"]
-by process.ppid
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc b/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc
index ed42ba2465..d9c11931df 100644
--- a/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of Windows Work Folders to execute a potentially masqueraded
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -15,98 +15,84 @@ Identifies the use of Windows Work Folders to execute a potentially masqueraded
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows-server/storage/work-folders/work-folders-overview
 * https://twitter.com/ElliotKillick/status/1449812843772227588
 * https://lolbas-project.github.io/lolbas/Binaries/WorkFolders/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<signed-proxy-execution-via-ms-work-folders-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Signed Proxy Execution via MS Work Folders
 
-Work Folders is a role service for file servers running Windows Server that provides a consistent way for users to access
-their work files from their PCs and devices. This allows users to store work files and access them from anywhere. When
-called, Work Folders will automatically execute any Portable Executable (PE) named control.exe as an argument before
-accessing the synced share.
+Work Folders is a role service for file servers running Windows Server that provides a consistent way for users to access their work files from their PCs and devices. This allows users to store work files and access them from anywhere. When called, Work Folders will automatically execute any Portable Executable (PE) named control.exe as an argument before accessing the synced share.
 
-Using Work Folders to execute a masqueraded control.exe could allow an adversary to bypass application controls and
-increase privileges.
+Using Work Folders to execute a masqueraded control.exe could allow an adversary to bypass application controls and increase privileges.
 
 #### Possible investigation steps
 
-- Investigate the process tree starting with parent process WorkFolders.exe and child process control.exe to determine
-if other child processes spawned during execution.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+    - Examine the location of the WorkFolders.exe binary to determine if it was copied to the location of the control.exe binary. It resides in the System32 directory by default.
 - Trace the activity related to the control.exe binary to identify any continuing intrusion activity on the host.
-- Examine the location of the WorkFolders.exe binary to determine if it was copied to the location of the control.exe
-binary. It resides in the System32 directory by default.
-- Review the control.exe binary executed with Work Folders to determine maliciousness such as additional host activity
-or network traffic.
+- Review the control.exe binary executed with Work Folders to determine maliciousness such as additional host activity or network traffic.
 - Determine if control.exe was synced to sync share, indicating potential lateral movement.
 - Review how control.exe was originally delivered on the host, such as emailed, downloaded from the web, or written to
 disk from a separate binary.
 
 ### False positive analysis
 
-- Windows Work Folders are used legitimately by end users and administrators for file sharing and syncing but not in the
-instance where a suspicious control.exe is passed as an argument.
+- Windows Work Folders are used legitimately by end users and administrators for file sharing and syncing but not in the instance where a suspicious control.exe is passed as an argument.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Review the Work Folders synced share to determine if the control.exe was shared and if so remove it.
-- If no lateral movement was identified during investigation, take the affected host offline if possible and remove the
-control.exe binary as well as any additional artifacts identified during investigation.
-- Review integrating Windows Information Protection (WIP) to enforce data protection by encrypting the data on PCs using
-Work Folders.
+- If no lateral movement was identified during investigation, take the affected host offline if possible and remove the control.exe binary as well as any additional artifacts identified during investigation.
+- Review integrating Windows Information Protection (WIP) to enforce data protection by encrypting the data on PCs using Work Folders.
 - Confirm with the user whether this was expected or not, and reset their password.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name :
-"control.exe" and process.parent.name : "WorkFolders.exe" and not
-process.executable : ("?:\\Windows\\System32\\control.exe",
-"?:\\Windows\\SysWOW64\\control.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start"
+    and process.name : "control.exe" and process.parent.name : "WorkFolders.exe"
+    and not process.executable : ("?:\\Windows\\System32\\control.exe", "?:\\Windows\\SysWOW64\\control.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,27 +104,3 @@ process.executable : ("?:\\Windows\\System32\\control.exe",
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[signed-proxy-execution-via-ms-work-folders-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start","process_started") and
-process.name : "control.exe" and process.parent.name :
-"WorkFolders.exe" and not process.executable :
-("?:\\Windows\\System32\\control.exe",
-"?:\\Windows\\SysWOW64\\control.exe")
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Rule name changed from: Signed Proxy Execution via MS WorkFolders
diff --git a/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc
index 3229198a3a..0d1cdc8738 100644
--- a/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to the registered Subject Interface Package (SIP) provi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * endgame-*
@@ -14,51 +14,48 @@ Identifies modifications to the registered Subject Interface Package (SIP) provi
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/mattifestation/PoCSubjectInterfacePackage
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 101 (<<sip-provider-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type:"change" and registry.path: (
-"*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType
-0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll",
-"*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType
-0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll", "*\\SOFTWARE\\Microsoft
-\\Cryptography\\Providers\\Trust\\FinalPolicy\\{*}\\$Dll", "*\\SOF
-TWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPo
-licy\\{*}\\$Dll" ) and registry.data.strings:"*.dll"
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type:"change" and
+  registry.path: (
+    "*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll",
+    "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll",
+    "*\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{*}\\$Dll",
+    "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{*}\\$Dll"
+    ) and
+  registry.data.strings:"*.dll"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,31 +67,7 @@ licy\\{*}\\$Dll" ) and registry.data.strings:"*.dll"
 ** Name: Subvert Trust Controls
 ** ID: T1553
 ** Reference URL: https://attack.mitre.org/techniques/T1553/
-
-[[sip-provider-modification-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type:"change" and registry.path: (
-"HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType
-0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll", "HKLM\\SOFTWARE\\WOW643
-2Node\\Microsoft\\Cryptography\\OID\\EncodingType
-0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll", "HKLM\\SOFTWARE\\Micros
-oft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{*}\\$Dll", "HKL
-M\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\F
-inalPolicy\\{*}\\$Dll" ) and registry.data.strings:"*.dll"
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SIP and Trust Provider Hijacking
+** ID: T1553.003
+** Reference URL: https://attack.mitre.org/techniques/T1553/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/smb-windows-file-sharing-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/smb-windows-file-sharing-activity-to-the-internet.asciidoc
index 18f20bdfe5..24d18d2d73 100644
--- a/docs/detections/prebuilt-rules/rule-details/smb-windows-file-sharing-activity-to-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/smb-windows-file-sharing-activity-to-the-internet.asciidoc
@@ -5,66 +5,82 @@ This rule detects network events that may indicate the use of Windows file shari
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Initial Access
-* Host
-
-*Version*: 100 (<<smb-windows-file-sharing-activity-to-the-internet-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:(139 or 445) or event.dataset:zeek.smb) and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16
-) and not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or
-169.254.0.0/16 or 172.16.0.0/12 or 192.0.0.0/24 or
-192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or
-192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or
-192.0.2.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or
-192.168.0.0/16 or 192.88.99.0/24 or 224.0.0.0/4 or
-100.64.0.0/10 or 192.175.48.0/24 or 198.18.0.0/15 or
-198.51.100.0/24 or 203.0.113.0/24 or 240.0.0.0/4 or "::1"
-or "FE80::/10" or "FF00::/8" )
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,8 +92,6 @@ or "FE80::/10" or "FF00::/8" )
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-
 * Tactic:
 ** Name: Exfiltration
 ** ID: TA0010
@@ -86,75 +100,3 @@ or "FE80::/10" or "FF00::/8" )
 ** Name: Exfiltration Over Alternative Protocol
 ** ID: T1048
 ** Reference URL: https://attack.mitre.org/techniques/T1048/
-
-[[smb-windows-file-sharing-activity-to-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 11 (7.15.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:(139 or 445) or event.dataset:zeek.smb) and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 ) and not
-destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or "::1" or "FE80::/10"
-or "FF00::/8" )
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:(139 or 445) or event.dataset:zeek.smb) and
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port:(139 or 445) and
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 3 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport: tcp and destination.port: (139 or 445) and (
-network.direction: outbound or ( source.ip: (10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16) and not destination.ip: (10.0.0.0/8
-or 172.16.0.0/12 or 192.168.0.0/16) ) )
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/smtp-on-port-26-tcp.asciidoc b/docs/detections/prebuilt-rules/rule-details/smtp-on-port-26-tcp.asciidoc
index 72bfb54ff9..545dbcd30f 100644
--- a/docs/detections/prebuilt-rules/rule-details/smtp-on-port-26-tcp.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/smtp-on-port-26-tcp.asciidoc
@@ -5,62 +5,50 @@ This rule detects events that may indicate use of SMTP on TCP port 26. This port
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://unit42.paloaltonetworks.com/unit42-badpatch/
 * https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<smtp-on-port-26-tcp-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:26 or (event.dataset:zeek.smtp and
-destination.port:26))
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,8 +56,6 @@ destination.port:26))
 ** Name: Command and Control
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
-
-
 * Tactic:
 ** Name: Exfiltration
 ** ID: TA0010
@@ -78,46 +64,3 @@ destination.port:26))
 ** Name: Exfiltration Over Alternative Protocol
 ** ID: T1048
 ** Reference URL: https://attack.mitre.org/techniques/T1048/
-
-[[smtp-on-port-26-tcp-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and (destination.port:26 or (event.dataset:zeek.smtp and
-destination.port:26))
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port:26
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
index 04b72795d9..f279960286 100644
--- a/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies changes to the SoftwareUpdate preferences using the built-in defaults
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,51 +14,42 @@ Identifies changes to the SoftwareUpdate preferences using the built-in defaults
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<softwareupdate-preferences-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Authorized SoftwareUpdate Settings Changes
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:defaults and process.args:(write and "-bool" and
-(com.apple.SoftwareUpdate or
-/Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or
-true))
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:defaults and
+ process.args:(write and "-bool" and (com.apple.SoftwareUpdate or /Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or true))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,22 +61,7 @@ true))
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[softwareupdate-preferences-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:defaults and process.args:(write and "-bool" and
-(com.apple.SoftwareUpdate or
-/Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or
-true))
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
index a08a234723..2f692a4917 100644
--- a/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
@@ -5,7 +5,7 @@ Identifies a SolarWinds binary modifying the start type of a service to be disab
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,61 +16,61 @@ Identifies a SolarWinds binary modifying the start type of a service to be disab
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 101 (<<solarwinds-process-disabling-services-via-registry-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path : (
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start",
-"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Start" )
-and registry.data.strings : ("4", "0x00000004") and process.name :
-( "SolarWinds.BusinessLayerHost*.exe",
-"ConfigurationWizard*.exe", "NetflowDatabaseMaintenance*.exe",
-"NetFlowService*.exe", "SolarWinds.Administration*.exe",
-"SolarWinds.Collector.Service*.exe",
-"SolarwindsDiagnostics*.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Start"
+  ) and
+  registry.data.strings : ("4", "0x00000004") and
+  process.name : (
+      "SolarWinds.BusinessLayerHost*.exe",
+      "ConfigurationWizard*.exe",
+      "NetflowDatabaseMaintenance*.exe",
+      "NetFlowService*.exe",
+      "SolarWinds.Administration*.exe",
+      "SolarWinds.Collector.Service*.exe",
+      "SolarwindsDiagnostics*.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -82,8 +82,10 @@ and registry.data.strings : ("4", "0x00000004") and process.name :
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -92,64 +94,7 @@ and registry.data.strings : ("4", "0x00000004") and process.name :
 ** Name: Supply Chain Compromise
 ** ID: T1195
 ** Reference URL: https://attack.mitre.org/techniques/T1195/
-
-[[solarwinds-process-disabling-services-via-registry-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start" and
-registry.data.strings : ("4", "0x00000004") and process.name : (
-"SolarWinds.BusinessLayerHost*.exe", "ConfigurationWizard*.exe",
-"NetflowDatabaseMaintenance*.exe", "NetFlowService*.exe",
-"SolarWinds.Administration*.exe",
-"SolarWinds.Collector.Service*.exe" ,
-"SolarwindsDiagnostics*.exe")
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start" and
-registry.data.strings : ("4", "0x00000004") and process.name : (
-"SolarWinds.BusinessLayerHost*.exe",
-"ConfigurationWizard*.exe", "NetflowDatabaseMaintenance*.exe",
-"NetFlowService*.exe", "SolarWinds.Administration*.exe",
-"SolarWinds.Collector.Service*.exe" ,
-"SolarwindsDiagnostics*.exe")
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start" and
-registry.data.strings == "4" and process.name : (
-"SolarWinds.BusinessLayerHost*.exe", "ConfigurationWizard*.exe",
-"NetflowDatabaseMaintenance*.exe", "NetFlowService*.exe",
-"SolarWinds.Administration*.exe",
-"SolarWinds.Collector.Service*.exe" ,
-"SolarwindsDiagnostics*.exe")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc
index 56a5c78cfa..86c56bb553 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc
@@ -5,89 +5,71 @@ A machine learning job detected a significant spike in the rate of a particular
 
 *Rule type*: machine_learning
 
-*Machine learning job*: high_distinct_count_error_message
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* ML
-* Investigation Guide
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Resources: Investigation Guide
 
-*Version*: 102 (<<spike-in-aws-error-messages-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 7.9.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Spikes in error message activity can also be due to bugs in cloud automation scripts or workflows; changes to cloud automation scripts or workflows; adoption of new services; changes in the way services are used; or changes to IAM privileges.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Spike in AWS Error Messages
 
-CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and
-understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity
-when deviations occur.
+CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
-This rule uses a machine learning job to detect a significant spike in the rate of a particular error in the CloudTrail
-messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.
+This rule uses a machine learning job to detect a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.
 
 #### Possible investigation steps
 
-- Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an
-automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.
+- Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Validate the activity is not related to planned patches, updates, or network administrator activity.
-- Examine the request parameters. These may indicate the source of the program or the nature of the task being performed
-when the error occurred.
+- Examine the request parameters. These may indicate the source of the program or the nature of the task being performed when the error occurred.
     - Check whether the error is related to unsuccessful attempts to enumerate or access objects, data, or secrets.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal
-time of day?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- Examine the history of the command. If the command only manifested recently, it might be part of a new automation
-module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence),
-it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
+- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 - The adoption of new services or the addition of new functionality to scripts may generate false positives.
 
 ### Related Rules
@@ -107,53 +89,12 @@ it might be part of a housekeeping or maintenance process. You can find the comm
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-
-
-[[spike-in-aws-error-messages-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.2.0 release)::
-* Formatting only
-
-Version 8 (8.1.0 release)::
-* Formatting only
-
-Version 7 (7.16.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc
index b1ebb8da73..3c1882f83d 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc
@@ -5,47 +5,77 @@ A machine learning job found an unusually large spike in authentication failure
 
 *Rule type*: machine_learning
 
-*Machine learning job*: auth_high_count_logon_fails
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 103
+
+*Rule authors*: 
 
 * Elastic
-* Authentication
-* Threat Detection
-* ML
-* Credential Access
 
-*Version*: 100 (<<spike-in-failed-logon-events-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.14.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Spike in Failed Logon Events
+
+This rule uses a machine learning job to detect a substantial spike in failed authentication events. This could indicate attempts to enumerate users, password spraying, brute force, etc.
+
+#### Possible investigation steps
 
-==== Potential false positives
+- Identify the users involved and if the activity targets a specific user or a set of users.
+- Check if the authentication comes from different sources.
+- Investigate if the host where the failed authentication events occur is exposed to the internet.
+  - If the host is exposed to the internet, and the source of these attempts is external, the activity can be related to bot activity and possibly not directed at your organization.
+  - If the host is not exposed to the internet, investigate the hosts where the authentication attempts are coming from, as this can indicate that they are compromised and the attacker is trying to move laterally.
+- Investigate other alerts associated with the involved users and hosts during the past 48 hours.
+- Check whether the involved credentials are used in automation or scheduled tasks.
+- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
+- Investigate whether there are successful authentication events from the involved sources. This could indicate a successful brute force or password spraying attack.
 
-A misconfigured service account can trigger this alert. A password change on an account used by an email client can trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert.
-==== Threat mapping
+### False positive analysis
+
+- If the account is used in automation tasks, it is possible that they are using expired credentials, causing a spike in authentication failures.
+- Authentication failures can be related to permission issues.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Assess whether the asset should be exposed to the internet, and take action to reduce your attack surface.
+  - If the asset needs to be exposed to the internet, restrict access to remote login services to specific IPs.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,16 +87,3 @@ A misconfigured service account can trigger this alert. A password change on an
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[spike-in-failed-logon-events-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-firewall-denies.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-firewall-denies.asciidoc
index 3caab81be3..e4fe12f3b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-firewall-denies.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-firewall-denies.asciidoc
@@ -5,52 +5,33 @@ A machine learning job detected an unusually large spike in network traffic that
 
 *Rule type*: machine_learning
 
-*Machine learning job*: high_count_network_denies
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Network
-* Threat Detection
-* ML
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Version*: 100 (<<spike-in-firewall-denies-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.13.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A misconfgured network application or firewall may trigger this alert. Security scans or test cycles may trigger this alert.
-
-[[spike-in-firewall-denies-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (7.14.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events.asciidoc
index 4974592e40..8ff6ba214d 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events.asciidoc
@@ -5,47 +5,38 @@ A machine learning job found an unusually large spike in successful authenticati
 
 *Rule type*: machine_learning
 
-*Machine learning job*: auth_high_count_logon_events
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Authentication
-* Threat Detection
-* ML
-* Credential Access
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
 
-*Version*: 100 (<<spike-in-logon-events-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.14.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Build servers and CI systems can sometimes trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,13 +48,3 @@ Build servers and CI systems can sometimes trigger this alert. Security test cyc
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[spike-in-logon-events-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc
index da5570f108..f81dbd2fe8 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc
@@ -1,56 +1,81 @@
 [[spike-in-network-traffic-to-a-country]]
 === Spike in Network Traffic To a Country
 
-A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.
+A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country that does not normally appear in network traffic or business workflows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.
 
 *Rule type*: machine_learning
 
-*Machine learning job*: high_count_by_destination_country
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
+
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+
+*Version*: 103
+
+*Rule authors*: 
 
 * Elastic
-* Network
-* Threat Detection
-* ML
 
-*Version*: 100 (<<spike-in-network-traffic-to-a-country-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.13.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Spike in Network Traffic To a Country
+
+Monitoring network traffic for anomalies is a good methodology for uncovering various potentially suspicious activities. For example, data exfiltration or infected machines may communicate with a command-and-control (C2) server in another country your company doesn't have business with.
+
+This rule uses a machine learning job to detect a significant spike in the network traffic to a country, which can indicate reconnaissance or enumeration activities, an infected machine being used as a bot in a DDoS attack, or potentially data exfiltration.
+
+#### Possible investigation steps
 
-==== Potential false positives
+- Identify the specifics of the involved assets, such as role, criticality, and associated users.
+- Investigate other alerts associated with the involved assets during the past 48 hours.
+- Examine the data available and determine the exact users and processes involved in those connections.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Consider the time of day. If the user is a human (not a program or script), did the activity occurs during working hours?
+- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
 
-Business workflows that occur very occasionally, and involve an unusual surge in network traffic to one destination country, can trigger this alert. A new business workflow or a surge in business activity in a particular country may trigger this alert. Business travelers who roam to many countries for brief periods may trigger this alert if they engage in volumetric network activity.
+### False positive analysis
 
-[[spike-in-network-traffic-to-a-country-history]]
-==== Rule version history
+- Understand the context of the connections by contacting the asset owners. If this activity is related to a new business process or newly implemented (approved) technology, consider adding exceptions — preferably with a combination of user and source conditions.
 
-Version 100 (8.5.0 release)::
-* Formatting only
+### Response and remediation
 
-Version 2 (7.14.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+  - Remove and block malicious artifacts identified during triage.
+- Consider implementing temporary network border rules to block or alert connections to the target country, if relevant.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic.asciidoc
index c462f101d3..7a17c7e7b1 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic.asciidoc
@@ -5,55 +5,33 @@ A machine learning job detected an unusually large spike in network traffic. Suc
 
 *Rule type*: machine_learning
 
-*Machine learning job*: high_count_network_events
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Network
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<spike-in-network-traffic-history, version history>>)
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Business workflows that occur very occasionally, and involve an unusual surge in network traffic, can trigger this alert. A new business workflow or a surge in business activity may trigger this alert. A misconfigured network application or firewall may trigger this alert.
-
-[[spike-in-network-traffic-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (7.15.0 release)::
-* Formatting only
-
-Version 2 (7.14.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc
new file mode 100644
index 0000000000..b27c749281
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc
@@ -0,0 +1,100 @@
+[[spike-in-successful-logon-events-from-a-source-ip]]
+=== Spike in Successful Logon Events from a Source IP
+
+A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Spike in Successful Logon Events from a Source IP
+
+This rule uses a machine learning job to detect a substantial spike in successful authentication events. This could indicate post-exploitation activities that aim to test which hosts, services, and other resources the attacker can access with the compromised credentials.
+
+#### Possible investigation steps
+
+- Identify the specifics of the involved assets, such as role, criticality, and associated users.
+- Check if the authentication comes from different sources.
+- Use the historical data available to determine if the same behavior happened in the past.
+- Investigate other alerts associated with the involved users during the past 48 hours.
+- Check whether the involved credentials are used in automation or scheduled tasks.
+- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
+
+### False positive analysis
+
+- Understand the context of the authentications by contacting the asset owners. If this activity is related to a new business process or newly implemented (approved) technology, consider adding exceptions — preferably with a combination of user and source conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Domain Accounts
+** ID: T1078.002
+** Reference URL: https://attack.mitre.org/techniques/T1078/002/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modification.asciidoc
index 1832dd4ebb..2718ee7d16 100644
--- a/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modification.asciidoc
@@ -5,7 +5,7 @@ The Secure Shell (SSH) authorized_keys file specifies which users are allowed to
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,49 +14,54 @@ The Secure Shell (SSH) authorized_keys file specifies which users are allowed to
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<ssh-authorized-keys-file-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.category:file and event.type:(change or creation) and
-file.name:("authorized_keys" or "authorized_keys2") and not
-process.executable:
-(/Library/Developer/CommandLineTools/usr/bin/git or
-/usr/local/Cellar/maven/*/libexec/bin/mvn or
-/Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or
-/usr/bin/vim or /usr/local/Cellar/coreutils/*/bin/gcat
-or /usr/bin/bsdtar or /usr/bin/nautilus or
-/usr/bin/scp or /usr/bin/touch or
-/var/lib/docker/* or /usr/bin/google_guest_agent)
-----------------------------------
+ file.name:("authorized_keys" or "authorized_keys2" or "/etc/ssh/sshd_config" or "/root/.ssh") and
+ not process.executable:
+             (/Library/Developer/CommandLineTools/usr/bin/git or
+              /usr/local/Cellar/maven/*/libexec/bin/mvn or
+              /Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or
+              /usr/bin/vim or
+              /usr/local/Cellar/coreutils/*/bin/gcat or
+              /usr/bin/bsdtar or
+              /usr/bin/nautilus or
+              /usr/bin/scp or
+              /usr/bin/touch or
+              /var/lib/docker/* or
+              /usr/bin/google_guest_agent or 
+              /opt/jc/bin/jumpcloud-agent)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,44 +73,27 @@ or /usr/bin/bsdtar or /usr/bin/nautilus or
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[ssh-authorized-keys-file-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:(change or creation) and
-file.name:("authorized_keys" or "authorized_keys2") and not
-process.executable:
-(/Library/Developer/CommandLineTools/usr/bin/git or
-/usr/local/Cellar/maven/*/libexec/bin/mvn or
-/Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or
-/usr/bin/vim or /usr/local/Cellar/coreutils/*/bin/gcat
-or /usr/bin/bsdtar or /usr/bin/nautilus
-or /usr/bin/scp or /usr/bin/touch or
-/var/lib/docker/* or /usr/bin/google_guest_agent)
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:(change or creation) and
-file.name:("authorized_keys" or "authorized_keys2") and not
-process.executable:
-(/Library/Developer/CommandLineTools/usr/bin/git or
-/usr/local/Cellar/maven/*/libexec/bin/mvn or
-/Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or
-/usr/bin/vim or /usr/local/Cellar/coreutils/*/bin/gcat
-or /usr/bin/bsdtar or /usr/bin/nautilus
-or /usr/bin/scp or /usr/bin/touch or
-/var/lib/docker/*)
-----------------------------------
-
+* Sub-technique:
+** Name: SSH Authorized Keys
+** ID: T1098.004
+** Reference URL: https://attack.mitre.org/techniques/T1098/004/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Service Session Hijacking
+** ID: T1563
+** Reference URL: https://attack.mitre.org/techniques/T1563/
+* Sub-technique:
+** Name: SSH Hijacking
+** ID: T1563.001
+** Reference URL: https://attack.mitre.org/techniques/T1563/001/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modified-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modified-inside-a-container.asciidoc
new file mode 100644
index 0000000000..c3aa161a67
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/ssh-authorized-keys-file-modified-inside-a-container.asciidoc
@@ -0,0 +1,85 @@
+[[ssh-authorized-keys-file-modified-inside-a-container]]
+=== SSH Authorized Keys File Modified Inside a Container
+
+This rule detects the creation or modification of an authorized_keys or sshd_config file inside a container. The Secure Shell (SSH) authorized_keys file specifies which users are allowed to log into a server using public key authentication. Adversaries may modify it to maintain persistence on a victim host by adding their own public key(s). Unexpected and unauthorized SSH usage inside a container can be an indicator of compromise and should be investigated.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Lateral Movement
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where container.id:"*" and
+  event.type in ("change", "creation") and file.name: ("authorized_keys", "authorized_keys2", "sshd_config")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: SSH Authorized Keys
+** ID: T1098.004
+** Reference URL: https://attack.mitre.org/techniques/T1098/004/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Service Session Hijacking
+** ID: T1563
+** Reference URL: https://attack.mitre.org/techniques/T1563/
+* Sub-technique:
+** Name: SSH Hijacking
+** ID: T1563.001
+** Reference URL: https://attack.mitre.org/techniques/T1563/001/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/ssh-connection-established-inside-a-running-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/ssh-connection-established-inside-a-running-container.asciidoc
new file mode 100644
index 0000000000..4f871d9fb7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/ssh-connection-established-inside-a-running-container.asciidoc
@@ -0,0 +1,83 @@
+[[ssh-connection-established-inside-a-running-container]]
+=== SSH Connection Established Inside A Running Container
+
+This rule detects an incoming SSH connection established inside a running container. Running an ssh daemon inside a container should be avoided and monitored closely if necessary. If an attacker gains valid credentials they can use it to gain initial access or establish persistence within a compromised environment.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/SSH%20server%20running%20inside%20container/
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Lateral Movement
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type == "start" and 
+
+/* use of sshd to enter a container*/
+process.entry_leader.entry_meta.type: "sshd"  and 
+
+/* process is the initial process run in a container or start of a new session*/
+(process.entry_leader.same_as_process== true or process.session_leader.same_as_process== true) and 
+
+/* interactive process*/
+process.interactive== true
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: External Remote Services
+** ID: T1133
+** Reference URL: https://attack.mitre.org/techniques/T1133/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/ssh-process-launched-from-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/ssh-process-launched-from-inside-a-container.asciidoc
new file mode 100644
index 0000000000..0d6ea8466d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/ssh-process-launched-from-inside-a-container.asciidoc
@@ -0,0 +1,77 @@
+[[ssh-process-launched-from-inside-a-container]]
+=== SSH Process Launched From Inside A Container
+
+This rule detects an SSH or SSHD process executed from inside a container. This includes both the client ssh binary and server ssh daemon process. SSH usage inside a container should be avoided and monitored closely when necessary. With valid credentials an attacker may move laterally to other containers or to the underlying host through container breakout. They may also use valid SSH credentials as a persistence mechanism.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/SSH%20server%20running%20inside%20container/
+* https://www.blackhillsinfosec.com/sshazam-hide-your-c2-inside-of-ssh/
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Persistence
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type== "start" and
+event.action in ("fork", "exec") and event.action != "end" and 
+process.name: ("sshd", "ssh", "autossh")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: External Remote Services
+** ID: T1133
+** Reference URL: https://attack.mitre.org/techniques/T1133/
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
index cd20dced90..dc74240d92 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
@@ -13,78 +13,71 @@ Identifies files written or modified in the startup folder by unsigned processes
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<startup-folder-persistence-via-unsigned-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Startup Folder Persistence via Unsigned Process
 
-The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account
-logon, without user interaction, providing an excellent way for attackers to maintain persistence.
+The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
 
 This rule looks for unsigned processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- There is a high possibility of benign legitimate programs being added to Startup folders. This activity could be based
-on new software installations, patches, or any kind of network administrator related activity. Before undertaking further
-investigation, verify that this activity is not benign.
+- There is a high possibility of benign legitimate programs being added to Startup folders. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.
 
 ### Related rules
 
@@ -99,43 +92,36 @@ investigation, verify that this activity is not benign.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=5s [process
-where event.type == "start" and process.code_signature.trusted ==
-false and /* suspicious paths can be added here */
-process.executable : ("C:\\Users\\*.exe",
-"C:\\ProgramData\\*.exe",
-"C:\\Windows\\Temp\\*.exe",
-"C:\\Windows\\Tasks\\*.exe",
-"C:\\Intel\\*.exe", "C:\\PerfLogs\\*.exe")
-] [file where event.type != "deletion" and user.domain != "NT
-AUTHORITY" and file.path :
-("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*",
-"C:\\ProgramData\\Microsoft\\Windows\\Start
-Menu\\Programs\\StartUp\\*") ]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id with maxspan=5s
+  [process where host.os.type == "windows" and event.type == "start" and process.code_signature.trusted == false and
+  /* suspicious paths can be added here  */
+   process.executable : ("C:\\Users\\*.exe",
+                         "C:\\ProgramData\\*.exe",
+                         "C:\\Windows\\Temp\\*.exe",
+                         "C:\\Windows\\Tasks\\*.exe",
+                         "C:\\Intel\\*.exe",
+                         "C:\\PerfLogs\\*.exe")
+   ]
+   [file where host.os.type == "windows" and event.type != "deletion" and user.domain != "NT AUTHORITY" and
+    file.path : ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+                 "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*")
+   ]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -147,43 +133,7 @@ Menu\\Programs\\StartUp\\*") ]
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[startup-folder-persistence-via-unsigned-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=5s [process
-where event.type in ("start", "process_started") and
-process.code_signature.trusted == false and /* suspicious paths can
-be added here */ process.executable : ("C:\\Users\\*.exe",
-"C:\\ProgramData\\*.exe",
-"C:\\Windows\\Temp\\*.exe",
-"C:\\Windows\\Tasks\\*.exe",
-"C:\\Intel\\*.exe", "C:\\PerfLogs\\*.exe")
-] [file where event.type != "deletion" and user.domain != "NT
-AUTHORITY" and file.path :
-("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*",
-"C:\\ProgramData\\Microsoft\\Windows\\Start
-Menu\\Programs\\StartUp\\*") ]
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
index a7e189305a..9b766a820d 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
@@ -5,71 +5,64 @@ Detects the modification of Group Policy Objects (GPO) to add a startup/logon sc
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md
 * https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md
 * https://labs.f-secure.com/tools/sharpgpoabuse
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<startup-logon-script-added-to-group-policy-object-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate Administrative Activity
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-### Investigating Scheduled Task Execution at Scale via GPO
+### Investigating Startup/Logon Script added to Group Policy Object
 
-Group Policy Objects (GPOs) can be used by attackers to instruct arbitrarily large groups of
-clients to execute specified commands at startup, logon, shutdown, and logoff. This is done by creating or modifying the
-`scripts.ini` or `psscripts.ini` files. The scripts are stored in the following path: `<GPOPath>\Machine\Scripts\`,
-`<GPOPath>\User\Scripts\`
+Group Policy Objects (GPOs) can be used by attackers to instruct arbitrarily large groups of clients to execute specified commands at startup, logon, shutdown, and logoff. This is done by creating or modifying the `scripts.ini` or `psscripts.ini` files. The scripts are stored in the following paths:
+  - `<GPOPath>\Machine\Scripts\`
+  - `<GPOPath>\User\Scripts\`
 
 #### Possible investigation steps
 
-- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity
-is legitimate and the administrator is authorized to perform this operation.
-- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any
-potentially malicious commands or binaries.
+- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
+- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any potentially malicious commands or binaries.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.
 
@@ -89,29 +82,27 @@ potentially malicious commands or binaries.
 - Remove the script from the GPO.
 - Check if other GPOs have suspicious scripts attached.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-( event.code:5136 and
-winlog.event_data.AttributeLDAPDisplayName:(gPCMachineExtensionNames
-or gPCUserExtensionNames) and winlog.event_data.AttributeValue:(*42
-B5FAAE-6536-11D2-AE5A-0000F87571E3* and
-(*40B66650-4972-11D1-A7CA-0000F87571E3* or
-*40B6664F-4972-11D1-A7CA-0000F87571E3*)) ) or ( event.code:5145 and
-winlog.event_data.ShareName:\\\\*\\SYSVOL and
-winlog.event_data.RelativeTargetName:(*\\scripts.ini or
-*\\psscripts.ini) and (message:WriteData or
-winlog.event_data.AccessList:*%%4417*) )
+[source, js]
 ----------------------------------
+(
+ event.code:5136 and winlog.event_data.AttributeLDAPDisplayName:(gPCMachineExtensionNames or gPCUserExtensionNames) and
+   winlog.event_data.AttributeValue:(*42B5FAAE-6536-11D2-AE5A-0000F87571E3* and
+                                      (*40B66650-4972-11D1-A7CA-0000F87571E3* or *40B6664F-4972-11D1-A7CA-0000F87571E3*))
+)
+or
+(
+ event.code:5145 and winlog.event_data.ShareName:\\\\*\\SYSVOL and
+   winlog.event_data.RelativeTargetName:(*\\scripts.ini or *\\psscripts.ini) and
+   (message:WriteData or winlog.event_data.AccessList:*%%4417*)
+)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -120,28 +111,14 @@ winlog.event_data.AccessList:*%%4417*) )
 ** ID: TA0004
 ** Reference URL: https://attack.mitre.org/tactics/TA0004/
 * Technique:
+** Name: Domain Policy Modification
+** ID: T1484
+** Reference URL: https://attack.mitre.org/techniques/T1484/
+* Sub-technique:
+** Name: Group Policy Modification
+** ID: T1484.001
+** Reference URL: https://attack.mitre.org/techniques/T1484/001/
+* Technique:
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[startup-logon-script-added-to-group-policy-object-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index f0b1df5ede..95c907d3c2 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -13,79 +13,71 @@ Identifies run key or startup key registry modifications. In order to survive re
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<startup-or-run-key-registry-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Startup or Run Key Registry Modification
 
-Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys
-in the registry will cause the program referenced to be executed when a user logs in. These programs will executed
-under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring
-a range of registry run keys.
+Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
 
-- There is a high possibility of benign legitimate programs being added to registry run keys. This activity could be
-based on new software installations, patches, or any kind of network administrator related activity. Before undertaking
-further investigation, verify that this activity is not benign.
+- There is a high possibility of benign legitimate programs being added to registry run keys. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.
 
 ### Related rules
 
@@ -102,57 +94,116 @@ further investigation, verify that this activity is not benign.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.data.strings != null and registry.path : (
-/* Machine Hive */
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explore
-r\\Run\\*", "HKLM\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*", /* Users Hive */
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion
-\\RunOnceEx\\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\Cu
-rrentVersion\\Policies\\Explorer\\Run\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*" ) and /* add common
-legitimate changes without being too restrictive as this is one of the
-most abused AESPs */ not registry.data.strings : "ctfmon.exe /n" and
-not (registry.value : "Application Restart #*" and process.name :
-"csrss.exe") and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
-and not registry.data.strings : ("?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe") and not process.executable :
-("?:\\Windows\\System32\\msiexec.exe",
-"?:\\Windows\\SysWOW64\\msiexec.exe") and not (process.name :
-"OneDriveSetup.exe" and registry.value : ("Delete Cached
-Standalone Update Binary", "Delete Cached Update Binary", "amd64",
-"Uninstall *") and registry.data.strings :
-"?:\\Windows\\system32\\cmd.exe /q /c *
-\"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\"")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.data.strings != null and
+ registry.path : (
+     /* Machine Hive */
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+     "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+     /* Users Hive */
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*"
+     ) and
+  /* add common legitimate changes without being too restrictive as this is one of the most abused AESPs */
+  not registry.data.strings : "ctfmon.exe /n" and
+  not (registry.value : "Application Restart #*" and process.name : "csrss.exe") and
+  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+  not registry.data.strings : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
+  not process.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\SysWOW64\\msiexec.exe") and
+  not (
+    /* Logitech G Hub */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name : "Logitech Inc" and
+      process.name : "lghub_agent.exe" and registry.data.strings : (
+        "\"?:\\Program Files\\LGHUB\\lghub.exe\" --background"
+      )
+    ) or
+
+    /* Google Drive File Stream, Chrome, and Google Update */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name : "Google LLC" and
+      (
+        process.name : "GoogleDriveFS.exe" and registry.data.strings : (
+        "\"?:\\Program Files\\Google\\Drive File Stream\\*\\GoogleDriveFS.exe\" --startup_mode"
+        ) or
+
+        process.name : "chrome.exe" and registry.data.strings : (
+          "\"?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5",
+          "\"?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5"
+        ) or
+
+        process.name : "GoogleUpdate.exe" and registry.data.strings : (
+          "\"?:\\Users\\*\\AppData\\Local\\Google\\Update\\*\\GoogleUpdateCore.exe\""
+        )
+      )
+    ) or
+
+    /* MS Programs */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and
+      (
+        process.name : "msedge.exe" and registry.data.strings : (
+          "\"?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start /prefetch:5"
+        ) or
+
+        process.name : ("Update.exe", "Teams.exe") and registry.data.strings : (
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\""
+        ) or
+
+        process.name : "OneDriveStandaloneUpdater.exe" and registry.data.strings : (
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\Microsoft.SharePoint.exe"
+        ) or
+
+        process.name : "OneDriveSetup.exe" and
+          registry.value : (
+            "Delete Cached Standalone Update Binary", "Delete Cached Update Binary", "amd64", "Uninstall *", "i386", "OneDrive"
+          ) and
+          registry.data.strings : (
+            "?:\\Windows\\system32\\cmd.exe /q /c * \"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\"",
+            "?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe /background *",
+            "\"?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe\" /background *",
+            "?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe /background *"
+          )
+      )
+    ) or
+
+    /* Slack */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name : "Slack Technologies, Inc." and
+      process.name : "slack.exe" and registry.data.strings : (
+        "\"?:\\Users\\*\\AppData\\Local\\slack\\slack.exe\" --process-start-args --startup"
+      )
+    ) or
+
+    /* WebEx */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name : ("Cisco WebEx LLC", "Cisco Systems, Inc.") and
+      process.name : "WebexHost.exe" and registry.data.strings : (
+        "\"?:\\Users\\*\\AppData\\Local\\WebEx\\WebexHost.exe\" /daemon /runFrom=autorun"
+      )
+    )
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -164,101 +215,7 @@ Standalone Update Binary", "Delete Cached Update Binary", "amd64",
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[startup-or-run-key-registry-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.data.strings != null and registry.path : (
-/* Machine Hive */
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explore
-r\\Run\\*", "HKLM\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*", /* Users Hive */
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersio
-n\\RunOnceEx\\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\C
-urrentVersion\\Policies\\Explorer\\Run\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*" ) and /* add common
-legitimate changes without being too restrictive as this is one of the
-most abused AESPs */ not registry.data.strings : "ctfmon.exe /n" and
-not (registry.value : "Application Restart #*" and process.name :
-"csrss.exe") and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
-and not registry.data.strings : ("?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe") and not process.executable :
-("?:\\Windows\\System32\\msiexec.exe",
-"?:\\Windows\\SysWOW64\\msiexec.exe") and not (process.name :
-"OneDriveSetup.exe" and registry.value : ("Delete Cached
-Standalone Update Binary", "Delete Cached Update Binary", "amd64",
-"Uninstall *") and registry.data.strings :
-"?:\\Windows\\system32\\cmd.exe /q /c *
-\"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\"")
-----------------------------------
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* uncomment length once stable */ registry where /*
-length(registry.data.strings) > 0 and */ registry.path : ( /*
-Machine Hive */
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User
-Shell Folders\\*",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell
-Folders\\*", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion
-\\Policies\\Explorer\\Run\\*",
-"HKLM\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*", /* Users Hive */
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\
-\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersio
-n\\RunOnceEx\\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\
-CurrentVersion\\Explorer\\User Shell Folders\\*", "HKEY_USERS\\*
-\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell
-Folders\\*", "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\Curre
-ntVersion\\Policies\\Explorer\\Run\\*",
-"HKEY_USERS\\*\\Software\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell\\*" ) and /* add here
-common legit changes without making too restrictive as this is one of
-the most abused AESPs */ not registry.data.strings : "ctfmon.exe /n"
-and not (registry.value : "Application Restart #*" and process.name
-: "csrss.exe") and user.domain != "NT AUTHORITY" and not
-registry.data.strings : ("C:\\Program Files\\*.exe", "C:\\Program
-Files (x86)\\*.exe") and not process.executable :
-("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index 89f609a908..ce2a7c7ede 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -10,12 +10,13 @@ Identifies files written to or modified in the startup folder by commonly abused
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,69 +28,62 @@ Identifies files written to or modified in the startup folder by commonly abused
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<startup-persistence-by-a-suspicious-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Startup Persistence by a Suspicious Process
 
-The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account
-logon, without user interaction, providing an excellent way for attackers to maintain persistence.
+The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
 
 This rule monitors for commonly abused processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- Administrators may add programs to this mechanism via command-line shells. Before the further investigation,
-verify that this activity is not benign.
+- Administrators may add programs to this mechanism via command-line shells. Before the further investigation, verify that this activity is not benign.
 
 ### Related rules
 
@@ -104,43 +98,43 @@ verify that this activity is not benign.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and user.domain != "NT
-AUTHORITY" and file.path :
-("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*",
-"C:\\ProgramData\\Microsoft\\Windows\\Start
-Menu\\Programs\\StartUp\\*") and process.name : ("cmd.exe",
-"powershell.exe", "wmic.exe",
-"mshta.exe", "pwsh.exe",
-"cscript.exe", "wscript.exe",
-"regsvr32.exe", "RegAsm.exe",
-"rundll32.exe", "EQNEDT32.EXE",
-"WINWORD.EXE", "EXCEL.EXE",
-"POWERPNT.EXE", "MSPUB.EXE",
-"MSACCESS.EXE", "iexplore.exe",
-"InstallUtil.exe")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  user.domain != "NT AUTHORITY" and
+  file.path : ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  process.name : ("cmd.exe",
+                  "powershell.exe",
+                  "wmic.exe",
+                  "mshta.exe",
+                  "pwsh.exe",
+                  "cscript.exe",
+                  "wscript.exe",
+                  "regsvr32.exe",
+                  "RegAsm.exe",
+                  "rundll32.exe",
+                  "EQNEDT32.EXE",
+                  "WINWORD.EXE",
+                  "EXCEL.EXE",
+                  "POWERPNT.EXE",
+                  "MSPUB.EXE",
+                  "MSACCESS.EXE",
+                  "iexplore.exe",
+                  "InstallUtil.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -152,46 +146,7 @@ Menu\\Programs\\StartUp\\*") and process.name : ("cmd.exe",
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[startup-persistence-by-a-suspicious-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and user.domain != "NT
-AUTHORITY" and file.path :
-("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup\\*",
-"C:\\ProgramData\\Microsoft\\Windows\\Start
-Menu\\Programs\\StartUp\\*") and process.name : ("cmd.exe",
-"powershell.exe", "wmic.exe",
-"mshta.exe", "pwsh.exe",
-"cscript.exe", "wscript.exe",
-"regsvr32.exe", "RegAsm.exe",
-"rundll32.exe", "EQNEDT32.EXE",
-"WINWORD.EXE", "EXCEL.EXE",
-"POWERPNT.EXE", "MSPUB.EXE",
-"MSACCESS.EXE", "iexplore.exe",
-"InstallUtil.exe")
-----------------------------------
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Rule name changed from: Shortcut File Written or Modified for Persistence
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
index daa415dbfd..0178328e20 100644
--- a/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
@@ -5,7 +5,7 @@ Adversaries may create or modify the Sublime application plugins or scripts to e
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,61 +14,61 @@ Adversaries may create or modify the Sublime application plugins or scripts to e
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<sublime-plugin-or-application-script-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type in ("change", "creation") and file.extension :
-"py" and file.path : ( "/Users/*/Library/Application
-Support/Sublime Text*/Packages/*.py", "/Applications/Sublime
-Text.app/Contents/MacOS/sublime.py" ) and not process.executable
-: ( "/Applications/Sublime Text*.app/Contents/*",
-"/usr/local/Cellar/git/*/bin/git",
-"/Library/Developer/CommandLineTools/usr/bin/git",
-"/usr/libexec/xpcproxy", "/System/Library/PrivateFrameworks/Desk
-topServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
-)
+[source, js]
 ----------------------------------
+file where host.os.type == "macos" and event.type in ("change", "creation") and file.extension : "py" and
+  file.path :
+    (
+      "/Users/*/Library/Application Support/Sublime Text*/Packages/*.py",
+      "/Applications/Sublime Text.app/Contents/MacOS/sublime.py"
+    ) and
+  not process.executable :
+    (
+      "/Applications/Sublime Text*.app/Contents/*",
+      "/usr/local/Cellar/git/*/bin/git",
+      "/Library/Developer/CommandLineTools/usr/bin/git",
+      "/usr/libexec/xpcproxy",
+      "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,30 +80,3 @@ topServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
 ** Name: Compromise Client Software Binary
 ** ID: T1554
 ** Reference URL: https://attack.mitre.org/techniques/T1554/
-
-[[sublime-plugin-or-application-script-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type in ("change", "creation") and file.extension :
-"py" and file.path : ( "/Users/*/Library/Application
-Support/Sublime Text*/Packages/*.py", "/Applications/Sublime
-Text.app/Contents/MacOS/sublime.py" ) and not process.executable
-: ( "/Applications/Sublime Text*.app/Contents/MacOS/Sublime
-Text*", "/usr/local/Cellar/git/*/bin/git",
-"/usr/libexec/xpcproxy", "/System/Library/PrivateFrameworks/Des
-ktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
-, "/Applications/Sublime Text.app/Contents/MacOS/plugin_host"
-)
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/sudo-heap-based-buffer-overflow-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/sudo-heap-based-buffer-overflow-attempt.asciidoc
index d58ec7af65..bf93ce3907 100644
--- a/docs/detections/prebuilt-rules/rule-details/sudo-heap-based-buffer-overflow-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sudo-heap-based-buffer-overflow-attempt.asciidoc
@@ -5,7 +5,7 @@ Identifies the attempted use of a heap-based buffer overflow vulnerability for t
 
 *Rule type*: threshold
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,52 +14,47 @@ Identifies the attempted use of a heap-based buffer overflow vulnerability for t
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3156
 * https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
 * https://www.bleepingcomputer.com/news/security/latest-macos-big-sur-also-has-sudo-root-privilege-escalation-flaw
 * https://www.sudo.ws/alerts/unescape_overflow.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<sudo-heap-based-buffer-overflow-attempt-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the Sudo or Sudoedit binaries. Only Sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:start and process.name:(sudo
-or sudoedit) and process.args:(*\\ and ("-i" or "-s"))
+[source, js]
 ----------------------------------
+event.category:process and event.type:start and
+  process.name:(sudo or sudoedit) and
+  process.args:(*\\ and ("-i" or "-s"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -71,13 +66,3 @@ or sudoedit) and process.args:(*\\ and ("-i" or "-s"))
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[sudo-heap-based-buffer-overflow-attempt-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/sudoers-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/sudoers-file-modification.asciidoc
index 38386f12ce..46977a6f5d 100644
--- a/docs/detections/prebuilt-rules/rule-details/sudoers-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sudoers-file-modification.asciidoc
@@ -5,7 +5,7 @@ A sudoers file specifies the commands that users or groups can run and from whic
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,41 +14,39 @@ A sudoers file specifies the commands that users or groups can run and from whic
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<sudoers-file-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and event.type:change and file.path:(/etc/sudoers*
-or /private/etc/sudoers*)
+[source, js]
 ----------------------------------
+event.category:file and event.type:change and file.path:(/etc/sudoers* or /private/etc/sudoers*)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -60,42 +58,7 @@ or /private/etc/sudoers*)
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[sudoers-file-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.type:change and file.path:/etc/sudoers
-----------------------------------
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.11.0 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:file_integrity and event.action:updated and
-file.path:/etc/sudoers
-----------------------------------
-
+* Sub-technique:
+** Name: Sudo and Sudo Caching
+** ID: T1548.003
+** Reference URL: https://attack.mitre.org/techniques/T1548/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index 4496a9a265..7dfa97369f 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -13,7 +13,7 @@ The malware known as SUNBURST targets the SolarWind's Orion business software fo
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -25,74 +25,60 @@ The malware known as SUNBURST targets the SolarWind's Orion business software fo
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Command and Control
-* Investigation Guide
-
-*Version*: 102 (<<sunburst-command-and-control-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating SUNBURST Command and Control Activity
 
-SUNBURST is a trojanized version of a digitally signed SolarWinds Orion plugin called
-SolarWinds.Orion.Core.BusinessLayer.dll. The plugin contains a backdoor that communicates via HTTP to third-party
-servers. After an initial dormant period of up to two weeks, SUNBURST may retrieve and execute commands that instruct
-the backdoor to transfer files, execute files, profile the system, reboot the system, and disable system services.
-The malware's network traffic attempts to blend in with legitimate SolarWinds activity by imitating the Orion
-Improvement Program (OIP) protocol, and the malware stores persistent state data within legitimate plugin configuration files. The
-backdoor uses multiple obfuscated blocklists to identify processes, services, and drivers associated with forensic and
-anti-virus tools.
+SUNBURST is a trojanized version of a digitally signed SolarWinds Orion plugin called SolarWinds.Orion.Core.BusinessLayer.dll. The plugin contains a backdoor that communicates via HTTP to third-party servers. After an initial dormant period of up to two weeks, SUNBURST may retrieve and execute commands that instruct the backdoor to transfer files, execute files, profile the system, reboot the system, and disable system services. The malware's network traffic attempts to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol, and the malware stores persistent state data within legitimate plugin configuration files. The backdoor uses multiple obfuscated blocklists to identify processes, services, and drivers associated with forensic and anti-virus tools.
 
 More details on SUNBURST can be found on the [Mandiant Report](https://www.mandiant.com/resources/sunburst-additional-technical-details).
 
-This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity
-by imitating the Orion Improvement Program (OIP) protocol behavior.
+This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the executable involved using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- This activity should not happen legitimately. The security team should address any potential benign true positive
-(B-TP), as this configuration can put the environment at risk.
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the environment at risk.
 
 ### Response and remediation
 
@@ -102,41 +88,38 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Reimage the host operating system and restore compromised files to clean versions.
 - Upgrade SolarWinds systems to the latest version to eradicate the chance of reinfection by abusing the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-network where event.type == "protocol" and network.protocol == "http"
-and process.name : ("ConfigurationWizard.exe",
-"NetFlowService.exe",
-"NetflowDatabaseMaintenance.exe",
-"SolarWinds.Administration.exe",
-"SolarWinds.BusinessLayerHost.exe",
-"SolarWinds.BusinessLayerHostx64.exe",
-"SolarWinds.Collector.Service.exe",
-"SolarwindsDiagnostics.exe") and ( (
-(http.request.body.content : "*/swip/Upload.ashx*" and
-http.request.body.content : ("POST*", "PUT*")) or
-(http.request.body.content : ("*/swip/SystemDescription*",
-"*/swip/Events*") and http.request.body.content : ("GET*", "HEAD*"))
-) and not http.request.body.content : "*solarwinds.com*" )
+[source, js]
 ----------------------------------
+network where host.os.type == "windows" and event.type == "protocol" and network.protocol == "http" and
+  process.name : ("ConfigurationWizard.exe",
+                  "NetFlowService.exe",
+                  "NetflowDatabaseMaintenance.exe",
+                  "SolarWinds.Administration.exe",
+                  "SolarWinds.BusinessLayerHost.exe",
+                  "SolarWinds.BusinessLayerHostx64.exe",
+                  "SolarWinds.Collector.Service.exe",
+                  "SolarwindsDiagnostics.exe") and
+  (
+    (
+      (http.request.body.content : "*/swip/Upload.ashx*" and http.request.body.content : ("POST*", "PUT*")) or
+      (http.request.body.content : ("*/swip/SystemDescription*", "*/swip/Events*") and http.request.body.content : ("GET*", "HEAD*"))
+    ) and
+    not http.request.body.content : "*solarwinds.com*"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -148,8 +131,10 @@ http.request.body.content : ("POST*", "PUT*")) or
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -158,62 +143,7 @@ http.request.body.content : ("POST*", "PUT*")) or
 ** Name: Supply Chain Compromise
 ** ID: T1195
 ** Reference URL: https://attack.mitre.org/techniques/T1195/
-
-[[sunburst-command-and-control-activity-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network where event.type == "protocol" and network.protocol == "http"
-and process.name : ("ConfigurationWizard.exe",
-"NetFlowService.exe",
-"NetflowDatabaseMaintenance.exe",
-"SolarWinds.Administration.exe",
-"SolarWinds.BusinessLayerHost.exe",
-"SolarWinds.BusinessLayerHostx64.exe",
-"SolarWinds.Collector.Service.exe",
-"SolarwindsDiagnostics.exe") and (http.request.body.content :
-"*/swip/Upload.ashx*" and http.request.body.content : ("POST*",
-"PUT*")) or (http.request.body.content :
-("*/swip/SystemDescription*", "*/swip/Events*") and
-http.request.body.content : ("GET*", "HEAD*")) and not
-http.request.body.content : "*solarwinds.com*"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:protocol and
-network.protocol:http and process.name:( ConfigurationWizard.exe or
-NetFlowService.exe or NetflowDatabaseMaintenance.exe or
-SolarWinds.Administration.exe or SolarWinds.BusinessLayerHost.exe or
-SolarWinds.BusinessLayerHostx64.exe or
-SolarWinds.Collector.Service.exe or SolarwindsDiagnostics.exe) and
-http.request.body.content:(( (*/swip/Upload.ashx* and (POST* or PUT*))
-or (*/swip/SystemDescription* and (GET* or HEAD*)) or (*/swip/Events*
-and (GET* or HEAD*))) and not *solarwinds.com*)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc
index 7317b427d5..ee2edd8f10 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc
@@ -5,7 +5,7 @@ Detects when a user reports suspicious activity for their Okta account. These ev
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,60 +14,49 @@ Detects when a user reports suspicious activity for their Okta account. These ev
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<suspicious-activity-reported-by-okta-user-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A user may report suspicious activity on their Okta account in error.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:user.account.report_suspicious_activity_by_enduser
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:user.account.report_suspicious_activity_by_enduser
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -79,8 +68,6 @@ event.action:user.account.report_suspicious_activity_by_enduser
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -89,8 +76,6 @@ event.action:user.account.report_suspicious_activity_by_enduser
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -99,8 +84,6 @@ event.action:user.account.report_suspicious_activity_by_enduser
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -109,37 +92,3 @@ event.action:user.account.report_suspicious_activity_by_enduser
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[suspicious-activity-reported-by-okta-user-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:user.account.report_suspicious_activity_by_enduser
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
new file mode 100644
index 0000000000..d802c14e16
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -0,0 +1,133 @@
+[[suspicious-antimalware-scan-interface-dll]]
+=== Suspicious Antimalware Scan Interface DLL
+
+Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Suspicious Antimalware Scan Interface DLL
+
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
+
+Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the process that created the DLL and which account was used.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the execution of scripts and macros after the registry modification.
+- Investigate other processes launched from the directory that the DLL was created.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+### False positive analysis
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.action != "deletion" and file.path != null and
+ file.name : ("amsi.dll", "amsi") and not file.path : ("?:\\Windows\\system32\\amsi.dll", "?:\\Windows\\Syswow64\\amsi.dll", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*", "?:\\$WINDOWS.~BT\\Work\\*\\*", "?:\\Windows\\SoftwareDistribution\\Download\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Search Order Hijacking
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
index d3f3fc23d8..46a795430d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of the Automator Workflows process followed by a networ
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,45 +14,42 @@ Identifies the execution of the Automator Workflows process followed by a networ
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Execution
-
-*Version*: 100 (<<suspicious-automator-workflows-execution-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=30s [process where event.type in
-("start", "process_started") and process.name == "automator"]
-[network where process.name:"com.apple.automator.runner"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=30s
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "automator"]
+ [network where host.os.type == "macos" and process.name:"com.apple.automator.runner"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,13 +61,3 @@ sequence by host.id with maxspan=30s [process where event.type in
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-automator-workflows-execution-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
index e997390937..f45e8e10f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a suspicious browser child process. Adversaries may
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,62 +13,60 @@ Identifies the execution of a suspicious browser child process. Adversaries may
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://objective-see.com/blog/blog_0x43.html
 * https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Initial Access
-* Execution
-
-*Version*: 100 (<<suspicious-browser-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("Google Chrome", "Google Chrome Helper*",
-"firefox", "Opera", "Safari", "com.apple.WebKit.WebContent",
-"Microsoft Edge") and process.name : ("sh", "bash", "dash", "ksh",
-"tcsh", "zsh", "curl", "wget", "python*", "perl*", "php*",
-"osascript", "pwsh") and process.command_line != null and not
-process.command_line : "*/Library/Application
-Support/Microsoft/MAU*/Microsoft
-AutoUpdate.app/Contents/MacOS/msupdate*" and not process.args :
-( "hw.model", "IOPlatformExpertDevice",
-"/Volumes/Google Chrome/Google
-Chrome.app/Contents/Frameworks/*/Resources/install.sh", "--
-defaults-torrc", "*Chrome.app", "Framework.framework/Versi
-ons/*/Resources/keystone_promote_preflight.sh",
-"/Users/*/Library/Application
-Support/Google/Chrome/recovery/*/ChromeRecovery", "$DISPLAY",
-"*GIO_LAUNCHED_DESKTOP_FILE_PID=$$*", "/opt/homebrew/*",
-"/usr/local/*brew*" )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.parent.name : ("Google Chrome", "Google Chrome Helper*", "firefox", "Opera", "Safari", "com.apple.WebKit.WebContent", "Microsoft Edge") and
+  process.name : ("sh", "bash", "dash", "ksh", "tcsh", "zsh", "curl", "wget", "python*", "perl*", "php*", "osascript", "pwsh") and
+  process.command_line != null and
+  not process.command_line : "*/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate*" and
+  not process.args :
+    (
+      "hw.model",
+      "IOPlatformExpertDevice",
+      "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh",
+      "--defaults-torrc",
+      "*Chrome.app",
+      "Framework.framework/Versions/*/Resources/keystone_promote_preflight.sh",
+      "/Users/*/Library/Application Support/Google/Chrome/recovery/*/ChromeRecovery",
+      "$DISPLAY",
+      "*GIO_LAUNCHED_DESKTOP_FILE_PID=$$*",
+      "/opt/homebrew/*",
+      "/usr/local/*brew*"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,8 +78,6 @@ Support/Google/Chrome/recovery/*/ChromeRecovery", "$DISPLAY",
 ** Name: Exploitation for Client Execution
 ** ID: T1203
 ** Reference URL: https://attack.mitre.org/techniques/T1203/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -90,33 +86,3 @@ Support/Google/Chrome/recovery/*/ChromeRecovery", "$DISPLAY",
 ** Name: Drive-by Compromise
 ** ID: T1189
 ** Reference URL: https://attack.mitre.org/techniques/T1189/
-
-[[suspicious-browser-child-process-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("Google Chrome", "Google Chrome Helper*",
-"firefox", "Opera", "Safari", "com.apple.WebKit.WebContent",
-"Microsoft Edge") and process.name : ("sh", "bash", "dash", "ksh",
-"tcsh", "zsh", "curl", "wget", "python*", "perl*", "php*",
-"osascript", "pwsh") and process.command_line != null and not
-process.args : ( "/Library/Application
-Support/Microsoft/MAU*/Microsoft
-AutoUpdate.app/Contents/MacOS/msupdate", "hw.model",
-"IOPlatformExpertDevice", "/Volumes/Google Chrome/Google
-Chrome.app/Contents/Frameworks/*/Resources/install.sh", "--
-defaults-torrc", "Chrome.app", "Framework.framework/Vers
-ions/*/Resources/keystone_promote_preflight.sh",
-"/Users/*/Library/Application
-Support/Google/Chrome/recovery/*/ChromeRecovery", "$DISPLAY",
-"GIO_LAUNCHED_DESKTOP_FILE_PID=$$" )
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
index 3a44708f98..f3a1301329 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious modifications of the calendar file by an unusual process.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * auditbeat-*
@@ -14,55 +14,54 @@ Identifies suspicious modifications of the calendar file by an unusual process.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://labs.f-secure.com/blog/operationalising-calendar-alerts-persistence-on-macos
 * https://github.com/FSecureLABS/CalendarPersist
 * https://github.com/D00MFist/PersistentJXA/blob/master/CalendarPersist.js
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<suspicious-calendar-file-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted applications for managing calendars and reminders.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:file and event.action:modification and
-file.path:/Users/*/Library/Calendars/*.calendar/Events/*.ics and
-process.executable: (* and not ( /System/Library/* or
-/System/Applications/Calendar.app/Contents/MacOS/* or
-/System/Applications/Mail.app/Contents/MacOS/Mail or
-/usr/libexec/xpcproxy or /sbin/launchd or /Applications/*
-) )
+[source, js]
 ----------------------------------
+event.category:file and host.os.type:macos and event.action:modification and
+  file.path:/Users/*/Library/Calendars/*.calendar/Events/*.ics and
+  process.executable:
+  (* and not
+    (
+      /System/Library/* or
+      /System/Applications/Calendar.app/Contents/MacOS/* or
+      /System/Applications/Mail.app/Contents/MacOS/Mail or
+      /usr/libexec/xpcproxy or
+      /sbin/launchd or
+      /Applications/*
+    )
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,23 +73,3 @@ process.executable: (* and not ( /System/Library/* or
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[suspicious-calendar-file-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and event.action:modification and
-file.path:/Users/*/Library/Calendars/*.calendar/Events/*.ics and
-process.executable: (* and not ( /System/Library/* or
-/System/Applications/Calendar.app/Contents/MacOS/* or
-/usr/libexec/xpcproxy or /sbin/launchd or
-/Applications/* ) )
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 5f3f81f3ee..12d9c4052c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -16,7 +16,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -31,144 +31,98 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 101 (<<suspicious-certutil-commands-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Investigation guide
 
+==== Investigation guide
 
-[source,markdown]
-----------------------------------
 
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
+### Investigating Suspicious CertUtil Commands
 
-==== Rule query
+`certutil.exe` is a command line utility program that is included with Microsoft Windows operating systems. It is used to manage and manipulate digital certificates and certificate services on computers running Windows.
 
+Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and
-process.args : ("?decode", "?encode", "?urlcache", "?verifyctl",
-"?encodehex", "?decodehex", "?exportPFX")
-----------------------------------
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
-==== Threat mapping
+#### Possible investigation steps
 
-*Framework*: MITRE ATT&CK^TM^
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to determine the nature of the execution.
+  - If files were downloaded, retrieve them and check whether they were run, and under which security context.
+  - If files were obfuscated or deobfuscated, retrieve them.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the involved files using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Deobfuscate/Decode Files or Information
-** ID: T1140
-** Reference URL: https://attack.mitre.org/techniques/T1140/
+### False positive analysis
 
-[[suspicious-certutil-commands-history]]
-==== Rule version history
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-Version 101 (8.6.0 release)::
-* Formatting only
+### Response and remediation
 
-Version 100 (8.5.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 16 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and
-process.args : ("?decode", "?encode", "?urlcache", "?verifyctl",
-"?encodehex", "?decodehex", "?exportPFX")
 ----------------------------------
 
-Version 14 (8.3.0 release)::
-* Formatting only
-
-Version 12 (8.2.0 release)::
-* Formatting only
-
-Version 10 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and
-process.args : ("?decode", "?encode", "?urlcache", "?verifyctl",
-"?encodehex", "?decodehex")
-----------------------------------
+==== Rule query
 
-Version 9 (7.14.0 release)::
-* Rule name changed from: Encoding or Decoding Files via CertUtil
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and
-process.args : ("?decode", "?encode")
-----------------------------------
 
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:certutil.exe and process.args:(-decode or -encode or
-/decode or /encode)
-----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and
+  process.args : ("?decode", "?encode", "?urlcache", "?verifyctl", "?encodehex", "?decodehex", "?exportPFX")
 
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:certutil.exe and process.args:(-decode or -encode or
-/decode or /encode)
 ----------------------------------
 
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"certutil.exe" and process.args:("-encode" or "/encode"
-or "-decode" or "/decode")
-----------------------------------
+*Framework*: MITRE ATT&CK^TM^
 
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
index c52896f20d..3f300d7958 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
@@ -5,7 +5,7 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,58 +14,52 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://rekken.github.io/2020/05/14/Security-Flaws-in-Adobe-Acrobat-Reader-Allow-Malicious-Program-to-Gain-Root-on-macOS-Silently/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Privilege Escalation
-* CVE-2020-9615
-* CVE-2020-9614
-* CVE-2020-9613
-
-*Version*: 100 (<<suspicious-child-process-of-adobe-acrobat-reader-update-service-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted system or Adobe Acrobat Related processes.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:com.adobe.ARMDC.SMJobBlessHelper and
-user.name:root and not process.executable:
-(/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper or
-/usr/bin/codesign or
-/private/var/folders/zz/*/T/download/ARMDCHammer or
-/usr/sbin/pkgutil or /usr/bin/shasum or
-/usr/bin/perl* or /usr/sbin/spctl or
-/usr/sbin/installer or /usr/bin/csrutil)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.parent.name:com.adobe.ARMDC.SMJobBlessHelper and
+  user.name:root and
+  not process.executable: (/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper or
+                           /usr/bin/codesign or
+                           /private/var/folders/zz/*/T/download/ARMDCHammer or
+                           /usr/sbin/pkgutil or
+                           /usr/bin/shasum or
+                           /usr/bin/perl* or
+                           /usr/sbin/spctl or
+                           /usr/sbin/installer or
+                           /usr/bin/csrutil)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,26 +71,3 @@ user.name:root and not process.executable:
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[suspicious-child-process-of-adobe-acrobat-reader-update-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:com.adobe.ARMDC.SMJobBlessHelper and
-user.name:root and not process.executable:
-(/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper or
-/usr/bin/codesign or
-/private/var/folders/zz/*/T/download/ARMDCHammer or
-/usr/sbin/pkgutil or /usr/bin/shasum or
-/usr/bin/perl* or /usr/sbin/spctl or
-/usr/sbin/installer)
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
index 96e8ae6db3..249369d0ad 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious command execution (cmd) via Windows Management Instrumenta
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,51 +16,49 @@ Identifies suspicious command execution (cmd) via Windows Management Instrumenta
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<suspicious-cmd-execution-via-wmi-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"WmiPrvSE.exe" and process.name : "cmd.exe" and process.args :
-"\\\\127.0.0.1\\*" and process.args : ("2>&1", "1>")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "WmiPrvSE.exe" and process.name : "cmd.exe" and
+ process.args : "\\\\127.0.0.1\\*" and process.args : ("2>&1", "1>")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,40 +70,3 @@ process where event.type == "start" and process.parent.name :
 ** Name: Windows Management Instrumentation
 ** ID: T1047
 ** Reference URL: https://attack.mitre.org/techniques/T1047/
-
-[[suspicious-cmd-execution-via-wmi-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "WmiPrvSE.exe" and process.name : "cmd.exe" and
-process.args : "\\\\127.0.0.1\\*" and process.args : ("2>&1", "1>")
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name == "WmiPrvSE.exe" and process.name == "cmd.exe"
-and wildcard(process.args, "\\\\127.0.0.1\\*") and process.args in
-("2>&1", "1>")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc
new file mode 100644
index 0000000000..28c5c3cd29
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc
@@ -0,0 +1,82 @@
+[[suspicious-content-extracted-or-decompressed-via-funzip]]
+=== Suspicious Content Extracted or Decompressed via Funzip
+
+Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/software/S0482/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and
+((process.args == "tail" and process.args == "-c" and process.args == "funzip")) and
+not process.args : "/var/log/messages" and 
+not process.parent.executable : ("/usr/bin/dracut", "/sbin/dracut", "/usr/bin/xargs") and
+not (process.parent.name in ("sh", "sudo") and process.parent.command_line : "*nessus_su*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
index 6ceaa5573a..8fdc93b68d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to create or modify a crontab via a process that is not cron
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,46 +13,42 @@ Identifies attempts to create or modify a crontab via a process that is not cron
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf
 * https://theevilbit.github.io/beyond/beyond_0004/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<suspicious-crontab-creation-or-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and process.name != null and
-file.path : "/private/var/at/tabs/*" and not process.executable ==
-"/usr/bin/crontab"
+[source, js]
 ----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and process.name != null and
+  file.path : "/private/var/at/tabs/*" and not process.executable == "/usr/bin/crontab"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -64,20 +60,7 @@ file.path : "/private/var/at/tabs/*" and not process.executable ==
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[suspicious-crontab-creation-or-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type != "deletion" and process.name != null and
-file.path : "/private/var/at/tabs/*" and not process.executable ==
-"/usr/bin/crontab"
-----------------------------------
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc
new file mode 100644
index 0000000000..bf97e041be
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc
@@ -0,0 +1,67 @@
+[[suspicious-data-encryption-via-openssl-utility]]
+=== Suspicious Data Encryption via OpenSSL Utility
+
+Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/
+* https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Impact
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, user.name, process.parent.entity_id with maxspan=5s
+  [ process where host.os.type == "linux" and event.action == "exec" and 
+    process.name == "openssl" and process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl*", "php*", "python*", "xargs") and
+    process.args == "-in" and process.args == "-out" and
+    process.args in ("-k", "-K", "-kfile", "-pass", "-iv", "-md") and
+    /* excluding base64 encoding options and including encryption password or key params */
+    not process.args in ("-d", "-a", "-A", "-base64", "-none", "-nosalt") ] with runs=10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Encrypted for Impact
+** ID: T1486
+** Reference URL: https://attack.mitre.org/techniques/T1486/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
index 89668e8278..d5c59fa842 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
@@ -5,23 +5,24 @@ Identifies the loading of a non Microsoft signed DLL that is missing on a defaul
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://itm4n.github.io/windows-dll-hijacking-clarified/
 * http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
@@ -30,44 +31,40 @@ Identifies the loading of a non Microsoft signed DLL that is missing on a defaul
 * https://windows-internals.com/faxing-your-way-to-system/
 * http://waleedassar.blogspot.com/2013/01/wow64logdll.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-dll-loaded-for-persistence-or-privilege-escalation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation
 
-Attackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate
-privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a
-default Windows installation or one that can be loaded from a different location by a native Windows process.
+Attackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a default Windows installation or one that can be loaded from a different location by a native Windows process.
 
 #### Possible investigation steps
 
 - Examine the DLL signature and identify the process that created it.
-  - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and
-  any spawned child processes.
+  - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Retrieve the DLL and determine if it is malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
@@ -81,8 +78,7 @@ default Windows installation or one that can be loaded from a different location
 
 ### False positive analysis
 
-- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently
-malicious must be monitored by the security team.
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
 ### Response and remediation
 
@@ -92,45 +88,43 @@ malicious must be monitored by the security team.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where (event.category == "library" or (event.category ==
-"process" and event.action : "Image loaded*")) and ( /* compatible
-with Elastic Endpoint Library Events */ (dll.name : ("wlbsctrl.dll",
-"wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll",
-"Msfte.dll", "wow64log.dll",
-"WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll",
-"phoneinfo.dll", "EdgeGdi.dll", "cdpsgshims.dll",
-"windowsperformancerecordercontrol.dll", "diagtrack_win.dll") and
-(dll.code_signature.trusted == false or dll.code_signature.exists ==
-false)) or /* compatible with Sysmon EventID 7 - Image Load */
-(file.name : ("wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll",
-"Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
-"wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll",
-"wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
-"cdpsgshims.dll", "windowsperformancerecordercontrol.dll",
-"diagtrack_win.dll") and not file.code_signature.status == "Valid")
-)
+[source, js]
 ----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("driver", "library") or (event.category == "process" and event.action : "Image loaded*")) and
+ (
+  /* compatible with Elastic Endpoint Library Events */
+  (dll.name : ("wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
+               "wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
+               "cdpsgshims.dll", "windowsperformancerecordercontrol.dll", "diagtrack_win.dll", "oci.dll", "TPPCOIPW32.dll", 
+               "tpgenlic.dll", "thinmon.dll", "fxsst.dll", "msTracer.dll")
+   and (dll.code_signature.trusted != true or dll.code_signature.exists != true)) or
+
+  /* compatible with Sysmon EventID 7 - Image Load */
+  (file.name : ("wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
+               "wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
+               "cdpsgshims.dll", "windowsperformancerecordercontrol.dll", "diagtrack_win.dll", "oci.dll", "TPPCOIPW32.dll", 
+               "tpgenlic.dll", "thinmon.dll", "fxsst.dll", "msTracer.dll") and 
+   not file.path : ("?:\\Windows\\System32\\wbemcomn.dll", "?:\\Windows\\SysWOW64\\wbemcomn.dll") and 
+   not file.hash.sha256 : 
+            ("6e837794fc282446906c36d681958f2f6212043fc117c716936920be166a700f", 
+             "b14e4954e8cca060ffeb57f2458b6a3a39c7d2f27e94391cbcea5387652f21a4", 
+             "c258d90acd006fa109dc6b748008edbb196d6168bc75ace0de0de54a4db46662") and 
+   not file.code_signature.status == "Valid")
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -142,8 +136,10 @@ false)) or /* compatible with Sysmon EventID 7 - Image Load */
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -152,48 +148,7 @@ false)) or /* compatible with Sysmon EventID 7 - Image Load */
 ** Name: Hijack Execution Flow
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
-
-[[suspicious-dll-loaded-for-persistence-or-privilege-escalation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where dll.name : ( "wlbsctrl.dll", "wbemcomn.dll",
-"WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll",
-"Msfte.dll", "wow64log.dll", "WindowsCoreDeviceInfo.dll",
-"Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
-"cdpsgshims.dll", "windowsperformancerecordercontrol.dll",
-"diagtrack_win.dll" ) and not (dll.code_signature.subject_name :
-("Microsoft Windows", "Microsoft Corporation") and
-dll.code_signature.status : "trusted")
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where dll.name : ( "wlbsctrl.dll", "wbemcomn.dll",
-"WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll",
-"Msfte.dll", "wow64log.dll", "WindowsCoreDeviceInfo.dll",
-"Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
-"cdpsgshims.dll", "windowsperformancerecordercontrol.dll",
-"diagtrack_win.dll" ) and not (dll.code_signature.subject_name :
-"Microsoft Windows" and dll.code_signature.status : "trusted")
-----------------------------------
-
+* Sub-technique:
+** Name: DLL Search Order Hijacking
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
index e796616516..3ffed01ca2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a suspicious child process of the Event Monitor Daem
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,48 +13,64 @@ Identifies the execution of a suspicious child process of the Event Monitor Daem
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.xorrior.com/emond-persistence/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<suspicious-emond-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "emond" and process.name : ( "bash",
-"dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
-"Python", "python*", "perl*", "php*", "osascript",
-"pwsh", "curl", "wget", "cp", "mv", "touch", "echo",
-"base64", "launchctl")
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+ process.parent.name : "emond" and
+ process.name : (
+   "bash",
+   "dash",
+   "sh",
+   "tcsh",
+   "csh",
+   "zsh",
+   "ksh",
+   "fish",
+   "Python",
+   "python*",
+   "perl*",
+   "php*",
+   "osascript",
+   "pwsh",
+   "curl",
+   "wget",
+   "cp",
+   "mv",
+   "touch",
+   "echo",
+   "base64",
+   "launchctl")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,13 +82,7 @@ process.parent.name : "emond" and process.name : ( "bash",
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[suspicious-emond-child-process-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Emond
+** ID: T1546.014
+** Reference URL: https://attack.mitre.org/techniques/T1546/014/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
index e1539ebc6f..7064e53e62 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
@@ -5,7 +5,7 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,55 +16,54 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<suspicious-endpoint-security-parent-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name :
-("esensor.exe", "elastic-endpoint.exe") and process.parent.executable
-!= null and /* add FPs here */ not process.parent.executable :
-("C:\\Program Files\\Elastic\\*",
-"C:\\Windows\\System32\\services.exe",
-"C:\\Windows\\System32\\WerFault*.exe",
-"C:\\Windows\\System32\\wermgr.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.name : ("esensor.exe", "elastic-endpoint.exe") and
+ process.parent.executable != null and
+  /* add FPs here */
+ not process.parent.executable : ("C:\\Program Files\\Elastic\\*",
+                                  "C:\\Windows\\System32\\services.exe",
+                                  "C:\\Windows\\System32\\WerFault*.exe",
+                                  "C:\\Windows\\System32\\wermgr.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,58 +75,3 @@ process where event.type == "start" and process.name :
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[suspicious-endpoint-security-parent-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name : ("esensor.exe", "elastic-endpoint.exe") and
-process.parent.executable != null and /* add FPs here */ not
-process.parent.executable : ("C:\\Program Files\\Elastic\\*",
-"C:\\Windows\\System32\\services.exe",
-"C:\\Windows\\System32\\WerFault*.exe",
-"C:\\Windows\\System32\\wermgr.exe")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name : ("esensor.exe", "elastic-endpoint.exe") and
-process.parent.executable != null and /* add FPs here */ not
-process.parent.executable : ("C:\\Program Files\\Elastic\\*",
-"C:\\Windows\\System32\\services.exe",
-"C:\\Windows\\System32\\WerFault*.exe",
-"C:\\Windows\\System32\\wermgr.exe")
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(esensor.exe or "elastic-endpoint.exe" or "elastic-
-agent.exe") and not
-process.parent.executable:"C:\Windows\System32\services.exe"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
index ecd2e14e47..fdee0788ed 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
@@ -5,7 +5,7 @@ Identifies when a script interpreter or signed binary is launched via a non-stan
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,58 +15,53 @@ Identifies when a script interpreter or signed binary is launched via a non-stan
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
 * https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<suspicious-execution-from-a-mounted-device-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.executable : "C:\\*"
-and (process.working_directory : "?:\\" and not
-process.working_directory: "C:\\") and process.parent.name :
-"explorer.exe" and process.name : ("rundll32.exe", "mshta.exe",
-"powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe",
-"cscript.exe", "wscript.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.executable : "C:\\*" and
+  (process.working_directory : "?:\\" and not process.working_directory: "C:\\") and
+  process.parent.name : "explorer.exe" and
+  process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe",
+                  "cscript.exe", "wscript.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,8 +73,18 @@ process.working_directory: "C:\\") and process.parent.name :
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-
+* Sub-technique:
+** Name: Mshta
+** ID: T1218.005
+** Reference URL: https://attack.mitre.org/techniques/T1218/005/
+* Sub-technique:
+** Name: Regsvr32
+** ID: T1218.010
+** Reference URL: https://attack.mitre.org/techniques/T1218/010/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -88,16 +93,7 @@ process.working_directory: "C:\\") and process.parent.name :
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-execution-from-a-mounted-device-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc
new file mode 100644
index 0000000000..ea7158250d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc
@@ -0,0 +1,121 @@
+[[suspicious-execution-via-microsoft-office-add-ins]]
+=== Suspicious Execution via Microsoft Office Add-Ins
+
+Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/Octoberfest7/XLL_Phishing
+* https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where 
+    
+    host.os.type == "windows" and event.type == "start" and  
+    
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "VSTOInstaller.exe") and 
+    
+    process.args regex~ """.+\.(wll|xll|ppa|ppam|xla|xlam|vsto)""" and 
+    
+    /* Office Add-In from suspicious paths */
+    (process.args :
+             ("?:\\Users\\*\\Temp\\7z*",
+              "?:\\Users\\*\\Temp\\Rar$*",
+              "?:\\Users\\*\\Temp\\Temp?_*",
+              "?:\\Users\\*\\Temp\\BNZ.*",
+              "?:\\Users\\*\\Downloads\\*",
+              "?:\\Users\\*\\AppData\\Roaming\\*",
+              "?:\\Users\\Public\\*",
+              "?:\\ProgramData\\*",
+              "?:\\Windows\\Temp\\*",
+              "\\Device\\*",
+              "http*") or
+	      
+    process.parent.name : ("explorer.exe", "OpenWith.exe") or 
+    
+    /* Office Add-In from suspicious parent */
+    process.parent.name : ("cmd.exe", "powershell.exe")) and
+	  
+    /* False Positives */
+    not (process.args : "*.vsto" and
+         process.parent.executable :
+                   ("?:\\Program Files\\Logitech\\LogiOptions\\PlugInInstallerUtility*.exe",
+                    "?:\\ProgramData\\Logishrd\\LogiOptions\\Plugins\\VSTO\\*\\VSTOInstaller.exe",
+                    "?:\\Program Files\\Logitech\\LogiOptions\\PlugInInstallerUtility.exe",
+                    "?:\\Program Files\\LogiOptionsPlus\\PlugInInstallerUtility*.exe",
+                    "?:\\ProgramData\\Logishrd\\LogiOptionsPlus\\Plugins\\VSTO\\*\\VSTOInstaller.exe",
+                    "?:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*\\VSTOInstaller.exe")) and
+    not (process.args : "/Uninstall" and process.name : "VSTOInstaller.exe") and
+    not (process.parent.name : "rundll32.exe" and
+         process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc") and
+    not (process.name : "VSTOInstaller.exe" and process.args : "https://dl.getsidekick.com/outlook/vsto/Sidekick.vsto")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Office Application Startup
+** ID: T1137
+** Reference URL: https://attack.mitre.org/techniques/T1137/
+* Sub-technique:
+** Name: Add-ins
+** ID: T1137.006
+** Reference URL: https://attack.mitre.org/techniques/T1137/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
index 270f25b72b..8059369101 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
@@ -5,7 +5,7 @@ Identifies execution of a suspicious program via scheduled tasks by looking at p
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,76 +15,83 @@ Identifies execution of a suspicious program via scheduled tasks by looking at p
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<suspicious-execution-via-scheduled-task-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks running third party software.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and /* Schedule service
-cmdline on Win10+ */ process.parent.name : "svchost.exe" and
-process.parent.args : "Schedule" and /* add suspicious programs
-here */ process.pe.original_file_name in
-( "cscript.exe",
-"wscript.exe", "PowerShell.EXE",
-"Cmd.Exe", "MSHTA.EXE",
-"RUNDLL32.EXE", "REGSVR32.EXE",
-"MSBuild.exe", "InstallUtil.exe",
-"RegAsm.exe", "RegSvcs.exe",
-"msxsl.exe", "CONTROL.EXE",
-"EXPLORER.EXE",
-"Microsoft.Workflow.Compiler.exe",
-"msiexec.exe" ) and /* add
-suspicious paths here */ process.args : ( "C:\\Users\\*",
-"C:\\ProgramData\\*", "C:\\Windows\\Temp\\*",
-"C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*",
-"C:\\Intel\\*", "C:\\Windows\\Debug\\*", "C:\\HP\\*")
-and not (process.name : "cmd.exe" and process.args : "?:\\*.bat"
-and process.working_directory : "?:\\Windows\\System32\\") and
-not (process.name : "cscript.exe" and process.args :
-"?:\\Windows\\system32\\calluxxprovider.vbs") and not
-(process.name : "powershell.exe" and process.args : ("-File",
-"-PSConsoleFile") and user.id : "S-1-5-18") and not (process.name
-: "msiexec.exe" and user.id : "S-1-5-18")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    /* Schedule service cmdline on Win10+ */
+    process.parent.name : "svchost.exe" and process.parent.args : "Schedule" and
+    /* add suspicious programs here */
+    process.pe.original_file_name in
+                                (
+                                  "cscript.exe",
+                                  "wscript.exe",
+                                  "PowerShell.EXE",
+                                  "Cmd.Exe",
+                                  "MSHTA.EXE",
+                                  "RUNDLL32.EXE",
+                                  "REGSVR32.EXE",
+                                  "MSBuild.exe",
+                                  "InstallUtil.exe",
+                                  "RegAsm.exe",
+                                  "RegSvcs.exe",
+                                  "msxsl.exe",
+                                  "CONTROL.EXE",
+                                  "EXPLORER.EXE",
+                                  "Microsoft.Workflow.Compiler.exe",
+                                  "msiexec.exe"
+                                  ) and
+    /* add suspicious paths here */
+    process.args : (
+       "C:\\Users\\*",
+       "C:\\ProgramData\\*",
+       "C:\\Windows\\Temp\\*",
+       "C:\\Windows\\Tasks\\*",
+       "C:\\PerfLogs\\*",
+       "C:\\Intel\\*",
+       "C:\\Windows\\Debug\\*",
+       "C:\\HP\\*") and
+
+     not (process.name : "cmd.exe" and process.args : "?:\\*.bat" and process.working_directory : "?:\\Windows\\System32\\") and
+     not (process.name : "cscript.exe" and process.args : "?:\\Windows\\system32\\calluxxprovider.vbs") and
+     not (process.name : "powershell.exe" and process.args : ("-File", "-PSConsoleFile") and user.id : "S-1-5-18") and
+     not (process.name : "msiexec.exe" and user.id : "S-1-5-18")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -96,69 +103,7 @@ not (process.name : "cscript.exe" and process.args :
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[suspicious-execution-via-scheduled-task-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and /* Schedule service
-cmdline on Win10+ */ process.parent.name : "svchost.exe" and
-process.parent.args : "Schedule" and /* add suspicious programs
-here */ process.pe.original_file_name in
-( "cscript.exe",
-"wscript.exe", "PowerShell.EXE",
-"Cmd.Exe", "MSHTA.EXE",
-"RUNDLL32.EXE", "REGSVR32.EXE",
-"MSBuild.exe", "InstallUtil.exe",
-"RegAsm.exe", "RegSvcs.exe",
-"msxsl.exe", "CONTROL.EXE",
-"EXPLORER.EXE",
-"Microsoft.Workflow.Compiler.exe",
-"msiexec.exe" ) and /* add
-suspicious paths here */ process.args : ( "C:\\Users\\*",
-"C:\\ProgramData\\*", "C:\\Windows\\Temp\\*",
-"C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*",
-"C:\\Intel\\*", "C:\\Windows\\Debug\\*", "C:\\HP\\*")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and /* Schedule service
-cmdline on Win10+ */ process.parent.name : "svchost.exe" and
-process.parent.args : "Schedule" and /* add suspicious programs
-here */ process.pe.original_file_name in
-( "cscript.exe",
-"wscript.exe", "PowerShell.EXE",
-"Cmd.Exe", "MSHTA.EXE",
-"RUNDLL32.EXE", "REGSVR32.EXE",
-"MSBuild.exe", "InstallUtil.exe",
-"RegAsm.exe", "RegSvcs.exe",
-"msxsl.exe", "CONTROL.EXE",
-"EXPLORER.EXE",
-"Microsoft.Workflow.Compiler.exe",
-"msiexec.exe" ) and /* add
-suspicious paths here */ process.args : ( "C:\\Users\\*",
-"C:\\ProgramData\\*", "C:\\Windows\\Temp\\*",
-"C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*",
-"C:\\Intel\\*", "C:\\Windows\\Debug\\*", "C:\\HP\\*")
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc
new file mode 100644
index 0000000000..8aad333d70
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc
@@ -0,0 +1,87 @@
+[[suspicious-execution-via-windows-subsystem-for-linux]]
+=== Suspicious Execution via Windows Subsystem for Linux
+
+Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/
+* https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
+* https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type : "start" and
+ (
+  ((process.executable : "?:\\Windows\\System32\\bash.exe" or process.pe.original_file_name == "Bash.exe") and 
+  not process.command_line : ("bash", "bash.exe")) or 
+  process.executable : "?:\\Users\\*\\AppData\\Local\\Packages\\*\\rootfs\\usr\\bin\\bash" or 
+  (process.parent.name : "wsl.exe" and process.parent.command_line : "bash*" and not process.name : "wslhost.exe") or 
+  (process.name : "wsl.exe" and process.args : ("curl", "/etc/shadow", "/etc/passwd", "cat","--system", "root", "-e", "--exec", "bash", "/mnt/c/*"))
+  ) and 
+  not process.parent.executable : ("?:\\Program Files\\Docker\\*.exe", "?:\\Program Files (x86)\\Docker\\*.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
index f8b5db26b3..78c452b41f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
@@ -5,68 +5,70 @@ Identifies a suspicious Windows explorer child process. Explorer.exe can be abus
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
+*Tags*: 
 
-*Version*: 101 (<<suspicious-explorer-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ( process.name :
-("cscript.exe", "wscript.exe", "powershell.exe", "rundll32.exe",
-"cmd.exe", "mshta.exe", "regsvr32.exe") or
-process.pe.original_file_name in ("cscript.exe", "wscript.exe",
-"PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE",
-"REGSVR32.EXE") ) and /* Explorer started via DCOM */
-process.parent.name : "explorer.exe" and process.parent.args :
-"-Embedding" and not process.parent.args: ( /*
-Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs
-*/ "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
-"/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}" )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+   process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") or
+   process.pe.original_file_name in ("cscript.exe", "wscript.exe", "PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE", "REGSVR32.EXE")
+  ) and
+  /* Explorer started via DCOM */
+  process.parent.name : "explorer.exe" and process.parent.args : "-Embedding" and
+  not process.parent.args:
+          (
+            /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs   */
+            "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
+            "/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}"
+          )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,49 +80,11 @@ Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[suspicious-explorer-child-process-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-process.name : ("cscript.exe", "wscript.exe", "powershell.exe",
-"rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") or
-process.pe.original_file_name in ("cscript.exe", "wscript.exe",
-"PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE",
-"REGSVR32.EXE") ) and /* Explorer started via DCOM */
-process.parent.name : "explorer.exe" and process.parent.args :
-"-Embedding" and not process.parent.args: ( /*
-Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs
-*/ "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
-"/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}" )
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("cscript.exe", "wscript.exe", "powershell.exe",
-"rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") and /*
-Explorer started via DCOM */ process.parent.name : "explorer.exe"
-and process.parent.args : "-Embedding"
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc
new file mode 100644
index 0000000000..bfb6d2e5d1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc
@@ -0,0 +1,70 @@
+[[suspicious-file-changes-activity-detected]]
+=== Suspicious File Changes Activity Detected
+
+This rule identifies a sequence of 100 file extension rename events within a set of common file paths by the same process in a timespan of 1 second. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Impact
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=1s 
+  [ file where host.os.type == "linux" and event.type == "change" and
+    event.action == "rename" and file.extension != "" and 
+    file.path : (
+      "/home/*", "/etc/*", "/root/*", "/opt/*", "/var/backups/*", "/var/lib/log/*"
+      ) and not 
+    file.extension : (
+      "xml", "json", "conf", "dat", "gz", "info", "mod", "final",
+      "php", "pyc", "log", "bak", "bin", "csv", "pdf", "cfg", "*old"
+      ) and not 
+    process.name : (
+      "dpkg",  "yum", "dnf", "rpm", "dockerd"
+    ) ] with runs=100 | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Encrypted for Impact
+** ID: T1486
+** Reference URL: https://attack.mitre.org/techniques/T1486/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc
index dc91f4f3ae..7d2c5a9d89 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc
@@ -1,63 +1,61 @@
 [[suspicious-file-creation-in-etc-for-persistence]]
 === Suspicious File Creation in /etc for Persistence
 
-Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence for long term access.
+Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence mechanisms for long term access.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
-* logs-*
+* logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/
 * https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-* Orbit
-* Lightning Framework
-
-*Version*: 101 (<<suspicious-file-creation-in-etc-for-persistence-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Threat: Orbit
+* Threat: Lightning Framework
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.action == "creation" and user.name == "root" and
-file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*",
-"/etc/sudoers.d/*", "/etc/rc.d/init.d/*", "/etc/systemd/system/*") and
-not process.executable : ("*/dpkg", "*/yum", "*/apt", "*/dnf",
-"*/systemd", "*/snapd", "*/dnf-automatic", "*/yum-cron", "*/elastic-
-agent", "*/dnfdaemon-system")
+[source, js]
 ----------------------------------
+file where host.os.type == "linux" and event.type in ("creation", "file_create_event") and user.name == "root" and
+file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*", "/etc/sudoers.d/*", "/etc/rc.d/init.d/*", "/etc/systemd/system/*",
+"/usr//lib/systemd/system/*") and not process.executable : ("*/dpkg", "*/yum", "*/apt", "*/dnf", "*/rpm", "*/systemd",
+"*/snapd", "*/dnf-automatic","*/yum-cron", "*/elastic-agent", "*/dnfdaemon-system", "*/bin/dockerd", "*/sbin/dockerd",
+"/kaniko/executor", "/usr/sbin/rhn_check") and not file.extension == "swp"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,8 +67,26 @@ agent", "*/dnfdaemon-system")
 ** Name: Boot or Logon Initialization Scripts
 ** ID: T1037
 ** Reference URL: https://attack.mitre.org/techniques/T1037/
-
-
+* Sub-technique:
+** Name: RC Scripts
+** ID: T1037.004
+** Reference URL: https://attack.mitre.org/techniques/T1037/004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Systemd Service
+** ID: T1543.002
+** Reference URL: https://attack.mitre.org/techniques/T1543/002/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -79,8 +95,10 @@ agent", "*/dnfdaemon-system")
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -89,22 +107,7 @@ agent", "*/dnfdaemon-system")
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[suspicious-file-creation-in-etc-for-persistence-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.action == "creation" and user.name == "root" and
-file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*",
-"/etc/sudoers.d/*", "/etc/rc.d/init.d/*", "/etc/systemd/system/*") and
-not process.executable : ("*/dpkg", "*/yum", "*/apt", "*/dnf",
-"*/systemd")
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Sudo and Sudo Caching
+** ID: T1548.003
+** Reference URL: https://attack.mitre.org/techniques/T1548/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
index 6488bac384..b4aa59cc81 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a launchd child process with a hidden file. An adver
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,47 +14,44 @@ Identifies the execution of a launchd child process with a hidden file. An adver
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://objective-see.com/blog/blog_0x61.html
 * https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
 * https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-* Defense Evasion
-
-*Version*: 100 (<<suspicious-hidden-child-process-of-launchd-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:.* and process.parent.executable:/sbin/launchd
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:.* and process.parent.executable:/sbin/launchd
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,8 +63,10 @@ process.name:.* and process.parent.executable:/sbin/launchd
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-
+* Sub-technique:
+** Name: Launch Agent
+** ID: T1543.001
+** Reference URL: https://attack.mitre.org/techniques/T1543/001/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -76,13 +75,7 @@ process.name:.* and process.parent.executable:/sbin/launchd
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-[[suspicious-hidden-child-process-of-launchd-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc
index 00a584d6c5..3806ccc493 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of a browser process to open an HTML file with high ent
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,66 +13,66 @@ Identifies the execution of a browser process to open an HTML file with high ent
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
+*Tags*: 
 
-*Version*: 100 (<<suspicious-html-file-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by user.id with maxspan=5m [file where event.action in
-("creation", "rename") and file.extension : ("htm", "html") and
-file.path : ("?:\\Users\\*\\Downloads\\*",
-"?:\\Users\\*\\Content.Outlook\\*",
-"?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
-"?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
-"?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*") and ((file.Ext.entropy
->= 5 and file.size >= 150000) or file.size >= 1000000)] [process
-where event.action == "start" and ( (process.name in
-("chrome.exe", "msedge.exe", "brave.exe", "whale.exe", "browser.exe",
-"dragon.exe", "vivaldi.exe", "opera.exe") and process.args == "--
-single-argument") or (process.name == "iexplore.exe" and
-process.args_count == 2) or (process.name in ("firefox.exe",
-"waterfox.exe") and process.args == "-url") ) and process.args :
-("?:\\Users\\*\\Downloads\\*.htm*",
-"?:\\Users\\*\\Content.Outlook\\*.htm*",
-"?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*.htm*",
-"?:\\Users\\*\\AppData\\Local\\Temp\\7z*.htm*",
-"?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*.htm*")]
+[source, js]
 ----------------------------------
+sequence by user.id with maxspan=5m
+ [file where host.os.type == "windows" and event.action in ("creation", "rename") and
+  file.extension : ("htm", "html") and
+   file.path : ("?:\\Users\\*\\Downloads\\*",
+                "?:\\Users\\*\\Content.Outlook\\*",
+                "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
+                "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
+                "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*") and
+   ((file.Ext.entropy >= 5 and file.size >= 150000) or file.size >= 1000000)]
+ [process where host.os.type == "windows" and event.action == "start" and
+  (
+   (process.name in ("chrome.exe", "msedge.exe", "brave.exe", "whale.exe", "browser.exe", "dragon.exe", "vivaldi.exe", "opera.exe")
+    and process.args == "--single-argument") or
+   (process.name == "iexplore.exe" and process.args_count == 2) or
+   (process.name in ("firefox.exe", "waterfox.exe") and process.args == "-url")
+  )
+  and process.args : ("?:\\Users\\*\\Downloads\\*.htm*",
+                      "?:\\Users\\*\\Content.Outlook\\*.htm*",
+                      "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*.htm*",
+                      "?:\\Users\\*\\AppData\\Local\\Temp\\7z*.htm*",
+                      "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*.htm*")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,8 +84,14 @@ process.args_count == 2) or (process.name in ("firefox.exe",
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -94,10 +100,7 @@ process.args_count == 2) or (process.name in ("firefox.exe",
 ** Name: Obfuscated Files or Information
 ** ID: T1027
 ** Reference URL: https://attack.mitre.org/techniques/T1027/
-
-[[suspicious-html-file-creation-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: HTML Smuggling
+** ID: T1027.006
+** Reference URL: https://attack.mitre.org/techniques/T1027/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
new file mode 100644
index 0000000000..c791e18a29
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
@@ -0,0 +1,76 @@
+[[suspicious-image-load-taskschd-dll-from-ms-office]]
+=== Suspicious Image Load (taskschd.dll) from MS Office
+
+Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
+* https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+  process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  (dll.name : "taskschd.dll" or file.name : "taskschd.dll")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc
index 1a16ee3cfc..754e7004b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc
@@ -5,50 +5,53 @@ Identifies the creation of a suspicious ImagePath value. This could be an indica
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<suspicious-imagepath-service-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path :
-"HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath" and /* add
-suspicious registry ImagePath values here */ registry.data.strings :
-("%COMSPEC%*", "*\\.\\pipe\\*")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath"
+    ) and
+ /* add suspicious registry ImagePath values here */
+    registry.data.strings : ("%COMSPEC%*", "*\\.\\pipe\\*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -60,22 +63,7 @@ suspicious registry ImagePath values here */ registry.data.strings :
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[suspicious-imagepath-service-creation-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc
new file mode 100644
index 0000000000..1fe57b8c20
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc
@@ -0,0 +1,78 @@
+[[suspicious-inter-process-communication-via-outlook]]
+=== Suspicious Inter-Process Communication via Outlook
+
+Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.action == "start" and process.name : "OUTLOOK.EXE"  and
+ process.Ext.effective_parent.name != null and
+ not process.Ext.effective_parent.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Inter-Process Communication
+** ID: T1559
+** Reference URL: https://attack.mitre.org/techniques/T1559/
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-interactive-shell-spawned-from-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-interactive-shell-spawned-from-inside-a-container.asciidoc
new file mode 100644
index 0000000000..1f240d21ef
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-interactive-shell-spawned-from-inside-a-container.asciidoc
@@ -0,0 +1,72 @@
+[[suspicious-interactive-shell-spawned-from-inside-a-container]]
+=== Suspicious Interactive Shell Spawned From Inside A Container
+
+This rule detects when an interactive shell is spawned inside a running container. This could indicate a potential container breakout attempt or an attacker's attempt to gain unauthorized access to the underlying host.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and
+event.type== "start" and 
+
+/*D4C consolidates closely spawned event.actions, this excludes end actions to only capture ongoing processes*/
+event.action in ("fork", "exec") and event.action != "end"
+ and process.entry_leader.same_as_process== false and
+(
+(process.executable: "*/*sh" and process.args: ("-i", "-it")) or
+process.args: "*/*sh"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc
index b76ab6c248..9d1b8a51d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious child processes of the Java interpreter process. This may
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,13 +14,13 @@ Identifies suspicious child processes of the Java interpreter process. This may
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.lunasec.io/docs/blog/log4j-zero-day/
 * https://github.com/christophetd/log4shell-vulnerable-app
@@ -28,82 +28,70 @@ Identifies suspicious child processes of the Java interpreter process. This may
 * https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security
 * https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Execution
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-java-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Java Child Process
 
-This rule identifies a suspicious child process of the Java interpreter process. It may indicate an attempt to execute
-a malicious JAR file or an exploitation attempt via a Java specific vulnerability.
+This rule identifies a suspicious child process of the Java interpreter process. It may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a Java specific vulnerability.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence and whether they are located in expected locations.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
-spawned child processes.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 - Examine the command line to determine if the command executed is potentially harmful or malicious.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 
 ### False positive analysis
 
-- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination
-of process and command line conditions.
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process and command line conditions.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 process where event.type in ("start", "process_started") and
-process.parent.name : "java" and process.name : ("sh", "bash",
-"dash", "ksh", "tcsh", "zsh", "curl", "wget")
-----------------------------------
+  process.parent.name : "java" and
+  process.name : ("sh", "bash", "dash", "ksh", "tcsh", "zsh", "curl", "wget")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -115,38 +103,7 @@ process.parent.name : "java" and process.name : ("sh", "bash",
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-java-child-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Rule name changed from: Suspicious JAR Child Process
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "java" and process.name : ("sh", "bash",
-"dash", "ksh", "tcsh", "zsh", "curl", "wget") and process.args :
-"-jar" and process.args : "*.jar" and /* Add any FP's here */ not
-process.executable : ("/Users/*/.sdkman/*",
-"/Library/Java/JavaVirtualMachines/*") and not process.args :
-("/usr/local/*", "/Users/*/github.com/*", "/Users/*/src/*")
-----------------------------------
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: JavaScript
+** ID: T1059.007
+** Reference URL: https://attack.mitre.org/techniques/T1059/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc
index 0405d46719..a1dfcd04db 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious access to LSASS handle from a call trace pointing to seclo
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,58 +14,56 @@ Identifies suspicious access to LSASS handle from a call trace pointing to seclo
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Sysmon Only
-
-*Version*: 101 (<<suspicious-lsass-access-via-malseclogon-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.4.0
+*Version*: 206
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.code == "10" and winlog.event_data.TargetImage :
-"?:\\WINDOWS\\system32\\lsass.exe" and /* seclogon service
-accessing lsass */ winlog.event_data.CallTrace : "*seclogon.dll*"
-and process.name : "svchost.exe" and /* PROCESS_CREATE_PROCESS &
-PROCESS_DUP_HANDLE & PROCESS_QUERY_INFORMATION */
-winlog.event_data.GrantedAccess == "0x14c0"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.code == "10" and
+  winlog.event_data.TargetImage : "?:\\WINDOWS\\system32\\lsass.exe" and
+
+   /* seclogon service accessing lsass */
+  winlog.event_data.CallTrace : "*seclogon.dll*" and process.name : "svchost.exe" and
 
-==== Threat mapping
+   /* PROCESS_CREATE_PROCESS & PROCESS_DUP_HANDLE & PROCESS_QUERY_INFORMATION */
+  winlog.event_data.GrantedAccess == "0x14c0"
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,13 +75,7 @@ winlog.event_data.GrantedAccess == "0x14c0"
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[suspicious-lsass-access-via-malseclogon-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc
new file mode 100644
index 0000000000..8d3fcc6346
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc
@@ -0,0 +1,92 @@
+[[suspicious-lsass-process-access]]
+=== Suspicious Lsass Process Access
+
+Identifies access attempts to LSASS handle, this may indicate an attempt to dump credentials from Lsass memory.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Sysmon Only
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.code == "10" and
+  winlog.event_data.TargetImage : "?:\\WINDOWS\\system32\\lsass.exe" and
+  not winlog.event_data.GrantedAccess :
+                ("0x1000", "0x1400", "0x101400", "0x101000", "0x101001", "0x100000", "0x100040", "0x3200", "0x40", "0x3200") and
+  not process.name : ("procexp64.exe", "procmon.exe", "procexp.exe", "Microsoft.Identity.AadConnect.Health.AadSync.Host.ex") and
+  not process.executable :
+            ("?:\\Windows\\System32\\lsm.exe",
+             "?:\\Program Files\\*",
+             "?:\\Program Files (x86)\\*",
+             "?:\\Windows\\System32\\msiexec.exe",
+             "?:\\Windows\\CCM\\CcmExec.exe",
+             "?:\\Windows\\system32\\csrss.exe",
+             "?:\\Windows\\system32\\wininit.exe",
+             "?:\\Windows\\system32\\wbem\\wmiprvse.exe",
+             "?:\\Windows\\system32\\MRT.exe",
+             "?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\*",
+             "?:\\ProgramData\\WebEx\\webex\\*",
+             "?:\\Windows\\LTSvc\\LTSVC.exe") and
+   not winlog.event_data.CallTrace : ("*mpengine.dll*", "*appresolver.dll*", "*sysmain.dll*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
index e54233a6d8..8917b21b8d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,55 +13,74 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.malwarebytes.com/cybercrime/2017/02/microsoft-office-macro-malware-targets-macs/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Initial Access
-
-*Version*: 100 (<<suspicious-macos-ms-office-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name:("Microsoft Word", "Microsoft PowerPoint",
-"Microsoft Excel") and process.name: ( "bash", "dash",
-"sh", "tcsh", "csh", "zsh", "ksh", "fish",
-"python*", "perl*", "php*", "osascript", "pwsh",
-"curl", "wget", "cp", "mv", "base64", "launchctl" )
-and /* noisy false positives related to product version discovery
-and office errors reporting */ not process.args: (
-"ProductVersion", "hw.model", "ioreg",
-"ProductName", "ProductUserVisibleVersion",
-"ProductBuildVersion", "/Library/Application
-Support/Microsoft/MERP*/Microsoft Error
-Reporting.app/Contents/MacOS/Microsoft Error Reporting" )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+ process.parent.name:("Microsoft Word", "Microsoft PowerPoint", "Microsoft Excel") and
+ process.name:
+ (
+   "bash",
+   "dash",
+   "sh",
+   "tcsh",
+   "csh",
+   "zsh",
+   "ksh",
+   "fish",
+   "python*",
+   "perl*",
+   "php*",
+   "osascript",
+   "pwsh",
+   "curl",
+   "wget",
+   "cp",
+   "mv",
+   "base64",
+   "launchctl"
+  ) and
+  /* noisy false positives related to product version discovery and office errors reporting */
+  not process.args:
+    (
+      "ProductVersion",
+      "hw.model",
+      "ioreg",
+      "ProductName",
+      "ProductUserVisibleVersion",
+      "ProductBuildVersion",
+      "/Library/Application Support/Microsoft/MERP*/Microsoft Error Reporting.app/Contents/MacOS/Microsoft Error Reporting"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,44 +92,7 @@ Reporting.app/Contents/MacOS/Microsoft Error Reporting" )
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[suspicious-macos-ms-office-child-process-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name:("Microsoft Word", "Microsoft PowerPoint",
-"Microsoft Excel") and process.name: ( "bash", "dash",
-"sh", "tcsh", "csh", "zsh", "ksh", "fish",
-"python*", "perl*", "php*", "osascript", "pwsh",
-"curl", "wget", "cp", "mv", "base64", "launchctl"
-) and /* noisy false positives related to product version discovery
-and office errors reporting */ not process.args: (
-"ProductVersion", "hw.model", "ioreg",
-"ProductName", "ProductUserVisibleVersion",
-"ProductBuildVersion", "/Library/Application
-Support/Microsoft/MERP*/Microsoft Error
-Reporting.app/Contents/MacOS/Microsoft Error Reporting" )
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name:("Microsoft Word", "Microsoft PowerPoint",
-"Microsoft Excel") and process.name: ( "bash", "dash",
-"sh", "tcsh", "csh", "zsh", "ksh", "fish",
-"python*", "perl*", "php*", "osascript", "pwsh",
-"curl", "wget", "cp", "mv", "base64", "launchctl"
-)
-----------------------------------
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc
index ec730f3fd6..e1d7e8402a 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc
@@ -5,7 +5,7 @@ Identifies a suspicious managed code hosting process which could indicate code i
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,50 +15,51 @@ Identifies a suspicious managed code hosting process which could indicate code i
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-
-*Version*: 100 (<<suspicious-managed-code-hosting-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=5m [process where
-event.type == "start" and process.name : ("wscript.exe",
-"cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe",
-"dllhost.exe", "cmstp.exe")] [file where event.type != "deletion" and
-file.name : ("wscript.exe.log", "cscript.exe",
-"mshta.exe.log", "wmic.exe.log",
-"svchost.exe.log", "dllhost.exe.log",
-"cmstp.exe.log", "regsvr32.exe.log")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=5m
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe", "dllhost.exe", "cmstp.exe")]
+ [file where host.os.type == "windows" and event.type != "deletion" and
+  file.name : ("wscript.exe.log",
+               "cscript.exe",
+               "mshta.exe.log",
+               "wmic.exe.log",
+               "svchost.exe.log",
+               "dllhost.exe.log",
+               "cmstp.exe.log",
+               "regsvr32.exe.log")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -70,45 +71,3 @@ file.name : ("wscript.exe.log", "cscript.exe",
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[suspicious-managed-code-hosting-process-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=5m [process where
-event.type == "start" and process.name : ("wscript.exe",
-"cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe",
-"dllhost.exe", "cmstp.exe")] [file where event.type != "deletion" and
-file.name : ("wscript.exe.log", "cscript.exe",
-"mshta.exe.log", "wmic.exe.log",
-"svchost.exe.log", "dllhost.exe.log",
-"cmstp.exe.log", "regsvr32.exe.log")]
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.name:(wscript.exe.log or mshta.exe.log or wscript.exe.log or
-wmic.exe.log or svchost.exe.log or dllhost.exe.log or cmstp.exe.log or
-regsvr32.exe.log)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
new file mode 100644
index 0000000000..e851c0b6ff
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
@@ -0,0 +1,69 @@
+[[suspicious-microsoft-365-mail-access-by-clientappid]]
+=== Suspicious Microsoft 365 Mail Access by ClientAppId
+
+Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was observed for the fist time during the last 10 days.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Configuration Audit
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:MailItemsAccessed and event.outcome:success
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
index 1b6c4b4f89..2762a042d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
@@ -5,7 +5,7 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,67 +16,62 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://twitter.com/nao_sec/status/1530196847679401984
 * https://lolbas-project.github.io/lolbas/Binaries/Msdt/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<suspicious-microsoft-diagnostics-wizard-execution-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and
-(process.pe.original_file_name == "msdt.exe" or process.name :
-"msdt.exe") and ( process.args : ("IT_RebrowseForFile=*", "ms-
-msdt:/id", "ms-msdt:-id", "*FromBase64*") or (process.args :
-"-af" and process.args : "/skip" and process.parent.name :
-("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe",
-"wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
-process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml",
-"PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*"))
-or (process.pe.original_file_name == "msdt.exe" and not
-process.name : "msdt.exe" and process.name != null) or
-(process.pe.original_file_name == "msdt.exe" and not
-process.executable : ("?:\\Windows\\system32\\msdt.exe",
-"?:\\Windows\\SysWOW64\\msdt.exe")) )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+   (process.pe.original_file_name == "msdt.exe" or process.name : "msdt.exe") and
+   (
+    process.args : ("IT_RebrowseForFile=*", "ms-msdt:/id", "ms-msdt:-id", "*FromBase64*") or
+
+    (process.args : "-af" and process.args : "/skip" and
+     process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
+     process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml", "PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*")) or
+
+    (process.pe.original_file_name == "msdt.exe" and not process.name : "msdt.exe" and process.name != null) or
 
-==== Threat mapping
+    (process.pe.original_file_name == "msdt.exe" and not process.executable : ("?:\\Windows\\system32\\msdt.exe", "?:\\Windows\\SysWOW64\\msdt.exe"))
+    )
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -88,52 +83,3 @@ process.executable : ("?:\\Windows\\system32\\msdt.exe",
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[suspicious-microsoft-diagnostics-wizard-execution-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.pe.original_file_name == "msdt.exe" or process.name :
-"msdt.exe") and ( process.args : ("IT_RebrowseForFile=*", "ms-
-msdt:/id", "ms-msdt:-id", "*FromBase64*") or (process.args :
-"-af" and process.args : "/skip" and process.parent.name :
-("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe",
-"wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
-process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml",
-"PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*"))
-or (process.pe.original_file_name == "msdt.exe" and not
-process.name : "msdt.exe" and process.name != null) or
-(process.pe.original_file_name == "msdt.exe" and not
-process.executable : ("?:\\Windows\\system32\\msdt.exe",
-"?:\\Windows\\SysWOW64\\msdt.exe")) )
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.pe.original_file_name == "msdt.exe" or process.name :
-"msdt.exe") and ( process.args : ("IT_RebrowseForFile=*", "ms-
-msdt:/id", "ms-msdt:-id", "*FromBase64*") or (process.args :
-"-af" and process.args : "/skip" and process.parent.name :
-("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe",
-"wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
-process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml",
-"PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*"))
-or (process.pe.original_file_name == "msdt.exe" and not
-process.name : "msdt.exe" and process.name != null) or
-(process.pe.original_file_name == "msdt.exe" and not
-process.executable : ("?:\\Windows\\system32\\msdt.exe",
-"?:\\Windows\\SysWOW64\\msdt.exe")) )
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc
new file mode 100644
index 0000000000..45e39087b8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc
@@ -0,0 +1,66 @@
+[[suspicious-mining-process-creation-event]]
+=== Suspicious Mining Process Creation Event
+
+Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and
+event.action : ("creation", "file_create_event") and 
+file.name : ("aliyun.service", "moneroocean_miner.service", "c3pool_miner.service", "pnsd.service", "apache4.service", "pastebin.service", "xvf.service")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc
new file mode 100644
index 0000000000..7f71889664
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc
@@ -0,0 +1,87 @@
+[[suspicious-modprobe-file-event]]
+=== Suspicious Modprobe File Event
+
+Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /etc/modprobe.conf -p wa -k modprobe
+-w /etc/modprobe.d -p wa -k modprobe
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action in ("opened-file", "read-file", "wrote-to-file") and
+file.path : ("/etc/modprobe.conf", "/etc/modprobe.d", "/etc/modprobe.d/*") and not 
+(process.name in ("auditbeat", "kmod", "modprobe", "lsmod", "insmod", "modinfo", "rmmod") or process.title : ("*grep*") or process.parent.pid == 1)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
new file mode 100644
index 0000000000..e2c0176113
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
@@ -0,0 +1,137 @@
+[[suspicious-module-loaded-by-lsass]]
+=== Suspicious Module Loaded by LSASS
+
+Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.xpnsec.com/exploring-mimikatz-part-2/
+* https://github.com/jas502n/mimikat_ssp
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and process.executable : "?:\\Windows\\System32\\lsass.exe" and
+  not (dll.code_signature.subject_name :
+               ("Microsoft Windows",
+                "Microsoft Corporation",
+                "Microsoft Windows Publisher",
+                "Microsoft Windows Software Compatibility Publisher",
+                "Microsoft Windows Hardware Compatibility Publisher",
+                "McAfee, Inc.",
+                "SecMaker AB",
+                "HID Global Corporation",
+                "HID Global",
+                "Apple Inc.",
+                "Citrix Systems, Inc.",
+                "Dell Inc",
+                "Hewlett-Packard Company",
+                "Symantec Corporation",
+                "National Instruments Corporation",
+                "DigitalPersona, Inc.",
+                "Novell, Inc.",
+                "gemalto",
+                "EasyAntiCheat Oy",
+                "Entrust Datacard Corporation",
+                "AuriStor, Inc.",
+                "LogMeIn, Inc.",
+                "VMware, Inc.",
+                "Istituto Poligrafico e Zecca dello Stato S.p.A.",
+                "Nubeva Technologies Ltd",
+                "Micro Focus (US), Inc.",
+                "Yubico AB",
+                "GEMALTO SA",
+                "Secure Endpoints, Inc.",
+                "Sophos Ltd",
+                "Morphisec Information Security 2014 Ltd",
+                "Entrust, Inc.",
+                "Nubeva Technologies Ltd",
+                "Micro Focus (US), Inc.",
+                "F5 Networks Inc",
+                "Bit4id",
+                "Thales DIS CPL USA, Inc.",
+                "Micro Focus International plc",
+                "HYPR Corp",
+                "Intel(R) Software Development Products",
+                "PGP Corporation",
+                "Parallels International GmbH",
+                "FrontRange Solutions Deutschland GmbH",
+                "SecureLink, Inc.",
+                "Tidexa OU",
+                "Amazon Web Services, Inc.",
+                "SentryBay Limited",
+                "Audinate Pty Ltd",
+                "CyberArk Software Ltd.",
+                "McAfeeSysPrep",
+                "NVIDIA Corporation PE Sign v2016") and
+       dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining")) and
+
+     not dll.hash.sha256 :
+                ("811a03a5d7c03802676d2613d741be690b3461022ea925eb6b2651a5be740a4c",
+                 "1181542d9cfd63fb00c76242567446513e6773ea37db6211545629ba2ecf26a1",
+                 "ed6e735aa6233ed262f50f67585949712f1622751035db256811b4088c214ce3",
+                 "26be2e4383728eebe191c0ab19706188f0e9592add2e0bf86b37442083ae5e12",
+                 "9367e78b84ef30cf38ab27776605f2645e52e3f6e93369c674972b668a444faa",
+                 "d46cc934765c5ecd53867070f540e8d6f7701e834831c51c2b0552aba871921b",
+                 "0f77a3826d7a5cd0533990be0269d951a88a5c277bc47cff94553330b715ec61",
+                 "4aca034d3d85a9e9127b5d7a10882c2ef4c3e0daa3329ae2ac1d0797398695fb",
+                 "86031e69914d9d33c34c2f4ac4ae523cef855254d411f88ac26684265c981d95")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
index a4a37859c2..d74613e8d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
@@ -5,69 +5,64 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/blog/vulnerability-summary-follina
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-ms-office-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious MS Office Child Process
 
-Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer.
-You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create
-presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted
-for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
 
-This rule looks for suspicious processes spawned by MS Office programs. This is generally the result of the execution of
-malicious documents.
+This rule looks for suspicious processes spawned by MS Office programs. This is generally the result of the execution of malicious documents.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include,
-but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
 - Determine if the collected files are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -86,55 +81,39 @@ but are not limited to, the Downloads and Document folders and the folder config
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
   - If the malicious file was delivered via phishing:
     - Block the email sender from sending future emails.
     - Block the malicious web pages.
     - Remove emails from the sender from mailboxes.
     - Consider improvements to the security awareness program.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("eqnedt32.exe", "excel.exe", "fltldr.exe", "msaccess.exe",
-"mspub.exe", "powerpnt.exe", "winword.exe", "outlook.exe") and
-process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe",
-"atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe",
-"certutil.exe", "cmd.exe", "cmstp.exe", "control.exe",
-"cscript.exe", "csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe",
-"forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe",
-"hostname.exe", "ieexec.exe", "iexpress.exe", "installutil.exe",
-"ipconfig.exe", "mshta.exe", "msxsl.exe",
-"nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe",
-"nltest.exe", "odbcconf.exe", "ping.exe",
-"powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe",
-"qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
-"regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
-"systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe",
-"wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe",
-"rundll32.exe", "hh.exe", "msdt.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("eqnedt32.exe", "excel.exe", "fltldr.exe", "msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe", "outlook.exe") and
+  process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "certutil.exe",
+                "cmd.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe",
+                "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "ipconfig.exe",
+                "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe",
+                "ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
+                "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe",
+                "wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe", "rundll32.exe", "hh.exe", "msdt.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -146,192 +125,19 @@ process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe",
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[suspicious-ms-office-child-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("eqnedt32.exe", "excel.exe", "fltldr.exe",
-"msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe",
-"outlook.exe") and process.name :
-("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe",
-"bginfo.exe", "bitsadmin.exe", "cdb.exe", "certutil.exe",
-"cmd.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe",
-"dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe",
-"fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe",
-"iexpress.exe", "installutil.exe", "ipconfig.exe",
-"mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe",
-"netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe",
-"ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe",
-"qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
-"regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
-"systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe",
-"wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe",
-"rundll32.exe", "hh.exe", "msdt.exe")
-----------------------------------
-
-Version 13 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("eqnedt32.exe", "excel.exe", "fltldr.exe",
-"msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe",
-"outlook.exe") and process.name :
-("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe",
-"bginfo.exe", "bitsadmin.exe", "cdb.exe", "certutil.exe",
-"cmd.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe",
-"dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe",
-"fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe",
-"iexpress.exe", "installutil.exe", "ipconfig.exe",
-"mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe",
-"netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe",
-"ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe",
-"qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
-"regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
-"systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe",
-"wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe",
-"rundll32.exe", "hh.exe", "msdt.exe")
-----------------------------------
-
-Version 11 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("eqnedt32.exe", "excel.exe", "fltldr.exe",
-"msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe") and
-process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe",
-"atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe",
-"certutil.exe", "cmd.exe", "cmstp.exe", "control.exe",
-"cscript.exe", "csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe",
-"forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe",
-"hostname.exe", "ieexec.exe", "iexpress.exe", "installutil.exe",
-"ipconfig.exe", "mshta.exe", "msxsl.exe",
-"nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe",
-"nltest.exe", "odbcconf.exe", "ping.exe",
-"powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe",
-"qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
-"regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
-"systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe",
-"wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe",
-"rundll32.exe", "hh.exe")
-----------------------------------
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("eqnedt32.exe", "excel.exe", "fltldr.exe",
-"msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe") and
-process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe",
-"atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe",
-"certutil.exe", "cmd.exe", "cmstp.exe", "cscript.exe",
-"csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe",
-"fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe",
-"ieexec.exe", "iexpress.exe", "installutil.exe", "ipconfig.exe",
-"mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe",
-"net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe",
-"ping.exe", "powershell.exe", "pwsh.exe",
-"qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe",
-"regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe",
-"schtasks.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe",
-"whoami.exe", "wmic.exe", "wscript.exe",
-"xwizard.exe", "explorer.exe", "rundll32.exe", "hh.exe")
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or
-msaccess.exe or mspub.exe or powerpnt.exe or winword.exe) and
-process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or
-atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe
-or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or
-dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or
-gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or
-installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or
-nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or
-nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe
-or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or
-regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or
-systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or
-wmic.exe or wscript.exe or xwizard.exe)
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:(eqnedt32.exe or excel.exe or fltldr.exe or
-msaccess.exe or mspub.exe or powerpnt.exe or winword.exe) and
-process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or
-atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe
-or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or
-dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or
-gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or
-installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or
-nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or
-nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe
-or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or
-regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or
-systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or
-wmic.exe or wscript.exe or xwizard.exe)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:("winword.exe" or "excel.exe" or "powerpnt.exe" or
-"eqnedt32.exe" or "fltldr.exe" or "mspub.exe" or "msaccess.exe") and
-process.name:("arp.exe" or "dsquery.exe" or "dsget.exe" or
-"gpresult.exe" or "hostname.exe" or "ipconfig.exe" or "nbtstat.exe" or
-"net.exe" or "net1.exe" or "netsh.exe" or "netstat.exe" or
-"nltest.exe" or "ping.exe" or "qprocess.exe" or "quser.exe" or
-"qwinsta.exe" or "reg.exe" or "sc.exe" or "systeminfo.exe" or
-"tasklist.exe" or "tracert.exe" or "whoami.exe" or "bginfo.exe" or
-"cdb.exe" or "cmstp.exe" or "csi.exe" or "dnx.exe" or "fsi.exe" or
-"ieexec.exe" or "iexpress.exe" or "installutil.exe" or
-"Microsoft.Workflow.Compiler.exe" or "msbuild.exe" or "mshta.exe" or
-"msxsl.exe" or "odbcconf.exe" or "rcsi.exe" or "regsvr32.exe" or
-"xwizard.exe" or "atbroker.exe" or "forfiles.exe" or "schtasks.exe" or
-"regasm.exe" or "regsvcs.exe" or "cmd.exe" or "cscript.exe" or
-"powershell.exe" or "pwsh.exe" or "wmic.exe" or "wscript.exe" or
-"bitsadmin.exe" or "certutil.exe" or "ftp.exe")
-----------------------------------
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
index 23a9d5a0ad..7a3cbef15d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
@@ -5,63 +5,61 @@ Identifies suspicious child processes of Microsoft Outlook. These child processe
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<suspicious-ms-outlook-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious MS Outlook Child Process
 
-Microsoft Outlook is an email client that provides contact, email calendar, and task management features. Outlook is
-widely used, either standalone or as part of the Office suite.
+Microsoft Outlook is an email client that provides contact, email calendar, and task management features. Outlook is widely used, either standalone or as part of the Office suite.
 
-This rule looks for suspicious processes spawned by MS Outlook, which can be the result of the execution of malicious
-documents and/or exploitation for initial access.
+This rule looks for suspicious processes spawned by MS Outlook, which can be the result of the execution of malicious documents and/or exploitation for initial access.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Retrieve recently opened files received via email and opened by the user that could cause this behavior. Common
-locations include but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Retrieve recently opened files received via email and opened by the user that could cause this behavior. Common locations include but are not limited to, the Downloads and Document folders and the folder configured at the email client.
 - Determine if the collected files are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -80,51 +78,40 @@ locations include but are not limited to, the Downloads and Document folders and
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
   - If the malicious file was delivered via phishing:
     - Block the email sender from sending future emails.
     - Block the malicious web pages.
     - Remove emails from the sender from mailboxes.
     - Consider improvements to the security awareness program.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"outlook.exe" and process.name : ("Microsoft.Workflow.Compiler.exe",
-"arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe",
-"cdb.exe", "certutil.exe", "cmd.exe", "cmstp.exe", "cscript.exe",
-"csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe",
-"forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe",
-"ieexec.exe", "iexpress.exe", "installutil.exe",
-"ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe",
-"net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe",
-"ping.exe", "powershell.exe", "pwsh.exe",
-"qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe",
-"regasm.exe", "regsvcs.exe", "regsvr32.exe",
-"sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe",
-"tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe", "xwizard.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "outlook.exe" and
+  process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe",
+                  "cdb.exe", "certutil.exe", "cmd.exe", "cmstp.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe",
+                  "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe",
+                  "iexpress.exe", "installutil.exe", "ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe",
+                  "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe", "ping.exe", "powershell.exe",
+                  "pwsh.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
+                  "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe",
+                  "tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe", "xwizard.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,118 +123,7 @@ process where event.type == "start" and process.parent.name :
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[suspicious-ms-outlook-child-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "outlook.exe" and process.name :
-("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe",
-"bginfo.exe", "bitsadmin.exe", "cdb.exe",
-"certutil.exe", "cmd.exe", "cmstp.exe", "cscript.exe", "csi.exe",
-"dnx.exe", "dsget.exe", "dsquery.exe",
-"forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe",
-"ieexec.exe", "iexpress.exe", "installutil.exe",
-"ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe",
-"net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe",
-"ping.exe", "powershell.exe", "pwsh.exe",
-"qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe",
-"regasm.exe", "regsvcs.exe", "regsvr32.exe",
-"sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe",
-"tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe", "xwizard.exe")
-----------------------------------
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:outlook.exe and
-process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or
-atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or
-certutil.exe or cmd.exe or cmstp.exe or cscript.exe or csi.exe or
-dnx.exe or dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or
-ftp.exe or gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe
-or installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or
-nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or
-nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe
-or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or
-regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or
-systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or
-wmic.exe or wscript.exe or xwizard.exe)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:outlook.exe and
-process.name:(Microsoft.Workflow.Compiler.exe or arp.exe or
-atbroker.exe or bginfo.exe or bitsadmin.exe or cdb.exe or certutil.exe
-or cmd.exe or cmstp.exe or cscript.exe or csi.exe or dnx.exe or
-dsget.exe or dsquery.exe or forfiles.exe or fsi.exe or ftp.exe or
-gpresult.exe or hostname.exe or ieexec.exe or iexpress.exe or
-installutil.exe or ipconfig.exe or mshta.exe or msxsl.exe or
-nbtstat.exe or net.exe or net1.exe or netsh.exe or netstat.exe or
-nltest.exe or odbcconf.exe or ping.exe or powershell.exe or pwsh.exe
-or qprocess.exe or quser.exe or qwinsta.exe or rcsi.exe or reg.exe or
-regasm.exe or regsvcs.exe or regsvr32.exe or sc.exe or schtasks.exe or
-systeminfo.exe or tasklist.exe or tracert.exe or whoami.exe or
-wmic.exe or wscript.exe or xwizard.exe)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:"outlook.exe" and process.name:("arp.exe" or
-"dsquery.exe" or "dsget.exe" or "gpresult.exe" or "hostname.exe" or
-"ipconfig.exe" or "nbtstat.exe" or "net.exe" or "net1.exe" or
-"netsh.exe" or "netstat.exe" or "nltest.exe" or "ping.exe" or
-"qprocess.exe" or "quser.exe" or "qwinsta.exe" or "reg.exe" or
-"sc.exe" or "systeminfo.exe" or "tasklist.exe" or "tracert.exe" or
-"whoami.exe" or "bginfo.exe" or "cdb.exe" or "cmstp.exe" or "csi.exe"
-or "dnx.exe" or "fsi.exe" or "ieexec.exe" or "iexpress.exe" or
-"installutil.exe" or "Microsoft.Workflow.Compiler.exe" or
-"msbuild.exe" or "mshta.exe" or "msxsl.exe" or "odbcconf.exe" or
-"rcsi.exe" or "regsvr32.exe" or "xwizard.exe" or "atbroker.exe" or
-"forfiles.exe" or "schtasks.exe" or "regasm.exe" or "regsvcs.exe" or
-"cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or
-"wmic.exe" or "wscript.exe" or "bitsadmin.exe" or "certutil.exe" or
-"ftp.exe")
-----------------------------------
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
new file mode 100644
index 0000000000..3f335b5854
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
@@ -0,0 +1,76 @@
+[[suspicious-net-code-compilation]]
+=== Suspicious .NET Code Compilation
+
+Identifies suspicious .NET code execution. connections.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("csc.exe", "vbc.exe") and
+  process.parent.name : ("wscript.exe", "mshta.exe", "cscript.exe", "wmic.exe", "svchost.exe", "rundll32.exe", "cmstp.exe", "regsvr32.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Sub-technique:
+** Name: Compile After Delivery
+** ID: T1027.004
+** Reference URL: https://attack.mitre.org/techniques/T1027/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
new file mode 100644
index 0000000000..f535b03b56
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -0,0 +1,161 @@
+[[suspicious-net-reflection-via-powershell]]
+=== Suspicious .NET Reflection via PowerShell
+
+Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.
+
+*Rule type*: query
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 108
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Suspicious .NET Reflection via PowerShell
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
+
+### Related rules
+
+- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "[System.Reflection.Assembly]::Load" or
+    "[Reflection.Assembly]::Load"
+  ) and not
+  powershell.file.script_block_text : (
+    ("CommonWorkflowParameters" or "RelatedLinksHelpInfo") and
+    "HelpDisplayStrings"
+  ) and not
+  (powershell.file.script_block_text :
+    ("Get-SolutionFiles" or "Get-VisualStudio" or "Select-MSBuildPath") and
+    not file.name : "PathFunctions.ps1"
+  )
+  and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Sub-technique:
+** Name: Dynamic-link Library Injection
+** ID: T1055.001
+** Reference URL: https://attack.mitre.org/techniques/T1055/001/
+* Sub-technique:
+** Name: Portable Executable Injection
+** ID: T1055.002
+** Reference URL: https://attack.mitre.org/techniques/T1055/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc
new file mode 100644
index 0000000000..e10076660a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc
@@ -0,0 +1,120 @@
+[[suspicious-network-activity-to-the-internet-by-previously-unknown-executable]]
+=== Suspicious Network Activity to the Internet by Previously Unknown Executable
+
+This rule monitors for network connectivity to the internet from a previously unknown executable located in a suspicious directory to a previously unknown destination ip. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to establish connections to unknown or suspicious destinations such as a command and control server. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* auditbeat-*
+* filebeat-*
+* packetbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-59m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:network and 
+event.action:(connection_attempted or ipv4_connection_attempt_event) and 
+process.executable : ( 
+    (/etc/crontab or 
+     /etc/rc.local or 
+     /boot/* or 
+     /dev/shm/* or 
+     /etc/cron.*/* or 
+     /etc/init.d/* or 
+     /etc/rc*.d/* or 
+     /etc/update-motd.d/* or 
+     /home/*/.* or 
+     /run/* or 
+     /srv/* or 
+     /tmp/* or 
+     /usr/lib/update-notifier/* or 
+     /var/tmp/*) and 
+     not (/usr/bin/apt or 
+          /usr/bin/curl or 
+          /usr/bin/dnf or 
+          /usr/bin/dockerd or 
+          /usr/bin/dpkg or 
+          /usr/bin/rpm or 
+          /usr/bin/wget or 
+          /usr/bin/yum) 
+    ) 
+and source.ip : ( 
+    10.0.0.0/8 or 
+    127.0.0.0/8 or 
+    172.16.0.0/12 or 
+    192.168.0.0/16) and 
+    not destination.ip : ( 
+        10.0.0.0/8 or 
+        100.64.0.0/10 or 
+        127.0.0.0/8 or 
+        169.254.0.0/16 or 
+        172.16.0.0/12 or 
+        192.0.0.0/24 or 
+        192.0.0.0/29 or 
+        192.0.0.10/32 or 
+        192.0.0.170/32 or 
+        192.0.0.171/32 or 
+        192.0.0.8/32 or 
+        192.0.0.9/32 or 
+        192.0.2.0/24 or 
+        192.168.0.0/16 or 
+        192.175.48.0/24 or 
+        192.31.196.0/24 or 
+        192.52.193.0/24 or 
+        192.88.99.0/24 or 
+        198.18.0.0/15 or 
+        198.51.100.0/24 or 
+        203.0.113.0/24 or 
+        224.0.0.0/4 or 
+        240.0.0.0/4 or 
+        "::1" or 
+        "FE80::/10" or 
+        "FF00::/8")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-attempt-by-root.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-attempt-by-root.asciidoc
index aa9fb1a8d7..3ffb35e651 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-attempt-by-root.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-attempt-by-root.asciidoc
@@ -5,7 +5,7 @@ Identifies an outbound network connection attempt followed by a session id chang
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,44 +13,38 @@ Identifies an outbound network connection attempt followed by a session id chang
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/
 * https://twitter.com/GossiTheDog/status/1522964028284411907
 * https://exatrack.com/public/Tricephalic_Hellkeeper.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Command and Control
-
-*Version*: 100 (<<suspicious-network-connection-attempt-by-root-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 8.3.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-False-Positives (FP) can appear if another remote terminal service is being used to connect to it's listener but typically SSH is used in these scenarios.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 ### Investigating Connection Attempt by Non-SSH Root Session
@@ -62,22 +56,18 @@ Detection alerts from this rule indicate a strange or abnormal outbound connecti
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [network where
-event.type == "start" and event.action == "connection_attempted" and
-user.id == "0" and not process.executable : ("/bin/ssh",
-"/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")] [process
-where event.action == "session_id_change" and user.id == "0" and
-not process.executable : ("/bin/ssh", "/sbin/ssh",
-"/usr/lib/systemd/systemd", "/usr/sbin/sshd")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=1m
+[network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and user.id == "0" and
+    not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd","/usr/bin/ssh","/usr/bin/sshpass")]
+[process where host.os.type == "linux" and event.action == "session_id_change" and user.id == "0" and
+    not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd","/usr/bin/ssh","/usr/bin/sshpass")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -89,8 +79,6 @@ not process.executable : ("/bin/ssh", "/sbin/ssh",
 ** Name: Non-Application Layer Protocol
 ** ID: T1095
 ** Reference URL: https://attack.mitre.org/techniques/T1095/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -99,33 +87,7 @@ not process.executable : ("/bin/ssh", "/sbin/ssh",
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[suspicious-network-connection-attempt-by-root-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [network where
-event.type == "start" and event.action == "connection_attempted" and
-user.id == "0" and not process.executable : ("/bin/ssh",
-"/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")] [process
-where event.action == "session_id_change" and user.id == "0" and
-not process.executable : ("/bin/ssh", "/sbin/ssh",
-"/usr/lib/systemd/systemd", "/usr/sbin/sshd")]
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=1m [network where
-event.type == "start" and event.action == "connection_attempted" and
-user.id == "0" and not process.executable : ("/bin/ssh",
-"/sbin/ssh", "/usr/lib/systemd/systemd")] [process where event.action
-== "session_id_change" and user.id == "0"]
-----------------------------------
-
+* Sub-technique:
+** Name: Sudo and Sudo Caching
+** ID: T1548.003
+** Reference URL: https://attack.mitre.org/techniques/T1548/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-network-tool-launched-inside-a-container.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-network-tool-launched-inside-a-container.asciidoc
new file mode 100644
index 0000000000..e5503226b0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-network-tool-launched-inside-a-container.asciidoc
@@ -0,0 +1,82 @@
+[[suspicious-network-tool-launched-inside-a-container]]
+=== Suspicious Network Tool Launched Inside A Container
+
+This rule detects commonly abused network utilities running inside a container. Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation, and should be monitored closely within a container.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-cloud_defend*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Elastic Defend for Containers
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Tactic: Command and Control
+* Tactic: Reconnaissance
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where container.id: "*" and event.type== "start" and 
+(
+(process.name: ("nc", "ncat", "nmap", "dig", "nslookup", "tcpdump", "tshark", "ngrep", "telnet", "mitmproxy", "socat", "zmap", "masscan", "zgrab")) or 
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
+(process.args: ("nc", "ncat", "nmap", "dig", "nslookup", "tcpdump", "tshark", "ngrep", "telnet", "mitmproxy", "socat", "zmap", "masscan", "zgrab"))
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
index fb544daf6e..142cd6f2a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious child processes of PDF reader applications. These child pr
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,54 +16,50 @@ Identifies suspicious child processes of PDF reader applications. These child pr
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<suspicious-pdf-reader-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious PDF Reader Child Process
 
-PDF is a common file type used in corporate environments and most machines have software to handle these files. This
-creates a vector where attackers can exploit the engines and technology behind this class of software for initial access
-or privilege escalation.
+PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
 
 This rule looks for commonly abused built-in utilities spawned by a PDF reader process, which is likely a malicious behavior.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Retrieve PDF documents received and opened by the user that could cause this behavior. Common locations include, but
-are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Retrieve PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
 - Determine if the collected files are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
     - Observe and collect information about the following activities:
@@ -83,54 +79,43 @@ are not limited to, the Downloads and Document folders and the folder configured
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the triage identified malware, search the environment for additional compromised hosts.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
   - If the malicious file was delivered via phishing:
     - Block the email sender from sending future emails.
     - Block the malicious web pages.
     - Remove emails from the sender from mailboxes.
     - Consider improvements to the security awareness program.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("AcroRd32.exe", "Acrobat.exe",
-"FoxitPhantomPDF.exe", "FoxitReader.exe") and
-process.name : ("arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe",
-"hostname.exe", "ipconfig.exe", "nbtstat.exe",
-"net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe",
-"ping.exe", "qprocess.exe", "quser.exe",
-"qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe",
-"tracert.exe", "whoami.exe", "bginfo.exe",
-"cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe", "ieexec.exe",
-"iexpress.exe", "installutil.exe", "Microsoft.Workflow.Compiler.exe",
-"msbuild.exe", "mshta.exe", "msxsl.exe",
-"odbcconf.exe", "rcsi.exe", "regsvr32.exe", "xwizard.exe",
-"atbroker.exe", "forfiles.exe", "schtasks.exe",
-"regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe",
-"powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe",
-"bitsadmin.exe", "certutil.exe", "ftp.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("AcroRd32.exe",
+                         "Acrobat.exe",
+                         "FoxitPhantomPDF.exe",
+                         "FoxitReader.exe") and
+  process.name : ("arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe", "nbtstat.exe",
+                  "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe",
+                  "quser.exe", "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe",
+                  "whoami.exe", "bginfo.exe", "cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe", "ieexec.exe",
+                  "iexpress.exe", "installutil.exe", "Microsoft.Workflow.Compiler.exe", "msbuild.exe", "mshta.exe",
+                  "msxsl.exe", "odbcconf.exe", "rcsi.exe", "regsvr32.exe", "xwizard.exe", "atbroker.exe",
+                  "forfiles.exe", "schtasks.exe", "regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe",
+                  "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe", "bitsadmin.exe", "certutil.exe", "ftp.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -142,99 +127,3 @@ process.name : ("arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe",
 ** Name: User Execution
 ** ID: T1204
 ** Reference URL: https://attack.mitre.org/techniques/T1204/
-
-[[suspicious-pdf-reader-child-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("AcroRd32.exe",
-"Acrobat.exe", "FoxitPhantomPDF.exe",
-"FoxitReader.exe") and process.name : ("arp.exe", "dsquery.exe",
-"dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe",
-"nbtstat.exe", "net.exe", "net1.exe", "netsh.exe",
-"netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe",
-"quser.exe", "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe",
-"tasklist.exe", "tracert.exe", "whoami.exe",
-"bginfo.exe", "cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe",
-"ieexec.exe", "iexpress.exe", "installutil.exe",
-"Microsoft.Workflow.Compiler.exe", "msbuild.exe", "mshta.exe",
-"msxsl.exe", "odbcconf.exe", "rcsi.exe", "regsvr32.exe",
-"xwizard.exe", "atbroker.exe", "forfiles.exe",
-"schtasks.exe", "regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe",
-"powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe",
-"bitsadmin.exe", "certutil.exe", "ftp.exe")
-----------------------------------
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 7 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:(AcroRd32.exe or Acrobat.exe or
-FoxitPhantomPDF.exe or FoxitReader.exe) and process.name:(arp.exe or
-dsquery.exe or dsget.exe or gpresult.exe or hostname.exe or
-ipconfig.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or
-netstat.exe or nltest.exe or ping.exe or qprocess.exe or quser.exe or
-qwinsta.exe or reg.exe or sc.exe or systeminfo.exe or tasklist.exe or
-tracert.exe or whoami.exe or bginfo.exe or cdb.exe or cmstp.exe or
-csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or
-installutil.exe or Microsoft.Workflow.Compiler.exe or msbuild.exe or
-mshta.exe or msxsl.exe or odbcconf.exe or rcsi.exe or regsvr32.exe or
-xwizard.exe or atbroker.exe or forfiles.exe or schtasks.exe or
-regasm.exe or regsvcs.exe or cmd.exe or cscript.exe or powershell.exe
-or pwsh.exe or wmic.exe or wscript.exe or bitsadmin.exe or
-certutil.exe or ftp.exe)
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:(AcroRd32.exe or Acrobat.exe or
-FoxitPhantomPDF.exe or FoxitReader.exe) and process.name:(arp.exe or
-dsquery.exe or dsget.exe or gpresult.exe or hostname.exe or
-ipconfig.exe or nbtstat.exe or net.exe or net1.exe or netsh.exe or
-netstat.exe or nltest.exe or ping.exe or qprocess.exe or quser.exe or
-qwinsta.exe or reg.exe or sc.exe or systeminfo.exe or tasklist.exe or
-tracert.exe or whoami.exe or bginfo.exe or cdb.exe or cmstp.exe or
-csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or
-installutil.exe or Microsoft.Workflow.Compiler.exe or msbuild.exe or
-mshta.exe or msxsl.exe or odbcconf.exe or rcsi.exe or regsvr32.exe or
-xwizard.exe or atbroker.exe or forfiles.exe or schtasks.exe or
-regasm.exe or regsvcs.exe or cmd.exe or cscript.exe or powershell.exe
-or pwsh.exe or wmic.exe or wscript.exe or bitsadmin.exe or
-certutil.exe or ftp.exe)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
index 28840343c8..753c971de6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
@@ -14,7 +14,7 @@ Detects the presence of a portable executable (PE) in a PowerShell script by loo
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -26,65 +26,58 @@ Detects the presence of a portable executable (PE) in a PowerShell script by loo
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-portable-executable-encoded-in-powershell-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Portable Executable Encoded in Powershell Script
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk,
-bypassing file-based security protections. These executables are generally base64 encoded.
+Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk, bypassing file-based security protections. These executables are generally base64 encoded.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the script using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -104,29 +97,26 @@ prevalence, whether they are located in expected locations, and if they are sign
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - Reimage the host operating system or restore the compromised files to clean versions.
 - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-TVqQAAMAAAAEAAAA )
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    TVqQAAMAAAAEAAAA
+  ) and not user.id : "S-1-5-18"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -138,40 +128,7 @@ TVqQAAMAAAAEAAAA )
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-portable-executable-encoded-in-powershell-script-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-TVqQAAMAAAAEAAAA )
-----------------------------------
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 3 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.code:"4104" and powershell.file.script_block_text : (
-TVqQAAMAAAAEAAAA )
-----------------------------------
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
index d1c3c0c64d..ea80537533 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
@@ -5,65 +5,57 @@ Identifies the PowerShell engine being invoked by unexpected processes. Rather t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
-* winlogbeat-*
-* logs-windows.*
-* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<suspicious-powershell-engine-imageload-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious PowerShell Engine ImageLoad
 
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
-Attackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called
-"PowerShell without PowerShell," works by using the underlying System.Management.Automation namespace and can bypass
-application allowlisting and PowerShell security features.
+Attackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called "PowerShell without PowerShell," works by using the underlying System.Management.Automation namespace and can bypass application allowlisting and PowerShell security features.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 - Retrieve the implementation (DLL, executable, etc.) and determine if it is malicious:
@@ -78,8 +70,7 @@ modifications, and any spawned child processes.
 
 ### False positive analysis
 
-- This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with
-some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.
+- This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.
 
 ### Response and remediation
 
@@ -89,62 +80,50 @@ some products. These benign true positives (B-TPs) can be added as exceptions if
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-
-If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where (event.category : ("library", "driver") or (event.category
-== "process" and event.action : "Image loaded*")) and (dll.name :
-("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll") or file.name :
-("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll")) and /* add false positives
-relevant to your environment here */ not process.executable :
-("C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe",
-"C:\\Windows\\System32\\sdiagnhost.exe") and not process.executable
-regex~ """C:\\Program Files( \(x86\))?\\*\.exe""" and not
-process.name : ( "Altaro.SubAgent.exe", "AppV_Manage.exe",
-"azureadconnect.exe", "CcmExec.exe", "configsyncrun.exe",
-"choco.exe", "ctxappvservice.exe", "DVLS.Console.exe",
-"edgetransport.exe", "exsetup.exe",
-"forefrontactivedirectoryconnector.exe", "InstallUtil.exe",
-"JenkinsOnDesktop.exe",
-"Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe",
-"mmc.exe", "mscorsvw.exe", "msexchangedelivery.exe",
-"msexchangefrontendtransport.exe", "msexchangehmworker.exe",
-"msexchangesubmission.exe", "msiexec.exe", "MsiExec.exe",
-"noderunner.exe", "NServiceBus.Host.exe",
-"NServiceBus.Host32.exe",
-"NServiceBus.Hosting.Azure.HostProcess.exe", "OuiGui.WPF.exe",
-"powershell.exe", "powershell_ise.exe", "pwsh.exe",
-"SCCMCliCtrWPF.exe", "ScriptEditor.exe", "ScriptRunner.exe",
-"sdiagnhost.exe", "servermanager.exe", "setup100.exe",
-"ServiceHub.VSDetouredHost.exe", "SPCAF.Client.exe",
-"SPCAF.SettingsEditor.exe", "SQLPS.exe",
-"telemetryservice.exe", "UMWorkerProcess.exe", "w3wp.exe",
-"wsmprovhost.exe" )
+[source, js]
 ----------------------------------
+library where host.os.type == "windows" and
+  dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll") and
+  not 
+  (
+    /* MS Signed Binaries */
+    (
+      process.code_signature.subject_name : (
+        "Microsoft Windows",
+        "Microsoft Dynamic Code Publisher",
+        "Microsoft Corporation"
+      ) and process.code_signature.trusted == true and not process.name : ("rundll32.exe", "regsvr32.exe")
+    ) or
+
+    /* Signed Executables from the Program Files folder */
+    (
+      process.executable : (
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Program Files\\*.exe"
+      ) and process.code_signature.trusted == true
+    ) or
+
+    /* Lenovo */
+    (
+      process.executable : (
+        "?:\\Windows\\Lenovo\\*.exe"
+      ) and (process.code_signature.subject_name : "Lenovo" and process.code_signature.trusted == true) 
+    )
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -156,152 +135,7 @@ process.name : ( "Altaro.SubAgent.exe", "AppV_Manage.exe",
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-powershell-engine-imageload-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-any where (event.category == "library" or (event.category == "process"
-and event.action : "Image loaded*")) and (dll.name :
-("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll") or file.name :
-("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll")) and /* add false positives
-relevant to your environment here */ not process.executable :
-("C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe",
-"C:\\Windows\\System32\\sdiagnhost.exe") and not process.executable
-regex~ """C:\\Program Files( \(x86\))?\\*\.exe""" and not
-process.name : ( "Altaro.SubAgent.exe", "AppV_Manage.exe",
-"azureadconnect.exe", "CcmExec.exe", "configsyncrun.exe",
-"choco.exe", "ctxappvservice.exe", "DVLS.Console.exe",
-"edgetransport.exe", "exsetup.exe",
-"forefrontactivedirectoryconnector.exe", "InstallUtil.exe",
-"JenkinsOnDesktop.exe",
-"Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe",
-"mmc.exe", "mscorsvw.exe", "msexchangedelivery.exe",
-"msexchangefrontendtransport.exe", "msexchangehmworker.exe",
-"msexchangesubmission.exe", "msiexec.exe", "MsiExec.exe",
-"noderunner.exe", "NServiceBus.Host.exe",
-"NServiceBus.Host32.exe",
-"NServiceBus.Hosting.Azure.HostProcess.exe", "OuiGui.WPF.exe",
-"powershell.exe", "powershell_ise.exe", "pwsh.exe",
-"SCCMCliCtrWPF.exe", "ScriptEditor.exe", "ScriptRunner.exe",
-"sdiagnhost.exe", "servermanager.exe", "setup100.exe",
-"ServiceHub.VSDetouredHost.exe", "SPCAF.Client.exe",
-"SPCAF.SettingsEditor.exe", "SQLPS.exe",
-"telemetryservice.exe", "UMWorkerProcess.exe", "w3wp.exe",
-"wsmprovhost.exe" )
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where dll.name : ("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll") and /* add false positives
-relevant to your environment here */ not process.executable :
-("C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe",
-"C:\\Windows\\System32\\sdiagnhost.exe") and not process.executable
-regex~ """C:\\Program Files( \(x86\))?\\*\.exe""" and not
-process.name : ( "Altaro.SubAgent.exe", "AppV_Manage.exe",
-"azureadconnect.exe", "CcmExec.exe", "configsyncrun.exe",
-"choco.exe", "ctxappvservice.exe", "DVLS.Console.exe",
-"edgetransport.exe", "exsetup.exe",
-"forefrontactivedirectoryconnector.exe", "InstallUtil.exe",
-"JenkinsOnDesktop.exe",
-"Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe",
-"mmc.exe", "mscorsvw.exe", "msexchangedelivery.exe",
-"msexchangefrontendtransport.exe", "msexchangehmworker.exe",
-"msexchangesubmission.exe", "msiexec.exe", "MsiExec.exe",
-"noderunner.exe", "NServiceBus.Host.exe",
-"NServiceBus.Host32.exe",
-"NServiceBus.Hosting.Azure.HostProcess.exe", "OuiGui.WPF.exe",
-"powershell.exe", "powershell_ise.exe", "pwsh.exe",
-"SCCMCliCtrWPF.exe", "ScriptEditor.exe", "ScriptRunner.exe",
-"sdiagnhost.exe", "servermanager.exe", "setup100.exe",
-"ServiceHub.VSDetouredHost.exe", "SPCAF.Client.exe",
-"SPCAF.SettingsEditor.exe", "SQLPS.exe",
-"telemetryservice.exe", "UMWorkerProcess.exe", "w3wp.exe",
-"wsmprovhost.exe" )
-----------------------------------
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where dll.name : ("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll") and /* add false positives
-relevant to your environment here */ not process.executable :
-("C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe",
-"C:\\Windows\\System32\\sdiagnhost.exe", "C:\\Program Files*\\*.exe")
-and not process.name : ( "Altaro.SubAgent.exe",
-"AppV_Manage.exe", "azureadconnect.exe", "CcmExec.exe",
-"configsyncrun.exe", "choco.exe", "ctxappvservice.exe",
-"DVLS.Console.exe", "edgetransport.exe", "exsetup.exe",
-"forefrontactivedirectoryconnector.exe", "InstallUtil.exe",
-"JenkinsOnDesktop.exe",
-"Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe",
-"mmc.exe", "mscorsvw.exe", "msexchangedelivery.exe",
-"msexchangefrontendtransport.exe", "msexchangehmworker.exe",
-"msexchangesubmission.exe", "msiexec.exe", "MsiExec.exe",
-"noderunner.exe", "NServiceBus.Host.exe",
-"NServiceBus.Host32.exe",
-"NServiceBus.Hosting.Azure.HostProcess.exe", "OuiGui.WPF.exe",
-"powershell.exe", "powershell_ise.exe", "pwsh.exe",
-"SCCMCliCtrWPF.exe", "ScriptEditor.exe", "ScriptRunner.exe",
-"sdiagnhost.exe", "servermanager.exe", "setup100.exe",
-"ServiceHub.VSDetouredHost.exe", "SPCAF.Client.exe",
-"SPCAF.SettingsEditor.exe", "SQLPS.exe",
-"telemetryservice.exe", "UMWorkerProcess.exe", "w3wp.exe",
-"wsmprovhost.exe" )
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where file.name : ("System.Management.Automation.ni.dll",
-"System.Management.Automation.dll") and /* add false positives
-relevant to your environment here */ not process.executable :
-("C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe",
-"C:\\Windows\\System32\\sdiagnhost.exe", "C:\\Program Files*\\*.exe")
-and not process.name : ( "Altaro.SubAgent.exe",
-"AppV_Manage.exe", "azureadconnect.exe", "CcmExec.exe",
-"configsyncrun.exe", "choco.exe", "ctxappvservice.exe",
-"DVLS.Console.exe", "edgetransport.exe", "exsetup.exe",
-"forefrontactivedirectoryconnector.exe", "InstallUtil.exe",
-"JenkinsOnDesktop.exe",
-"Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe",
-"mmc.exe", "mscorsvw.exe", "msexchangedelivery.exe",
-"msexchangefrontendtransport.exe", "msexchangehmworker.exe",
-"msexchangesubmission.exe", "msiexec.exe", "MsiExec.exe",
-"noderunner.exe", "NServiceBus.Host.exe",
-"NServiceBus.Host32.exe",
-"NServiceBus.Hosting.Azure.HostProcess.exe", "OuiGui.WPF.exe",
-"powershell.exe", "powershell_ise.exe", "pwsh.exe",
-"SCCMCliCtrWPF.exe", "ScriptEditor.exe", "ScriptRunner.exe",
-"sdiagnhost.exe", "servermanager.exe", "setup100.exe",
-"ServiceHub.VSDetouredHost.exe", "SPCAF.Client.exe",
-"SPCAF.SettingsEditor.exe", "SQLPS.exe", "telemetryservice.exe",
-"UMWorkerProcess.exe", "w3wp.exe", "wsmprovhost.exe" )
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-script.asciidoc
index fcc20de521..3c947c0a62 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-script.asciidoc
@@ -5,49 +5,40 @@ A machine learning job detected a PowerShell script with unusual data characteri
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_script
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 * https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
 
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Execution
+*Tags*: 
 
-*Version*: 101 (<<suspicious-powershell-script-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Execution
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain kinds of security testing may trigger this alert. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,28 +50,7 @@ Certain kinds of security testing may trigger this alert. PowerShell scripts tha
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-powershell-script-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
index 8c88f21186..d9ccb6f0fc 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
@@ -5,68 +5,63 @@ Detects deletion of print driver files by an unusual process. This may indicate
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<suspicious-print-spooler-file-deletion-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uninstall or manual deletion of a legitimate printing driver files. Verify the printer file metadata such as manufacturer and signature information.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type : "deletion" and not process.name :
-("spoolsv.exe", "dllhost.exe", "explorer.exe") and file.path :
-"?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.dll"
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type : "deletion" and
+ not process.name : ("spoolsv.exe", "dllhost.exe", "explorer.exe") and
+ file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.dll"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,19 +73,3 @@ file where event.type : "deletion" and not process.name :
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[suspicious-print-spooler-file-deletion-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc
index 082f5ddbe1..9aad141d7e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc
@@ -5,61 +5,65 @@ Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030)
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability
 * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Privilege%20Escalation/privesc_sysmon_cve_20201030_spooler.evtx
 * https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1030
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<suspicious-print-spooler-point-and-print-dll-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=30s [registry where registry.path :
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory" and
-registry.data.strings :
-"C:\\Windows\\System32\\spool\\drivers\\x64\\4"] [registry where
-registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module"
-and registry.data.strings :
-"C:\\Windows\\System32\\spool\\drivers\\x64\\4\\*"]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=30s
+[registry where host.os.type == "windows" and
+ registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory"
+    ) and
+ registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4"]
+[registry where host.os.type == "windows" and
+ registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module"
+    ) and
+ registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4\\*"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -71,19 +75,3 @@ and registry.data.strings :
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[suspicious-print-spooler-point-and-print-dll-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index 87f311cf91..c0d264a0e9 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -10,12 +10,13 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,72 +28,64 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-print-spooler-spl-file-created-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Print Spooler SPL File Created
 
-Print Spooler is a Windows service enabled by default in all Windows clients and servers. The service manages print jobs
-by loading printer drivers, receiving files to be printed, queuing them, scheduling, etc.
+Print Spooler is a Windows service enabled by default in all Windows clients and servers. The service manages print jobs by loading printer drivers, receiving files to be printed, queuing them, scheduling, etc.
 
-The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like
-CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location
-`?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
+The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
 
-- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination
-of process executable and file conditions.
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process executable and file conditions.
 
 ### Response and remediation
 
@@ -102,35 +95,44 @@ of process executable and file conditions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Ensure that the machine has the latest security updates and is not running legacy Windows versions.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.extension : "spl" and
-file.path : "?:\\Windows\\System32\\spool\\PRINTERS\\*" and not
-process.name : ("spoolsv.exe",
-"printfilterpipelinesvc.exe",
-"PrintIsolationHost.exe", "splwow64.exe",
-"msiexec.exe", "poqexec.exe")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.extension : "spl" and
+  file.path : "?:\\Windows\\System32\\spool\\PRINTERS\\*" and
+  not process.name : ("spoolsv.exe",
+                      "printfilterpipelinesvc.exe",
+                      "PrintIsolationHost.exe",
+                      "splwow64.exe",
+                      "msiexec.exe",
+                      "poqexec.exe") and
+  not user.id : "S-1-5-18" and
+  not process.executable :
+            ("?:\\Windows\\System32\\mmc.exe",
+             "\\Device\\Mup\\*.exe",
+             "?:\\Windows\\System32\\svchost.exe",
+             "?:\\Windows\\System32\\mmc.exe",
+             "?:\\Windows\\System32\\printui.exe",
+             "?:\\Windows\\System32\\mstsc.exe",
+             "?:\\Windows\\System32\\spool\\*.exe",
+             "?:\\Program Files\\*.exe",
+             "?:\\Program Files (x86)\\*.exe",
+             "?:\\PROGRA~1\\*.exe",
+             "?:\\PROGRA~2\\*.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -142,36 +144,3 @@ process.name : ("spoolsv.exe",
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[suspicious-print-spooler-spl-file-created-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Rule name changed from: Suspicious PrintSpooler SPL File Created
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.extension:(spl or SPL) and
-file.path:C\:\\Windows\\System32\\spool\\PRINTERS\\* and not
-process.name:(spoolsv.exe or printfilterpipelinesvc.exe or
-PrintIsolationHost.exe or splwow64.exe or msiexec.exe or poqexec.exe)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
index 0397ffbff9..1aefa6410d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
@@ -5,66 +5,69 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/
 * https://www.thezdi.com/blog/2020/7/8/cve-2020-1300-remote-code-execution-through-microsoft-windows-cab-files
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<suspicious-printspooler-service-executable-file-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and process.name : "spoolsv.exe"
-and file.extension : ("exe", "dll") and not file.path :
-("?:\\Windows\\System32\\spool\\*", "?:\\Windows\\Temp\\*",
-"?:\\Users\\*")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+  process.name : "spoolsv.exe" and file.extension : "dll" and
+  file.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*") and
+  not file.path :
+          ("?:\\WINDOWS\\SysWOW64\\PrintConfig.dll",
+           "?:\\WINDOWS\\system32\\x5lrs.dll",
+           "?:\\WINDOWS\\sysWOW64\\x5lrs.dll",
+           "?:\\WINDOWS\\system32\\PrintConfig.dll")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,33 +79,3 @@ and file.extension : ("exe", "dll") and not file.path :
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[suspicious-printspooler-service-executable-file-creation-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and
-process.name:spoolsv.exe and file.extension:(exe or dll) and not
-file.path:(C\:\\Windows\\System32\\spool\\* or C\:\\Windows\\Temp\\*
-or C\:\\Users\\*)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc
new file mode 100644
index 0000000000..309d46b72a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc
@@ -0,0 +1,89 @@
+[[suspicious-proc-pseudo-file-system-enumeration]]
+=== Suspicious Proc Pseudo File System Enumeration
+
+This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /proc/ -p r -k audit_proc
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type : "linux" and event.category : "file" and event.action : "opened-file" and 
+file.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.parent.pid : 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
index b0241f2f5a..c90240b684 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
@@ -14,7 +14,7 @@ Identifies suspicious process access events from an unknown memory region. Endpo
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,73 +27,64 @@ Identifies suspicious process access events from an unknown memory region. Endpo
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Sysmon Only
-
-*Version*: 102 (<<suspicious-process-access-via-direct-system-call-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 208
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Process Access via Direct System Call
 
-Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is
-malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly.
+Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly.
 
 More context and technical details can be found in this [research blog](https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/).
 
-This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system
-calls to bypass security solutions that rely on hooks.
+This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
 
-- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting
-SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
+- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
 ### Response and remediation
 
@@ -103,49 +94,42 @@ SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessa
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove the malicious certificate from the root certificate store.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.code == "10" and
-length(winlog.event_data.CallTrace) > 0 and /* Sysmon CallTrace
-starting with unknown memory module instead of ntdll which host
-Windows NT Syscalls */ not winlog.event_data.CallTrace :
-("?:\\WINDOWS\\SYSTEM32\\ntdll.dll*",
-"?:\\WINDOWS\\SysWOW64\\ntdll.dll*",
-"?:\\Windows\\System32\\wow64cpu.dll*",
-"?:\\WINDOWS\\System32\\wow64win.dll*",
-"?:\\Windows\\System32\\win32u.dll*") and not
-winlog.event_data.TargetImage : ("?:\\Program Files
-(x86)\\Malwarebytes Anti-Exploit\\mbae-svc.exe",
-"?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe", "?:\\Program
-Files
-(x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
-"?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\*\\AcroCEF.exe") and
-not (process.executable : ("?:\\Program Files\\Adobe\\Acrobat
-DC\\Acrobat\\Acrobat.exe", "?:\\Program
-Files (x86)\\World of Warcraft\\_classic_\\WowClassic.exe") and
-not winlog.event_data.TargetImage :
-"?:\\WINDOWS\\system32\\lsass.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.code == "10" and
+ length(winlog.event_data.CallTrace) > 0 and
+
+ /* Sysmon CallTrace starting with unknown memory module instead of ntdll which host Windows NT Syscalls */
+ not winlog.event_data.CallTrace :
+            ("?:\\WINDOWS\\SYSTEM32\\ntdll.dll*",
+             "?:\\WINDOWS\\SysWOW64\\ntdll.dll*",
+             "?:\\Windows\\System32\\wow64cpu.dll*",
+             "?:\\WINDOWS\\System32\\wow64win.dll*",
+             "?:\\Windows\\System32\\win32u.dll*") and
+
+ not winlog.event_data.TargetImage :
+            ("?:\\Program Files (x86)\\Malwarebytes Anti-Exploit\\mbae-svc.exe",
+             "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe",
+             "?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
+             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\*\\AcroCEF.exe") and
+
+ not (process.executable : ("?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
+                            "?:\\Program Files (x86)\\World of Warcraft\\_classic_\\WowClassic.exe") and
+      not winlog.event_data.TargetImage : "?:\\WINDOWS\\system32\\lsass.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -157,32 +141,3 @@ not winlog.event_data.TargetImage :
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[suspicious-process-access-via-direct-system-call-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.code == "10" and
-length(winlog.event_data.CallTrace) > 0 and /* Sysmon CallTrace
-starting with unknown memory module instead of ntdll which host
-Windows NT Syscalls */ not winlog.event_data.CallTrace :
-("?:\\WINDOWS\\SYSTEM32\\ntdll.dll*",
-"?:\\WINDOWS\\SysWOW64\\ntdll.dll*")
-----------------------------------
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc
index cb49a7cc44..0f824af5a1 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc
@@ -5,7 +5,7 @@ Identifies when a process is created and immediately accessed from an unknown me
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,52 +14,47 @@ Identifies when a process is created and immediately accessed from an unknown me
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Sysmon Only
+*Tags*: 
 
-*Version*: 102 (<<suspicious-process-creation-calltrace-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Sysmon Only
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 207
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Process Creation CallTrace
 
-Attackers may inject code into child processes' memory to hide their actual activity, evade detection mechanisms, and
-decrease discoverability during forensics. This rule looks for a spawned process by Microsoft Office, scripting, and
-command line applications, followed by a process access event for an unknown memory region by the parent process, which
-can indicate a code injection attempt.
+Attackers may inject code into child processes' memory to hide their actual activity, evade detection mechanisms, and decrease discoverability during forensics. This rule looks for a spawned process by Microsoft Office, scripting, and command line applications, followed by a process access event for an unknown memory region by the parent process, which can indicate a code injection attempt.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate abnormal behavior observed by the subject process such as network connections, registry or file
-modifications, and any spawned child processes.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 - Create a memory dump of the child process for analysis.
@@ -73,52 +68,41 @@ modifications, and any spawned child processes.
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan=1m [process where event.code == "1"
-and /* sysmon process creation */ process.parent.name :
-("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe",
-"eqnedt32.exe", "fltldr.exe", "mspub.exe",
-"msaccess.exe","cscript.exe", "wscript.exe", "rundll32.exe",
-"regsvr32.exe", "mshta.exe", "wmic.exe",
-"cmstp.exe", "msxsl.exe") and /* noisy FP patterns */ not
-(process.parent.name : "EXCEL.EXE" and process.executable :
-"?:\\Program Files\\Microsoft Office\\root\\Office*\\ADDINS\\*.exe")
-and not (process.executable : "?:\\Windows\\splwow64.exe" and
-process.args in ("8192", "12288") and process.parent.name :
-("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")) and
-not (process.parent.name : "rundll32.exe" and process.parent.args : ("
-?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfPro
-c", "--no-sandbox")) and not (process.executable :
-("?:\\Program Files
-(x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
-"?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
-"?:\\Windows\\SysWOW64\\DWWIN.EXE") and process.parent.name :
-("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")) and
-not (process.parent.name : "regsvr32.exe" and process.parent.args :
-("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) ] by
-process.parent.entity_id, process.entity_id [process where
-event.code == "10" and /* Sysmon process access event from unknown
-module */ winlog.event_data.CallTrace : "*UNKNOWN*"] by
-process.entity_id, winlog.event_data.TargetProcessGUID
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan=1m
+  [process where host.os.type == "windows" and event.code == "1" and
+   /* sysmon process creation */
+   process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe",
+                          "mspub.exe", "msaccess.exe","cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe",
+                          "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") and
+
+   /* noisy FP patterns */
+   not (process.parent.name : "EXCEL.EXE" and process.executable : "?:\\Program Files\\Microsoft Office\\root\\Office*\\ADDINS\\*.exe") and
+   not (process.executable : "?:\\Windows\\splwow64.exe" and process.args in ("8192", "12288") and process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")) and
+   not (process.parent.name : "rundll32.exe" and process.parent.args : ("?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc", "--no-sandbox")) and
+   not (process.executable :
+            ("?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
+             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
+             "?:\\Windows\\SysWOW64\\DWWIN.EXE") and
+        process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")) and
+   not (process.parent.name : "regsvr32.exe" and process.parent.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*"))
+   ] by process.parent.entity_id, process.entity_id
+  [process where host.os.type == "windows" and event.code == "10" and
+   /* Sysmon process access event from unknown module */
+   winlog.event_data.CallTrace : "*UNKNOWN*"] by process.entity_id, winlog.event_data.TargetProcessGUID
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -130,34 +114,3 @@ process.entity_id, winlog.event_data.TargetProcessGUID
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[suspicious-process-creation-calltrace-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=1m [process where event.code == "1"
-and /* sysmon process creation */ process.parent.name :
-("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe",
-"eqnedt32.exe", "fltldr.exe", "mspub.exe",
-"msaccess.exe", "powershell.exe", "pwsh.exe",
-"cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe",
-"mshta.exe", "wmic.exe", "cmstp.exe",
-"msxsl.exe")] by process.parent.entity_id, process.entity_id
-[process where event.code == "10" and /* Sysmon process access
-event from unknown module */ winlog.event_data.CallTrace :
-"*UNKNOWN*"] by process.entity_id, winlog.event_data.TargetProcessGUID
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
index ae91c5b8d5..440fa46b78 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious psexec activity which is executing from the psexec service
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,51 +16,78 @@ Identifies suspicious psexec activity which is executing from the psexec service
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<suspicious-process-execution-via-renamed-psexec-executable-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating PsExec Network Connection
 
+PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
 
-==== Rule query
+This rule identifies instances where the PsExec service component is executed using a custom name. This behavior can indicate an attempt to bypass security controls or detections that look for the default PsExec service component name.
+
+#### Possible investigation steps
+
+- Check if the usage of this tool complies with the organization's administration policy.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Identify the target computer and its role in the IT environment.
+- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+### False positive analysis
 
+- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
 
-[source,js]
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-process where event.type == "start" and
-process.pe.original_file_name : "psexesvc.exe" and not process.name :
-"PSEXESVC.exe"
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "psexesvc.exe" and not process.name : "PSEXESVC.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,44 +99,7 @@ process.pe.original_file_name : "psexesvc.exe" and not process.name :
 ** Name: System Services
 ** ID: T1569
 ** Reference URL: https://attack.mitre.org/techniques/T1569/
-
-[[suspicious-process-execution-via-renamed-psexec-executable-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.pe.original_file_name : "psexesvc.exe" and not process.name :
-"PSEXESVC.exe"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-(process.pe.original_file_name:(psexesvc.exe or PSEXESVC.exe) or
-winlog.event_data.OriginalFileName:(psexesvc.exe or PSEXESVC.exe)) and
-process.parent.name:services.exe and not process.name:(psexesvc.exe or
-PSEXESVC.exe)
-----------------------------------
-
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
new file mode 100644
index 0000000000..41c07a8b59
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -0,0 +1,131 @@
+[[suspicious-process-spawned-from-motd-detected]]
+=== Suspicious Process Spawned from MOTD Detected
+
+Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and "/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Suspicious Process Spawned from MOTD Detected
+
+The message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.
+
+Attackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Files in these directories will automatically run with root privileges when they are made executable.
+
+This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+#### Possible Investigation Steps
+
+- Investigate the file that was created or modified from which the suspicious process was executed.
+  - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
+- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.
+  - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')"}}
+  - !{osquery{"label":"Osquery - Retrieve Additional File Listing Information","query":"SELECT\n  f.path,\n  u.username AS file_owner,\n  g.groupname AS group_owner,\n  datetime(f.atime, 'unixepoch') AS file_last_access_time,\n  datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\n  datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\n  datetime(f.btime, 'unixepoch') AS file_created_time,\n  f.size AS size_bytes\nFROM\n  file f\n  LEFT JOIN users u ON f.uid = u.uid\n  LEFT JOIN groups g ON f.gid = g.gid\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\n"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+        - Cron jobs, services, and other persistence mechanisms.
+            - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
+
+### Related Rules
+
+- Potential Persistence Through MOTD File Creation Detected - 96d11d31-9a79-480f-8401-da28b194608f
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the MOTD files or restore them to the original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and
+event.type == "start" and event.action : ("exec", "exec_event") and
+process.parent.executable : ("/etc/update-motd.d/*", "/usr/lib/update-notifier/*") and
+process.executable : ("*sh", "python*", "perl", "php*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
index a60b21fbdf..7b01b67df8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
@@ -5,71 +5,76 @@ Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Clien
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<suspicious-rdp-activex-client-loaded-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where (event.category == "library" or (event.category == "process"
-and event.action : "Image loaded*")) and (dll.name : "mstscax.dll" or
-file.name : "mstscax.dll") and /* depending on noise in your env
-add here extra paths */ process.executable : (
-"C:\\Windows\\*", "C:\\Users\\Public\\*",
-"C:\\Users\\Default\\*", "C:\\Intel\\*", "C:\\PerfLogs\\*",
-"C:\\ProgramData\\*", "\\Device\\Mup\\*", "\\\\*" ) and
-/* add here FPs */ not process.executable :
-("C:\\Windows\\System32\\mstsc.exe",
-"C:\\Windows\\SysWOW64\\mstsc.exe")
+[source, js]
 ----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+ (dll.name : "mstscax.dll" or file.name : "mstscax.dll") and
+   /* depending on noise in your env add here extra paths  */
+  process.executable :
+    (
+    "C:\\Windows\\*",
+    "C:\\Users\\Public\\*",
+    "C:\\Users\\Default\\*",
+    "C:\\Intel\\*",
+    "C:\\PerfLogs\\*",
+    "C:\\ProgramData\\*",
+    "\\Device\\Mup\\*",
+    "\\\\*"
+    ) and
+    /* add here FPs */
+  not process.executable : ("C:\\Windows\\System32\\mstsc.exe", "C:\\Windows\\SysWOW64\\mstsc.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,49 +86,3 @@ add here extra paths */ process.executable : (
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[suspicious-rdp-activex-client-loaded-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where dll.name : "mstscax.dll" and /* depending on noise in
-your env add here extra paths */ process.executable : (
-"C:\\Windows\\*", "C:\\Users\\Public\\*",
-"C:\\Users\\Default\\*", "C:\\Intel\\*", "C:\\PerfLogs\\*",
-"C:\\ProgramData\\*", "\\Device\\Mup\\*", "\\\\*" ) and
-/* add here FPs */ not process.executable :
-("C:\\Windows\\System32\\mstsc.exe",
-"C:\\Windows\\SysWOW64\\mstsc.exe")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where file.name == "mstscax.dll" and /* depending on noise
-in your env add here extra paths */ wildcard(process.executable,
-"C:\\Windows\\*",
-"C:\\Users\\Public\\*",
-"C:\\Users\\Default\\*",
-"C:\\Intel\\*", "C:\\PerfLogs\\*",
-"C:\\ProgramData\\*",
-"\\Device\\Mup\\*", "\\\\*") and
-/* add here FPs */ not process.executable in
-("C:\\Windows\\System32\\mstsc.exe",
-"C:\\Windows\\SysWOW64\\mstsc.exe")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc
index 17a83d821a..bad872a5fc 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc
@@ -5,110 +5,98 @@ Identifies remote access to the registry using an account with Backup Operators
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/mpgn/BackupOperatorToDA
 * https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-remote-registry-access-via-sebackupprivilege-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Remote Registry Access via SeBackupPrivilege
 
-SeBackupPrivilege is a privilege that allows file content retrieval, designed to enable users to create backup copies of
-the system. Since it is impossible to make a backup of something you cannot read, this privilege comes at the cost of
-providing the user with full read access to the file system. This privilege must bypass any access control list (ACL) placed in the system.
+SeBackupPrivilege is a privilege that allows file content retrieval, designed to enable users to create backup copies of the system. Since it is impossible to make a backup of something you cannot read, this privilege comes at the cost of providing the user with full read access to the file system. This privilege must bypass any access control list (ACL) placed in the system.
 
-This rule identifies remote access to the registry using an account with Backup Operators group membership. This may
-indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation
-for credential access and privileges elevation.
+This rule identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Investigate the activities done by the subject user the login session. The field `winlog.event_data.SubjectLogonId`
-can be used to get this data.
+- Investigate the activities done by the subject user the login session. The field `winlog.event_data.SubjectLogonId` can be used to get this data.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Contact the account owner and confirm whether they are aware of this activity.
-- Investigate abnormal behaviors observed by the subject user such as network connections, registry or file
-modifications, and processes created.
+- Investigate abnormal behaviors observed by the subject user such as network connections, registry or file modifications, and processes created.
 - Investigate if the registry file was retrieved or exfiltrated.
 
 ### False positive analysis
 
-- If this activity is expected and noisy in your environment, benign true positives (B-TPs) can be added as exceptions
-if necessary.
+- If this activity is expected and noisy in your environment, benign true positives (B-TPs) can be added as exceptions if necessary.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Limit or disable the involved user account to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, winlog.event_data.SubjectLogonId with maxspan=1m
-[iam where event.action == "logged-in-special" and
-winlog.event_data.PrivilegeList : "SeBackupPrivilege" and /*
-excluding accounts with existing privileged access */ not
-winlog.event_data.PrivilegeList : "SeDebugPrivilege"] [any where
-event.action == "Detailed File Share" and
-winlog.event_data.RelativeTargetName : "winreg"]
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name, winlog.event_data.SubjectLogonId with maxspan=1m
+ [iam where event.action == "logged-in-special"  and
+  winlog.event_data.PrivilegeList : "SeBackupPrivilege" and
 
-==== Threat mapping
+  /* excluding accounts with existing privileged access */
+  not winlog.event_data.PrivilegeList : "SeDebugPrivilege"]
+ [any where event.action == "Detailed File Share" and winlog.event_data.RelativeTargetName : "winreg"]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -120,8 +108,10 @@ winlog.event_data.RelativeTargetName : "winreg"]
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -130,28 +120,3 @@ winlog.event_data.RelativeTargetName : "winreg"]
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[suspicious-remote-registry-access-via-sebackupprivilege-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, winlog.event_data.SubjectLogonId with maxspan=1m
-[iam where event.action == "logged-in-special" and
-winlog.event_data.PrivilegeList : "SeBackupPrivilege"] [any where
-event.action == "Detailed File Share" and
-winlog.event_data.RelativeTargetName : "winreg"]
-----------------------------------
-
-Version 2 (8.3.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
new file mode 100644
index 0000000000..85cdbdb071
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
@@ -0,0 +1,66 @@
+[[suspicious-renaming-of-esxi-files]]
+=== Suspicious Renaming of ESXI Files
+
+Identifies instances where VMware-related files, such as those with extensions like ".vmdk", ".vmx", ".vmxf", ".vmsd", ".vmsn", ".vswp", ".vmss", ".nvram", and ".vmem", are renamed on a Linux system. The rule monitors for the "rename" event action associated with these file types, which could indicate malicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action == "rename" and
+file.Ext.original.name : ("*.vmdk", "*.vmx", "*.vmxf", "*.vmsd", "*.vmsn", "*.vswp", "*.vmss", "*.nvram", "*.vmem")
+and not file.name : ("*.vmdk", "*.vmx", "*.vmxf", "*.vmsd", "*.vmsn", "*.vswp", "*.vmss", "*.nvram", "*.vmem")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
new file mode 100644
index 0000000000..dafb45a742
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
@@ -0,0 +1,65 @@
+[[suspicious-renaming-of-esxi-index-html-file]]
+=== Suspicious Renaming of ESXI index.html File
+
+Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action == "rename" and file.name : "index.html" and
+file.Ext.original.path : "/usr/lib/vmware/*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-script-object-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-script-object-execution.asciidoc
index f6dd3cb612..d4af9cc57c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-script-object-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-script-object-execution.asciidoc
@@ -5,7 +5,7 @@ Identifies scrobj.dll loaded into unusual Microsoft processes. This usually mean
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,60 +13,60 @@ Identifies scrobj.dll loaded into unusual Microsoft processes. This usually mean
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<suspicious-script-object-execution-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=2m [process where
-event.type == "start" and (process.code_signature.subject_name in
-("Microsoft Corporation", "Microsoft Windows") and
-process.code_signature.trusted == true) and not
-process.executable : ( "?:\\Windows\\System32\\cscript.exe",
-"?:\\Windows\\SysWOW64\\cscript.exe", "?:\\Program Files
-(x86)\\Internet Explorer\\iexplore.exe", "?:\\Program
-Files\\Internet Explorer\\iexplore.exe", "?:\\Windows\\SystemAp
-ps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe",
-"?:\\Windows\\system32\\msiexec.exe",
-"?:\\Windows\\SysWOW64\\msiexec.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\system32\\taskhostw.exe",
-"?:\\windows\\system32\\inetsrv\\w3wp.exe",
-"?:\\windows\\SysWOW64\\inetsrv\\w3wp.exe",
-"?:\\Windows\\system32\\wscript.exe",
-"?:\\Windows\\SysWOW64\\wscript.exe",
-"?:\\Windows\\system32\\mobsync.exe",
-"?:\\Windows\\SysWOW64\\mobsync.exe",
-"?:\\Windows\\System32\\cmd.exe",
-"?:\\Windows\\SysWOW64\\cmd.exe")] [library where event.type ==
-"start" and dll.name : "scrobj.dll"]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=2m
+  [process where host.os.type == "windows" and event.type == "start"
+   and (process.code_signature.subject_name in ("Microsoft Corporation", "Microsoft Windows") and
+   process.code_signature.trusted == true) and
+     not process.executable : (
+       "?:\\Windows\\System32\\cscript.exe",
+       "?:\\Windows\\SysWOW64\\cscript.exe",
+       "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
+       "?:\\Program Files\\Internet Explorer\\iexplore.exe",
+       "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe",
+       "?:\\Windows\\system32\\msiexec.exe",
+       "?:\\Windows\\SysWOW64\\msiexec.exe",
+       "?:\\Windows\\System32\\smartscreen.exe",
+       "?:\\Windows\\system32\\taskhostw.exe",
+       "?:\\windows\\system32\\inetsrv\\w3wp.exe",
+       "?:\\windows\\SysWOW64\\inetsrv\\w3wp.exe",
+       "?:\\Windows\\system32\\wscript.exe",
+       "?:\\Windows\\SysWOW64\\wscript.exe",
+       "?:\\Windows\\system32\\mobsync.exe",
+       "?:\\Windows\\SysWOW64\\mobsync.exe",
+       "?:\\Windows\\System32\\cmd.exe",
+       "?:\\Windows\\SysWOW64\\cmd.exe")]
+  [library where host.os.type == "windows" and event.type == "start" and dll.name : "scrobj.dll"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,79 +78,3 @@ ps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe",
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[suspicious-script-object-execution-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=2m [process where
-event.type == "start" and (process.code_signature.subject_name in
-("Microsoft Corporation", "Microsoft Windows") and
-process.code_signature.trusted == true) and not
-process.executable : ( "?:\\Windows\\System32\\cscript.exe",
-"?:\\Windows\\SysWOW64\\cscript.exe", "?:\\Program Files
-(x86)\\Internet Explorer\\iexplore.exe", "?:\\Program
-Files\\Internet Explorer\\iexplore.exe", "?:\\Windows\\SystemAp
-ps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe",
-"?:\\Windows\\system32\\msiexec.exe",
-"?:\\Windows\\SysWOW64\\msiexec.exe",
-"?:\\Windows\\System32\\smartscreen.exe",
-"?:\\Windows\\system32\\taskhostw.exe",
-"?:\\windows\\system32\\inetsrv\\w3wp.exe",
-"?:\\windows\\SysWOW64\\inetsrv\\w3wp.exe",
-"?:\\Windows\\system32\\wscript.exe",
-"?:\\Windows\\SysWOW64\\wscript.exe",
-"?:\\Windows\\system32\\mobsync.exe",
-"?:\\Windows\\SysWOW64\\mobsync.exe",
-"?:\\Windows\\System32\\cmd.exe",
-"?:\\Windows\\SysWOW64\\cmd.exe")] [library where event.type ==
-"start" and dll.name : "scrobj.dll"]
-----------------------------------
-
-Version 4 (7.13.0 release)::
-* Rule name changed from: Windows Suspicious Script Object Execution
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* add winlogbeat-* when process.code_signature.* fields are populated
-*/ sequence by process.entity_id with maxspan = 2m [process where
-event.type in ("start", "process_started") and /* uncomment once
-in winlogbeat */ /* process.code_signature.subject_name :
-"Microsoft Corporation" and process.code_signature.trusted : true and
-*/ not process.name : ( "cscript.exe",
-"iexplore.exe", "MicrosoftEdge.exe", "msiexec.exe",
-"smartscreen.exe", "taskhostw.exe", "w3wp.exe",
-"wscript.exe")] [library where event.type == "start" and dll.name :
-"scrobj.dll"]
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-/* add winlogbeat-* when process.code_signature.* fields are populated
-*/ sequence by process.entity_id with maxspan=2m [process where
-event.type in ("start", "process_started") and /* uncomment once
-in winlogbeat */ /* process.code_signature.subject_name ==
-"Microsoft Corporation" and process.code_signature.trusted == true and
-*/ not (process.name : "cscript.exe" or process.name :
-"iexplore.exe" or process.name : "MicrosoftEdge.exe" or
-process.name : "msiexec.exe" or process.name :
-"smartscreen.exe" or process.name : "taskhostw.exe" or
-process.name : "w3wp.exe" or process.name : "wscript.exe")]
-[library where event.type == "start" and file.name : "scrobj.dll"]
-----------------------------------
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
index 32c723563c..d645a88536 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -1,5 +1,5 @@
 [[suspicious-service-was-installed-in-the-system]]
-=== Suspicious service was installed in the system
+=== Suspicious Service was Installed in the System
 
 Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.
 
@@ -9,46 +9,63 @@ Identifies the creation of a new Windows service with suspicious Service command
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
+*References*: None
+
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 7
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
+### Investigating Suspicious Service was Installed in the System
+
+Attackers may create new services to execute system shells and other command execution utilities to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these utilities with persistence payloads.
+
+This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Identify how the service was created or modified. Look for registry changes events or Windows events related to
-service activities (for example, 4697 and/or 7045).
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).
+  - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.
+    - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+    - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+    - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+    - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+    - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+  - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -57,41 +74,42 @@ service activities (for example, 4697 and/or 7045).
 
 ### False positive analysis
 
-- Certain services such as PSEXECSVC may happen legitimately. The security team should address any potential benign true
-positive (B-TP) by excluding the relevant FP by pattern.
+- Certain services such as PSEXECSVC may happen legitimately. The security team should address any potential benign true positive (B-TP) by excluding the relevant FP by pattern.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Delete the service or restore it to the original configuration.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the service.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where (event.code : "4697" and
-(winlog.event_data.ServiceFileName : ("*COMSPEC*", "*\\172.0.0.1*",
-"*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
-"*echo*", "*RemComSvc*") or winlog.event_data.ServiceFileName
-regex~ """%systemroot%\\[a-z0-9]+\.exe""")) or (event.code : "7045"
-and winlog.event_data.ImagePath : ("*COMSPEC*", "*\\172.0.0.1*",
-"*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
-"*echo*", "*RemComSvc*"))
+[source, js]
 ----------------------------------
+any where
+  (event.code : "4697" and
+   (winlog.event_data.ServiceFileName :
+           ("*COMSPEC*", "*\\172.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
+            "*echo*", "*RemComSvc*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
+            "*\\Users\\*", "*\\Windows\\Temp\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
+            "*regsvr32*", "*msbuild*") or
+   winlog.event_data.ServiceFileName regex~ """%systemroot%\\[a-z0-9]+\.exe""")) or
+
+  (event.code : "7045" and
+   winlog.event_data.ImagePath : (
+       "*COMSPEC*", "*\\172.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
+       "*echo*", "*RemComSvc*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
+       "*\\Users\\*", "*\\Windows\\Temp\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
+       "*regsvr32*", "*msbuild*"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -103,3 +121,7 @@ and winlog.event_data.ImagePath : ("*COMSPEC*", "*\\172.0.0.1*",
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
index 72915648db..266806fdee 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
@@ -5,7 +5,7 @@ A suspicious SolarWinds child process was detected, which may indicate an attemp
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,70 +16,63 @@ A suspicious SolarWinds child process was detected, which may indicate an attemp
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
 * https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20CHILD%20PROCESSES%20(METHODOLOGY).ioc
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
-
-*Version*: 102 (<<suspicious-solarwinds-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Trusted SolarWinds child processes, verify process details such as network connections and file writes.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name:
-("SolarWinds.BusinessLayerHost.exe",
-"SolarWinds.BusinessLayerHostx64.exe") and not process.name : (
-"APMServiceControl*.exe", "ExportToPDFCmd*.Exe",
-"SolarWinds.Credentials.Orion.WebApi*.exe",
-"SolarWinds.Orion.Topology.Calculator*.exe", "Database-
-Maint.exe", "SolarWinds.Orion.ApiPoller.Service.exe",
-"WerFault.exe", "WerMgr.exe",
-"SolarWinds.BusinessLayerHost.exe",
-"SolarWinds.BusinessLayerHostx64.exe") and not process.executable :
-("?:\\Windows\\SysWOW64\\ARP.EXE",
-"?:\\Windows\\SysWOW64\\lodctr.exe",
-"?:\\Windows\\SysWOW64\\unlodctr.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name: ("SolarWinds.BusinessLayerHost.exe", "SolarWinds.BusinessLayerHostx64.exe") and
+ not process.name : (
+        "APMServiceControl*.exe",
+        "ExportToPDFCmd*.Exe",
+        "SolarWinds.Credentials.Orion.WebApi*.exe",
+        "SolarWinds.Orion.Topology.Calculator*.exe",
+        "Database-Maint.exe",
+        "SolarWinds.Orion.ApiPoller.Service.exe",
+        "WerFault.exe",
+        "WerMgr.exe",
+        "SolarWinds.BusinessLayerHost.exe",
+        "SolarWinds.BusinessLayerHostx64.exe") and
+ not process.executable : ("?:\\Windows\\SysWOW64\\ARP.EXE", "?:\\Windows\\SysWOW64\\lodctr.exe", "?:\\Windows\\SysWOW64\\unlodctr.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -91,8 +84,6 @@ Maint.exe", "SolarWinds.Orion.ApiPoller.Service.exe",
 ** Name: Native API
 ** ID: T1106
 ** Reference URL: https://attack.mitre.org/techniques/T1106/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -101,40 +92,7 @@ Maint.exe", "SolarWinds.Orion.ApiPoller.Service.exe",
 ** Name: Supply Chain Compromise
 ** ID: T1195
 ** Reference URL: https://attack.mitre.org/techniques/T1195/
-
-[[suspicious-solarwinds-child-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name: ("SolarWinds.BusinessLayerHost.exe",
-"SolarWinds.BusinessLayerHostx64.exe") and not process.name : (
-"APMServiceControl*.exe", "ExportToPDFCmd*.Exe",
-"SolarWinds.Credentials.Orion.WebApi*.exe",
-"SolarWinds.Orion.Topology.Calculator*.exe", "Database-
-Maint.exe", "SolarWinds.Orion.ApiPoller.Service.exe",
-"WerFault.exe", "WerMgr.exe")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index 51221df814..485b94f6da 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -8,83 +8,76 @@ Identifies suspicious startup shell folder modifications to change the default S
 *Rule indices*:
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<suspicious-startup-shell-folder-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.13.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Suspicious Startup Shell Folder Modification
 
-Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for
-persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this
-behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for
-an attacker.
+Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Review the source process and related file tied to the Windows Registry entry.
-- Validate the activity is not related to planned patches, updates, network administrator activity or legitimate software
-installations.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the file using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
-- There is a high possibility of benign legitimate programs being added to shell folders. This activity could be based
-on new software installations, patches, or other network administrator activity. Before undertaking further investigation,
-it should be verified that this activity is not benign.
+- There is a high possibility of benign legitimate programs being added to shell folders. This activity could be based on new software installations, patches, or other network administrator activity. Before undertaking further investigation, it should be verified that this activity is not benign.
 
 ### Related rules
 
@@ -101,37 +94,37 @@ it should be verified that this activity is not benign.
   - Block the malicious web pages.
   - Remove emails from the sender from mailboxes.
   - Consider improvements to the security awareness program.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path : (
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User
-Shell Folders\\Common Startup",
-"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell
-Folders\\Common Startup", "HKEY_USERS\\*\\Software\\Microsoft\\Wi
-ndows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup", "H
-KEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\
-Shell Folders\\Startup" ) and registry.data.strings != null and
-/* Normal Startup Folder Paths */ not registry.data.strings : (
-"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
-"%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
-"%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup",
-"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start
-Menu\\Programs\\Startup" )
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+ registry.path : (
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup"
+     ) and
+  registry.data.strings != null and
+  /* Normal Startup Folder Paths */
+  not registry.data.strings : (
+           "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
+           )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -143,28 +136,7 @@ Menu\\Programs\\Startup" )
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-[[suspicious-startup-shell-folder-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc
new file mode 100644
index 0000000000..589ab7e8e8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc
@@ -0,0 +1,87 @@
+[[suspicious-sysctl-file-event]]
+=== Suspicious Sysctl File Event
+
+Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+
+```
+-w /etc/sysctl.conf -p wa -k sysctl
+-w /etc/sysctl.d -p wa -k sysctl
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action in ("opened-file", "read-file", "wrote-to-file") and
+file.path : ("/etc/sysctl.conf", "/etc/sysctl.d", "/etc/sysctl.d/*") and not process.name == "auditbeat"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc
new file mode 100644
index 0000000000..7b7ffb231f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc
@@ -0,0 +1,76 @@
+[[suspicious-system-commands-executed-by-previously-unknown-executable]]
+=== Suspicious System Commands Executed by Previously Unknown Executable
+
+This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type : "linux" and event.category : "process" and 
+event.action : ("exec" or "exec_event" or "fork" or "fork_event") and 
+process.executable : (
+  /bin/* or /usr/bin/* or /usr/share/* or /tmp/* or /var/tmp/* or /dev/shm/* or
+  /etc/init.d/* or /etc/rc*.d/* or /etc/crontab or /etc/cron.*/* or /etc/update-motd.d/* or 
+  /usr/lib/update-notifier/* or /home/*/.* or /boot/* or /srv/* or /run/*
+  ) and process.args : (
+  "whoami" or "id" or "hostname" or "uptime" or "top" or "ifconfig" or "netstat" or "route" or 
+  "ps" or "pwd" or "ls"
+  ) and not process.name : (
+  "sudo" or "which" or "whoami" or "id" or "hostname" or "uptime" or "top" or "netstat" or "ps" or 
+  "pwd" or "ls" or "apt" or "dpkg" or "yum" or "rpm" or "dnf" or "dockerd" or "snapd" or "snap"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc
new file mode 100644
index 0000000000..9e63ff7324
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc
@@ -0,0 +1,61 @@
+[[suspicious-termination-of-esxi-process]]
+=== Suspicious Termination of ESXI Process
+
+Identifies instances where VMware processes, such as "vmware-vmx" or "vmx," are terminated on a Linux system by a "kill" command. The rule monitors for the "end" event type, which signifies the termination of a process. The presence of a "kill" command as the parent process for terminating VMware processes may indicate that a threat actor is attempting to interfere with the virtualized environment on the targeted system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Impact
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "end" and process.name : ("vmware-vmx", "vmx")
+and process.parent.name : "kill"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Service Stop
+** ID: T1489
+** Reference URL: https://attack.mitre.org/techniques/T1489/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
index 7bff68bc6e..e6af011e5d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
@@ -1,11 +1,11 @@
 [[suspicious-werfault-child-process]]
 === Suspicious WerFault Child Process
 
-A suspicious WerFault child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and parent process details as well.
+A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,66 +16,59 @@ A suspicious WerFault child process was detected, which may indicate an attempt
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/
+* https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/
 * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx
 * https://blog.menasec.net/2021/01/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<suspicious-werfault-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Custom Windows error reporting debugger or applications restarted by WerFault after a crash.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"WerFault.exe" and not process.name : ("cofire.exe",
-"psr.exe", "VsJITDebugger.exe",
-"TTTracer.exe", "rundll32.exe",
-"LogiOptionsMgr.exe") and not process.args : ("/LOADSAVEDWINDOWS",
-"/restore", "RestartByRestartManager*",
-"--restarted", "createdump",
-"dontsend", "/watson")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+
+  process.parent.name : "WerFault.exe" and 
+  
+  /* args -s and -t used to execute a process via SilentProcessExit mechanism */
+  (process.parent.args : "-s" and process.parent.args : "-t" and process.parent.args : "-c") and 
+  
+  not process.executable : ("?:\\Windows\\SysWOW64\\Initcrypt.exe", "?:\\Program Files (x86)\\Heimdal\\Heimdal.Guard.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -87,48 +80,3 @@ process where event.type == "start" and process.parent.name :
 ** Name: Masquerading
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[suspicious-werfault-child-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "WerFault.exe" and not process.name :
-("cofire.exe", "psr.exe",
-"VsJITDebugger.exe", "TTTracer.exe",
-"rundll32.exe", "LogiOptionsMgr.exe") and not
-process.args : ("/LOADSAVEDWINDOWS", "/restore",
-"RestartByRestartManager*", "--restarted",
-"createdump", "dontsend",
-"/watson")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:WerFault.exe and not process.name:(cofire.exe or
-psr.exe or VsJITDebugger.exe or TTTracer.exe or rundll32.exe)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
index 9d7f1f900c..d68b4f6195 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
@@ -5,7 +5,7 @@ Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processe
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,57 +16,52 @@ Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processe
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
-
-*Version*: 101 (<<suspicious-wmi-image-load-from-ms-office-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-any where (event.category : ("library", "driver") or (event.category
-== "process" and event.action : "Image loaded*")) and process.name :
-("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE",
-"MSACCESS.EXE") and (dll.name : "wmiutils.dll" or file.name :
-"wmiutils.dll")
+[source, js]
 ----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+  process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  (dll.name : "wmiutils.dll" or file.name : "wmiutils.dll")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,53 +73,3 @@ any where (event.category : ("library", "driver") or (event.category
 ** Name: Windows Management Instrumentation
 ** ID: T1047
 ** Reference URL: https://attack.mitre.org/techniques/T1047/
-
-[[suspicious-wmi-image-load-from-ms-office-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-any where (event.category == "library" or (event.category ==
-"process" and event.action : "Image loaded*")) and process.name :
-("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE",
-"MSACCESS.EXE") and (dll.name : "wmiutils.dll" or file.name :
-"wmiutils.dll")
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where process.name : ("WINWORD.EXE", "EXCEL.EXE",
-"POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and event.action :
-"load" and event.category : "library" and dll.name :
-"wmiutils.dll"
-----------------------------------
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where process.name in ("WINWORD.EXE", "EXCEL.EXE",
-"POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and event.action ==
-"load" and event.category == "library" and file.name ==
-"wmiutils.dll"
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-wmic-xsl-script-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-wmic-xsl-script-execution.asciidoc
index 8c5c245286..e09f3551c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-wmic-xsl-script-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-wmic-xsl-script-execution.asciidoc
@@ -5,7 +5,7 @@ Identifies WMIC allowlist bypass techniques by alerting on suspicious execution
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,46 +15,44 @@ Identifies WMIC allowlist bypass techniques by alerting on suspicious execution
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 101 (<<suspicious-wmic-xsl-script-execution-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan = 2m [process where
-event.type == "start" and (process.name : "WMIC.exe" or
-process.pe.original_file_name : "wmic.exe") and process.args :
-("format*:*", "/format*:*", "*-format*:*") and not
-process.command_line : "* /format:table *"] [any where (event.category
-== "library" or (event.category == "process" and event.action : "Image
-loaded*")) and (dll.name : ("jscript.dll", "vbscript.dll") or
-file.name : ("jscript.dll", "vbscript.dll"))]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan = 2m
+[process where host.os.type == "windows" and event.type == "start" and
+   (process.name : "WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
+   process.args : ("format*:*", "/format*:*", "*-format*:*") and
+   not process.command_line : "* /format:table *"]
+[any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+ (dll.name : ("jscript.dll", "vbscript.dll") or file.name : ("jscript.dll", "vbscript.dll"))]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,52 +64,3 @@ file.name : ("jscript.dll", "vbscript.dll"))]
 ** Name: XSL Script Processing
 ** ID: T1220
 ** Reference URL: https://attack.mitre.org/techniques/T1220/
-
-[[suspicious-wmic-xsl-script-execution-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan = 2m [process where
-event.type in ("start", "process_started") and (process.name :
-"WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
-process.args : ("format*:*", "/format*:*", "*-format*:*") and not
-process.command_line : "* /format:table *"] [any where (event.category
-== "library" or (event.category == "process" and event.action : "Image
-loaded*")) and (dll.name : ("jscript.dll", "vbscript.dll") or
-file.name : ("jscript.dll", "vbscript.dll"))]
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan = 2m [process where
-event.type in ("start", "process_started") and (process.name :
-"WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
-process.args : ("format*:*", "/format*:*", "*-format*:*") and not
-process.command_line : "* /format:table *"] [library where event.type
-== "start" and dll.name : ("jscript.dll", "vbscript.dll")]
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=2m [process where
-event.type in ("start", "process_started") and (process.name :
-"WMIC.exe" or process.pe.original_file_name == "wmic.exe") and
-wildcard(process.args, "format*:*", "/format*:*", "*-format*:*") and
-not wildcard(process.command_line, "* /format:table *")] [library
-where event.type == "start" and file.name in ("jscript.dll",
-"vbscript.dll")]
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index 32f5f65049..4a10b61623 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -16,122 +16,111 @@ A suspicious Zoom child process was detected, which may indicate an attempt to r
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<suspicious-zoom-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Investigation guide
 
+==== Investigation guide
 
-[source,markdown]
-----------------------------------
 
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
+### Investigating Suspicious Zoom Child Process
 
-==== Rule query
+By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading, and deserve further investigation.
 
+This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"Zoom.exe" and process.name : ("cmd.exe", "powershell.exe",
-"pwsh.exe", "powershell_ise.exe")
-----------------------------------
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
-==== Threat mapping
+#### Possible investigation steps
 
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Masquerading
-** ID: T1036
-** Reference URL: https://attack.mitre.org/techniques/T1036/
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the command line of the child process to determine which commands or scripts were executed.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-[[suspicious-zoom-child-process-history]]
-==== Rule version history
 
-Version 102 (8.6.0 release)::
-* Formatting only
+### False positive analysis
 
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.parent.name : "Zoom.exe" and process.name : ("cmd.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe")
-----------------------------------
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-Version 8 (8.4.0 release)::
-* Formatting only
+### Response and remediation
 
-Version 6 (8.2.0 release)::
-* Formatting only
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-Version 5 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.parent.name : "Zoom.exe" and process.name : ("cmd.exe",
-"powershell.exe", "pwsh.exe")
 ----------------------------------
 
-Version 4 (7.12.0 release)::
-* Formatting only
+==== Rule query
 
-Version 3 (7.11.2 release)::
-* Formatting only
 
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:Zoom.exe and not process.name:(Zoom.exe or
-WerFault.exe or airhost.exe or CptControl.exe or CptHost.exe or
-cpthost.exe or CptInstall.exe or CptService.exe or Installer.exe or
-zCrashReport.exe or Zoom_launcher.exe or zTscoder.exe or
-plugin_Launcher.exe or mDNSResponder.exe or zDevHelper.exe or
-APcptControl.exe or CrashSender*.exe or aomhost64.exe or Magnify.exe
-or m_plugin_launcher.exe or com.zoom.us.zTranscode.exe or
-RoomConnector.exe or tabtip.exe or Explorer.exe or chrome.exe or
-firefox.exe or iexplore.exe or outlook.exe or lync.exe or
-ApplicationFrameHost.exe or ZoomAirhostInstaller.exe or narrator.exe
-or NVDA.exe or Magnify.exe or Outlook.exe or m_plugin_launcher.exe or
-mphost.exe or APcptControl.exe or winword.exe or excel.exe or
-powerpnt.exe or ONENOTE.EXE or wpp.exe or debug_message.exe or
-zAssistant.exe or msiexec.exe or msedge.exe or dwm.exe or
-vcredist_x86.exe or Controller.exe or Installer.exe or CptInstall.exe
-or Zoom_launcher.exe or ShellExperienceHost.exe or wps.exe)
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "Zoom.exe" and process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe")
+
 ----------------------------------
 
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index 512b34c76c..49be16e1f8 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -16,7 +16,7 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -28,67 +28,57 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<svchost-spawning-cmd-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Svchost spawning Cmd
 
-The Service Host process (SvcHost) is a system process that can host one, or multiple, Windows services in the Windows
-NT family of operating systems. Note that `Svchost.exe` is reserved for use by the operating system and should not be
-used by non-Windows services.
+The Service Host process (SvcHost) is a system process that can host one, or multiple, Windows services in the Windows NT family of operating systems. Note that `Svchost.exe` is reserved for use by the operating system and should not be used by non-Windows services.
 
-This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual
-behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege
-escalation.
+This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
@@ -103,40 +93,41 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"svchost.exe" and process.name : "cmd.exe" and not process.args :
-("??:\\Program Files\\Npcap\\CheckStatus.bat?", "?:\\Program
-Files\\Npcap\\CheckStatus.bat", "\\system32\\cleanmgr.exe",
-"?:\\Windows\\system32\\silcollector.cmd",
-"\\system32\\AppHostRegistrationVerifier.exe",
-"\\system32\\ServerManagerLauncher.exe", "dir",
-"?:\\Program Files\\*", "?:\\Program Files (x86)\\*",
-"?:\\Windows\\LSDeployment\\Lspush.exe",
-"(x86)\\FMAuditOnsite\\watchdog.bat",
-"?:\\ProgramData\\chocolatey\\bin\\choco-upgrade-all.bat",
-"Files\\Npcap\\CheckStatus.bat") and /* very noisy pattern - bat
-or cmd script executed via scheduled tasks */ not
-(process.parent.args : "netsvcs" and process.args : ("?:\\*.bat",
-"?:\\*.cmd"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+
+  process.parent.name : "svchost.exe" and process.name : "cmd.exe" and
+
+  not process.args :
+         ("??:\\Program Files\\Npcap\\CheckStatus.bat?",
+          "?:\\Program Files\\Npcap\\CheckStatus.bat",
+          "\\system32\\cleanmgr.exe",
+          "?:\\Windows\\system32\\silcollector.cmd",
+          "\\system32\\AppHostRegistrationVerifier.exe",
+          "\\system32\\ServerManagerLauncher.exe",
+          "dir",
+          "?:\\Program Files\\*",
+          "?:\\Program Files (x86)\\*",
+          "?:\\Windows\\LSDeployment\\Lspush.exe",
+          "(x86)\\FMAuditOnsite\\watchdog.bat",
+          "?:\\ProgramData\\chocolatey\\bin\\choco-upgrade-all.bat",
+          "Files\\Npcap\\CheckStatus.bat") and
+
+   /* very noisy pattern - bat or cmd script executed via scheduled tasks */
+  not (process.parent.args : "netsvcs" and process.args : ("?:\\*.bat", "?:\\*.cmd"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -148,86 +139,3 @@ or cmd script executed via scheduled tasks */ not
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[svchost-spawning-cmd-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"svchost.exe" and process.name : "cmd.exe" and not
-(process.pe.original_file_name : "cmd.exe" and process.args : (
-"??:\\Program Files\\Npcap\\CheckStatus.bat?", "?:\\Program
-Files\\Npcap\\CheckStatus.bat", "\\system32\\cleanmgr.exe",
-"?:\\Windows\\system32\\silcollector.cmd",
-"\\system32\\AppHostRegistrationVerifier.exe",
-"\\system32\\ServerManagerLauncher.exe"))
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"svchost.exe" and process.name : "cmd.exe" and not
-(process.pe.original_file_name : "cmd.exe" and process.args : (
-"??:\\Program Files\\Npcap\\CheckStatus.bat?", "?:\\Program
-Files\\Npcap\\CheckStatus.bat", "\\system32\\cleanmgr.exe",
-"?:\\Windows\\system32\\silcollector.cmd",
-"\\system32\\AppHostRegistrationVerifier.exe",
-"\\system32\\ServerManagerLauncher.exe"))
-----------------------------------
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "svchost.exe" and process.name : "cmd.exe" and
-not (process.pe.original_file_name == "Cmd.Exe" and process.args :
-"?:\\Program Files\\Npcap\\CheckStatus.bat??")
-----------------------------------
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:svchost.exe and process.name:cmd.exe
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.parent.name:svchost.exe and process.name:cmd.exe
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
index bd9aa1002f..e9908fb0af 100644
--- a/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation of symbolic links to a shadow copy. Symbolic links can b
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,62 +16,53 @@ Identifies the creation of symbolic links to a shadow copy. Symbolic links can b
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink
 * https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 * https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/
 * https://www.hackingarticles.in/credential-dumping-ntds-dit/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<symbolic-link-to-shadow-copy-created-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 8.0.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate administrative activity related to shadow copies.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Symbolic Link to Shadow Copy Created
 
-Shadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt
-to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active
-Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is
-needed to extract these hashes and potentially conduct lateral movement.
+Shadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is needed to extract these hashes and potentially conduct lateral movement.
 
 #### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Determine if a volume shadow copy was recently created on this endpoint.
 - Review privileges of the end user as this requires administrative access.
@@ -91,19 +82,14 @@ for prevalence, whether they are located in expected locations, and if they are
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - If the entire domain or the `krbtgt` user was compromised:
-  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited
-  to, a password reset (twice) of the `krbtgt` user.
+  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.
 - Locate and remove static files copied from volume shadow copies.
 - Command-Line tool mklink should require administrative access by default unless in developer mode.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 Ensure advanced audit policies for Windows are enabled, specifically:
 Object Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested)
@@ -126,20 +112,18 @@ Direct access to a shell and calling symbolic link creation tools will not gener
 If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start","process_created") and
-process.pe.original_file_name in ("Cmd.Exe","PowerShell.EXE") and /*
-Create Symbolic Link to Shadow Copies */ process.args : ("*mklink*",
-"*SymbolicLink*") and process.command_line :
-("*HarddiskVolumeShadowCopy*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.pe.original_file_name in ("Cmd.Exe","PowerShell.EXE") and
+
+ /* Create Symbolic Link to Shadow Copies */
+ process.args : ("*mklink*", "*SymbolicLink*") and process.command_line : ("*HarddiskVolumeShadowCopy*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -151,42 +135,3 @@ Create Symbolic Link to Shadow Copies */ process.args : ("*mklink*",
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-[[symbolic-link-to-shadow-copy-created-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start","process_created") and
-process.pe.original_file_name in ("Cmd.Exe","PowerShell.EXE") and
-/* Create Symbolic Link to Shadow Copies */ process.args :
-("*mklink*", "*SymbolicLink*") and process.command_line :
-("*HarddiskVolumeShadowCopy*")
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.pe.original_file_name == "Cmd.Exe" and process.args :
-"*mklink*" and process.args :
-"*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*"
-----------------------------------
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/system-hosts-file-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-hosts-file-access.asciidoc
new file mode 100644
index 0000000000..a296653f4f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-hosts-file-access.asciidoc
@@ -0,0 +1,61 @@
+[[system-hosts-file-access]]
+=== System Hosts File Access
+
+Identifies the use of built-in tools to read the contents of \etc\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type == "start" and event.action == "exec" and
+    (process.name:("vi", "nano", "cat", "more", "less") and process.args : "/etc/hosts")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc
index 83c1564490..dacb5bf37a 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc
@@ -1,11 +1,11 @@
 [[system-information-discovery-via-windows-command-shell]]
 === System Information Discovery via Windows Command Shell
 
-Identifies the execution of discovery commands to enumerate system info or files and folders using the Windows Command Shell.
+Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows Command Shell.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -15,48 +15,75 @@ Identifies the execution of discovery commands to enumerate system info or files
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Execution
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Tactic: Execution
+* Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 5
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating System Information Discovery via Windows Command Shell
 
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-==== Rule query
+This rule identifies commands to enumerate system information, files, and folders using the Windows Command Shell.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+
+### False positive analysis
 
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-[source,js]
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-process where event.type == "start" and process.name : "cmd.exe" and
-process.args : "/c" and process.args : ("set", "dir")
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "cmd.exe" and process.args : "/c" and process.args : ("set", "dir") and
+  not process.parent.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\PROGRA~1\\*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,8 +95,10 @@ process.args : "/c" and process.args : ("set", "dir")
 ** Name: System Information Discovery
 ** ID: T1082
 ** Reference URL: https://attack.mitre.org/techniques/T1082/
-
-
+* Technique:
+** Name: File and Directory Discovery
+** ID: T1083
+** Reference URL: https://attack.mitre.org/techniques/T1083/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -78,3 +107,7 @@ process.args : "/c" and process.args : ("set", "dir")
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
index 8cd5d19e0f..f82ededa4d 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
@@ -5,66 +5,74 @@ Identifies the deletion of sensitive Linux system logs. This may indicate an att
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Defense Evasion
-
-*Version*: 101 (<<system-log-file-deletion-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "deletion" and file.path : (
-"/var/run/utmp", "/var/log/wtmp", "/var/log/btmp",
-"/var/log/lastlog", "/var/log/faillog", "/var/log/syslog",
-"/var/log/messages", "/var/log/secure", "/var/log/auth.log",
-"/var/log/boot.log", "/var/log/kern.log" ) and not
-process.name : ("gzip")
+[source, js]
 ----------------------------------
+file where host.os.type == "linux" and event.type == "deletion" and
+  file.path :
+    (
+    "/var/run/utmp",
+    "/var/log/wtmp",
+    "/var/log/btmp",
+    "/var/log/lastlog",
+    "/var/log/faillog",
+    "/var/log/syslog",
+    "/var/log/messages",
+    "/var/log/secure",
+    "/var/log/auth.log",
+    "/var/log/boot.log",
+    "/var/log/kern.log"
+    ) and
+    not process.name : ("gzip")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,46 +81,10 @@ process.name : ("gzip")
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[system-log-file-deletion-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "deletion" and file.path : (
-"/var/run/utmp", "/var/log/wtmp", "/var/log/btmp",
-"/var/log/lastlog", "/var/log/faillog", "/var/log/syslog",
-"/var/log/messages", "/var/log/secure", "/var/log/auth.log"
-) and not process.name : ("gzip")
-----------------------------------
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "deletion" and file.path : (
-"/var/run/utmp", "/var/log/wtmp", "/var/log/btmp",
-"/var/log/lastlog", "/var/log/faillog", "/var/log/syslog",
-"/var/log/messages", "/var/log/secure", "/var/log/auth.log"
-)
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Clear Linux or Mac System Logs
+** ID: T1070.002
+** Reference URL: https://attack.mitre.org/techniques/T1070/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-network-connections-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-network-connections-discovery.asciidoc
new file mode 100644
index 0000000000..08a01ff423
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-network-connections-discovery.asciidoc
@@ -0,0 +1,61 @@
+[[system-network-connections-discovery]]
+=== System Network Connections Discovery
+
+Adversaries may attempt to get a listing of network connections to or from a compromised system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type == "start" and
+  process.name : ("netstat", "lsof", "who", "w")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Network Connections Discovery
+** ID: T1049
+** Reference URL: https://attack.mitre.org/techniques/T1049/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-owner-user-discovery-linux.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-owner-user-discovery-linux.asciidoc
new file mode 100644
index 0000000000..a7cc5d16e2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-owner-user-discovery-linux.asciidoc
@@ -0,0 +1,65 @@
+[[system-owner-user-discovery-linux]]
+=== System Owner/User Discovery Linux
+
+Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type == "start" and
+  process.name : ("whoami", "w", "who", "users", "id")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Owner/User Discovery
+** ID: T1033
+** Reference URL: https://attack.mitre.org/techniques/T1033/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-service-discovery-through-built-in-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-service-discovery-through-built-in-windows-utilities.asciidoc
new file mode 100644
index 0000000000..9fe03e02ad
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-service-discovery-through-built-in-windows-utilities.asciidoc
@@ -0,0 +1,67 @@
+[[system-service-discovery-through-built-in-windows-utilities]]
+=== System Service Discovery through built-in Windows Utilities
+
+Detects the usage of commonly used system service discovery techniques, which attackers may use during the reconnaissance phase after compromising a system in order to gain a better understanding of the environment and/or escalate privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+  ((process.name: "net.exe" or process.pe.original_file_name == "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and process.args : ("start", "use") and process.args_count == 2) or
+  ((process.name: "sc.exe" or process.pe.original_file_name == "sc.exe") and process.args: ("query", "q*")) or
+  ((process.name: "tasklist.exe" or process.pe.original_file_name == "tasklist.exe") and process.args: "/svc")
+  ) and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Service Discovery
+** ID: T1007
+** Reference URL: https://attack.mitre.org/techniques/T1007/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index 1957cf34fe..82aadf9ffc 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -10,57 +10,64 @@ Windows services typically run as SYSTEM and can be used as a privilege escalati
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<system-shells-via-services-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating System Shells via Services
 
-Attackers may configure existing services or create new ones to execute system shells to elevate their privileges from
-administrator to SYSTEM. They can also configure services to execute these shells with persistence payloads.
+Attackers may configure existing services or create new ones to execute system shells to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these shells with persistence payloads.
 
 This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
 
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Identify how the service was created or modified. Look for registry changes events or Windows events related to
-service activities (for example, 4697 and/or 7045).
-  - Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).
+  - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.
+    - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+    - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+    - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
@@ -68,37 +75,33 @@ service activities (for example, 4697 and/or 7045).
 
 ### False positive analysis
 
-- This activity should not happen legitimately. The security team should address any potential benign true positive
-(B-TP), as this configuration can put the user and the domain at risk.
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Delete the service or restore it to the original configuration.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"services.exe" and process.name : ("cmd.exe", "powershell.exe",
-"pwsh.exe", "powershell_ise.exe") and /* Third party FP's */ not
-process.args : "NVDisplay.ContainerLocalSystem"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "services.exe" and
+  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+
+  /* Third party FP's */
+  not process.args : "NVDisplay.ContainerLocalSystem"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -110,94 +113,7 @@ process.args : "NVDisplay.ContainerLocalSystem"
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[system-shells-via-services-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "services.exe" and process.name : ("cmd.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe") and /* Third
-party FP's */ not process.args : "NVDisplay.ContainerLocalSystem"
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "services.exe" and process.name : ("cmd.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe") and /* Third
-party FP's */ not process.args : "NVDisplay.ContainerLocalSystem"
-----------------------------------
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "services.exe" and process.name : ("cmd.exe",
-"powershell.exe") and /* Third party FP's */ not process.args :
-"NVDisplay.ContainerLocalSystem"
-----------------------------------
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:services.exe and process.name:(cmd.exe or
-powershell.exe)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:services.exe and process.name:(cmd.exe or
-powershell.exe)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:"services.exe" and process.name:("cmd.exe" or
-"powershell.exe")
-----------------------------------
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc
new file mode 100644
index 0000000000..675c5bd4c0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc
@@ -0,0 +1,67 @@
+[[system-time-discovery]]
+=== System Time Discovery
+
+Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+ ((process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and process.args : "time") or 
+ (process.name: "w32tm.exe" and process.args: "/tz") or 
+ (process.name: "tzutil.exe" and process.args: "/g")
+) and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Time Discovery
+** ID: T1124
+** Reference URL: https://attack.mitre.org/techniques/T1124/
diff --git a/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
index 223c8ce9d4..fe9fd02ee1 100644
--- a/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
@@ -5,7 +5,7 @@ Keychains are the built-in way for macOS to keep track of users' passwords and c
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,44 +14,41 @@ Keychains are the built-in way for macOS to keep track of users' passwords and c
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<systemkey-access-via-command-line-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:("/private/var/db/SystemKey" or "/var/db/SystemKey")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.args:("/private/var/db/SystemKey" or "/var/db/SystemKey")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,22 +60,7 @@ process.args:("/private/var/db/SystemKey" or "/var/db/SystemKey")
 ** Name: Credentials from Password Stores
 ** ID: T1555
 ** Reference URL: https://attack.mitre.org/techniques/T1555/
-
-[[systemkey-access-via-command-line-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:"/private/var/db/SystemKey"
-----------------------------------
-
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc b/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc
index e73bba7a58..6c96e05e41 100644
--- a/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc
@@ -5,7 +5,7 @@ Adversaries may attempt to clear or disable the Bash command-line history in an
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,61 +14,58 @@ Adversaries may attempt to clear or disable the Bash command-line history in an
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<tampering-of-bash-command-line-history-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.9.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-((process.args : ("rm", "echo") or (process.args : "ln" and
-process.args : "-sf" and process.args : "/dev/null") or
-(process.args : "truncate" and process.args : "-s0")) and
-process.args : (".bash_history", "/root/.bash_history",
-"/home/*/.bash_history","/Users/.bash_history",
-"/Users/*/.bash_history", ".zsh_history",
-"/root/.zsh_history", "/home/*/.zsh_history", "/Users/.zsh_history",
-"/Users/*/.zsh_history")) or (process.name : "history" and
-process.args : "-c") or (process.args : "export" and process.args :
-("HISTFILE=/dev/null", "HISTFILESIZE=0")) or (process.args : "unset"
-and process.args : "HISTFILE") or (process.args : "set" and
-process.args : "history" and process.args : "+o") )
+[source, js]
 ----------------------------------
+process where event.type in ("start", "process_started") and
+ (
+  ((process.args : ("rm", "echo") or
+    (process.args : "ln" and process.args : "-sf" and process.args : "/dev/null") or
+    (process.args : "truncate" and process.args : "-s0"))
+    and process.args : (".bash_history", "/root/.bash_history", "/home/*/.bash_history","/Users/.bash_history", "/Users/*/.bash_history",
+                        ".zsh_history", "/root/.zsh_history", "/home/*/.zsh_history", "/Users/.zsh_history", "/Users/*/.zsh_history")) or
+  (process.name : "history" and process.args : "-c") or
+  (process.args : "export" and process.args : ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
+  (process.args : "unset" and process.args : "HISTFILE") or
+  (process.args : "set" and process.args : "history" and process.args : "+o")
+ )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,58 +74,10 @@ process.args : "history" and process.args : "+o") )
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[tampering-of-bash-command-line-history-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-(process.args : ("rm", "echo") and process.args : (".bash_history",
-"/root/.bash_history", "/home/*/.bash_history")) or (process.name :
-"history" and process.args : "-c") or (process.args : "export" and
-process.args : ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
-(process.args : "unset" and process.args : "HISTFILE") or
-(process.args : "set" and process.args : "history" and process.args :
-"+o") )
-----------------------------------
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Rule name changed from: Deletion of Bash Command Line History
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process AND event.type:(start or process_started) AND
-process.name:rm AND
-process.args:/\/(home\/.{1,255}|root)\/\.bash_history/
-----------------------------------
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.11.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.1 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Clear Command History
+** ID: T1070.003
+** Reference URL: https://attack.mitre.org/techniques/T1070/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
index d2f85256e6..8c470c9242 100644
--- a/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of the mount_apfs command to mount the entire file system thr
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,46 +14,42 @@ Identifies the use of the mount_apfs command to mount the entire file system thr
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://theevilbit.github.io/posts/cve_2020_9771/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-* CVE_2020_9771
-
-*Version*: 100 (<<tcc-bypass-via-mounted-apfs-snapshot-access-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category : process and event.type : (start or process_started)
-and process.name : mount_apfs and process.args :
-(/System/Volumes/Data and noowners)
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and process.name:mount_apfs and
+  process.args:(/System/Volumes/Data and noowners)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -65,13 +61,3 @@ and process.name : mount_apfs and process.args :
 ** Name: Direct Volume Access
 ** ID: T1006
 ** Reference URL: https://attack.mitre.org/techniques/T1006/
-
-[[tcc-bypass-via-mounted-apfs-snapshot-access-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/temporarily-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/temporarily-scheduled-task-creation.asciidoc
index 1f159bf244..1d69f2c623 100644
--- a/docs/detections/prebuilt-rules/rule-details/temporarily-scheduled-task-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/temporarily-scheduled-task-creation.asciidoc
@@ -5,73 +5,55 @@ Indicates the creation and deletion of a scheduled task within a short time inte
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Persistence
-
-*Version*: 2 (<<temporarily-scheduled-task-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 8.5.0
+*Version*: 6
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate scheduled tasks may be created during installation of new software.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, winlog.event_data.TaskName with maxspan=5m
-[iam where event.action == "scheduled-task-created" and not user.name
-: "*$"] [iam where event.action == "scheduled-task-deleted" and not
-user.name : "*$"]
+[source, js]
 ----------------------------------
+sequence by winlog.computer_name, winlog.event_data.TaskName with maxspan=5m
+   [iam where event.action == "scheduled-task-created" and not user.name : "*$"]
+   [iam where event.action == "scheduled-task-deleted" and not user.name : "*$"]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Indicator Removal on Host
-** ID: T1070
-** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
@@ -80,17 +62,7 @@ user.name : "*$"]
 ** Name: Scheduled Task/Job
 ** ID: T1053
 ** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[temporarily-scheduled-task-creation-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, winlog.event_data.TaskName with maxspan=5m
-[iam where event.action == "scheduled-task-created"] [iam where
-event.action == "scheduled-task-deleted"]
-----------------------------------
-
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
index 352946124c..5cb96f925c 100644
--- a/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of backup files, saved using third-party software, by a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,62 +16,52 @@ Identifies the deletion of backup files, saved using third-party software, by a
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<third-party-backup-files-deleted-via-unexpected-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain utilities that delete files for disk cleanup or Administrators manually removing backup files.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Third-party Backup Files Deleted via Unexpected Process
 
-Backups are a significant obstacle for any ransomware operation. They allow the victim to resume business by performing
-data recovery, making them a valuable target.
+Backups are a significant obstacle for any ransomware operation. They allow the victim to resume business by performing data recovery, making them a valuable target.
 
-Attackers can delete backups from the host and gain access to backup servers to remove centralized backups for the
-environment, ensuring that victims have no alternatives to paying the ransom.
+Attackers can delete backups from the host and gain access to backup servers to remove centralized backups for the environment, ensuring that victims have no alternatives to paying the ransom.
 
-This rule identifies file deletions performed by a process that does not belong to the backup suite and aims to delete
-Veritas or Veeam backups.
+This rule identifies file deletions performed by a process that does not belong to the backup suite and aims to delete Veritas or Veeam backups.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -79,8 +69,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This rule can be triggered by the manual removal of backup files and by removal using other third-party tools that are
-not from the backup suite. Exceptions can be added for specific accounts and executables, preferably tied together.
+- This rule can be triggered by the manual removal of backup files and by removal using other third-party tools that are not from the backup suite. Exceptions can be added for specific accounts and executables, preferably tied together.
 
 ### Related rules
 
@@ -92,36 +81,38 @@ not from the backup suite. Exceptions can be added for specific accounts and exe
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
 - Perform data recovery locally or restore the backups from replicated copies (Cloud, other servers, etc.).
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "deletion" and ( /* Veeam Related Backup
-Files */ (file.extension : ("VBK", "VIB", "VBM") and not
-process.executable : ("?:\\Windows\\Veeam\\Backup\\*",
-"?:\\Program Files\\Veeam\\Backup and Replication\\*",
-"?:\\Program Files (x86)\\Veeam\\Backup and Replication\\*")) or /*
-Veritas Backup Exec Related Backup File */ (file.extension : "BKF"
-and not process.executable : ("?:\\Program Files\\Veritas\\Backup
-Exec\\*", "?:\\Program Files
-(x86)\\Veritas\\Backup Exec\\*")) )
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "deletion" and
+  (
+  /* Veeam Related Backup Files */
+  (file.extension : ("VBK", "VIB", "VBM") and
+  not (
+    process.executable : ("?:\\Windows\\*", "?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
+    (process.code_signature.trusted == true and process.code_signature.subject_name : "Veeam Software Group GmbH")
+  )) or
+
+  /* Veritas Backup Exec Related Backup File */
+  (file.extension : "BKF" and
+  not process.executable : ("?:\\Program Files\\Veritas\\Backup Exec\\*",
+                            "?:\\Program Files (x86)\\Veritas\\Backup Exec\\*") and
+  not file.path : ("?:\\ProgramData\\Trend Micro\\*",
+                   "?:\\Program Files (x86)\\Trend Micro\\*",
+                   "?:\\$RECYCLE.BIN\\*"))
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,25 +124,3 @@ Exec\\*", "?:\\Program Files
 ** Name: Inhibit System Recovery
 ** ID: T1490
 ** Reference URL: https://attack.mitre.org/techniques/T1490/
-
-[[third-party-backup-files-deleted-via-unexpected-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.0.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
new file mode 100644
index 0000000000..46adade018
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -0,0 +1,118 @@
+[[threat-intel-hash-indicator-match]]
+=== Threat Intel Hash Indicator Match
+
+This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events.
+
+*Rule type*: threat_match
+
+*Rule indices*:
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* winlogbeat-*
+
+*Severity*: critical
+
+*Risk score*: 99
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*:
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Indicator Match
+
+*Version*: 2
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and Analysis
+
+### Investigating Threat Intel Hash Indicator Match
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Gain context about the field that matched the local observation. This information can be found in the `threat.indicator.matched.field` field.
+- Investigate the hash , which can be found in the `threat.indicator.matched.atomic` field:
+  - Search for the existence and reputation of the hash in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+  - Scope other potentially compromised hosts in your environment by mapping hosts with file operations involving the same hash.
+- Identify the process that created the file.
+  - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Enrich the information that you have right now by determining how the file was dropped, where it was downloaded from, etc. This can help you determine if the event is part of an ongoing campaign against the organization.
+- Retrieve the involved file and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - $osquery_0
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - $osquery_1
+      - $osquery_2
+      - $osquery_3
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+### False Positive Analysis
+
+- Adversaries often use legitimate tools as network administrators, such as `PsExec` or `AdFind`. These tools are often included in indicator lists, which creates the potential for false positives.
+
+### Response and Remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file.hash.*:* or file.pe.imphash:* or process.hash.*:* or process.pe.imphash:* or dll.hash.*:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
new file mode 100644
index 0000000000..60710c811e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -0,0 +1,117 @@
+[[threat-intel-ip-address-indicator-match]]
+=== Threat Intel IP Address Indicator Match
+
+This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* packetbeat-*
+* winlogbeat-*
+
+*Severity*: critical
+
+*Risk score*: 99
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Indicator Match
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and Analysis
+
+### Investigating Threat Intel IP Address Indicator Match
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. 
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
+
+#### Possible investigation steps
+
+- Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.
+- Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:
+  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. 
+  - Execute a reverse DNS lookup to retrieve hostnames associated with the given IP address.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - $osquery_0
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - $osquery_1
+      - $osquery_2
+      - $osquery_3
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+### False Positive Analysis
+
+- When a match is found, it's important to consider the indicator's initial release date. Threat intelligence is useful for augmenting existing security processes but can quickly become outdated. In other words, some threat intelligence only represents a specific set of activity observed at a specific time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.
+- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.
+- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.
+
+### Response and Remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+source.ip:* or destination.ip:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
new file mode 100644
index 0000000000..ed7f7e17a5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -0,0 +1,120 @@
+[[threat-intel-url-indicator-match]]
+=== Threat Intel URL Indicator Match
+
+This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* packetbeat-*
+* winlogbeat-*
+
+*Severity*: critical
+
+*Risk score*: 99
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Indicator Match
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and Analysis
+
+### Investigating Threat Intel URL Indicator Match
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. 
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
+
+#### Possible investigation steps
+
+- Investigate the URL, which can be found in the `threat.indicator.matched.atomic` field:
+  - Identify the type of malicious activity related to the URL (phishing, malware, etc.).
+  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. 
+  - Execute a WHOIS lookup to retrieve information about the domain registration and contacts to report abuse.
+  - If dealing with a phishing incident:
+    - Contact the user to gain more information around the delivery method, information sent, etc.
+    - Analyze whether the URL is trying to impersonate a legitimate address. Look for typosquatting, extra or unusual subdomains, or other anomalies that could lure the user.
+    - Investigate the phishing page to identify which information may have been sent to the attacker by the user.
+- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - $osquery_0
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - $osquery_1
+      - $osquery_2
+      - $osquery_3
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+### False Positive Analysis
+
+- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.
+- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.
+
+### Response and Remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Consider reporting the address for abuse using the provided contact information.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+url.full:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
new file mode 100644
index 0000000000..299699cc93
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -0,0 +1,113 @@
+[[threat-intel-windows-registry-indicator-match]]
+=== Threat Intel Windows Registry Indicator Match
+
+This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data.
+
+*Rule type*: threat_match
+
+*Rule indices*:
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* winlogbeat-*
+
+*Severity*: critical
+
+*Risk score*: 99
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*:
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Indicator Match
+
+*Version*: 2
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and Analysis
+
+### Investigating Threat Intel Windows Registry Indicator Match
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Check related threat reports to gain context about the registry indicator of compromise (IoC) and to understand if it's a system-native mechanism abused for persistence, to store data, to disable security mechanisms, etc. Use this information to define the appropriate triage and respond steps.
+- Identify the process responsible for the registry operation and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - $osquery_0
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - $osquery_1
+      - $osquery_2
+      - $osquery_3
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+### False Positive Analysis
+
+- Adversaries can leverage dual-use registry mechanisms that are commonly used by normal applications. These registry keys can be added into indicator lists creating the potential for false positives.
+
+### Response and Remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry.path:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc
index 51d0a3532f..28e74c40af 100644
--- a/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc
@@ -5,7 +5,7 @@ Timestomping is an anti-forensics technique which is used to modify the timestam
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,52 +14,50 @@ Timestomping is an anti-forensics technique which is used to modify the timestam
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 33
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* macOS
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<timestomping-using-touch-command-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "touch" and
-user.id != "0" and process.args : ("-r", "-t", "-a*","-m*") and not
-process.args : ("/usr/lib/go-*/bin/go", "/usr/lib/dracut/dracut-
-functions.sh", "/tmp/KSInstallAction.*/m/.patch/*")
+[source, js]
 ----------------------------------
+process where event.type == "start" and
+ process.name : "touch" and user.id != "0" and
+ process.args : ("-r", "-t", "-a*","-m*") and
+ not process.args : ("/usr/lib/go-*/bin/go", "/usr/lib/dracut/dracut-functions.sh", "/tmp/KSInstallAction.*/m/.patch/*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -68,41 +66,10 @@ functions.sh", "/tmp/KSInstallAction.*/m/.patch/*")
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[timestomping-using-touch-command-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "touch" and process.args : ("-r", "-t", "-a*","-m*")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name == "touch" and wildcard(process.args, "-r", "-t",
-"-a*","-m*")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Timestomp
+** ID: T1070.006
+** Reference URL: https://attack.mitre.org/techniques/T1070/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
index 1728d49cc3..5eec1733a1 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
@@ -5,67 +5,65 @@ Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 101 (<<uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.executable :
-"C:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe" and process.parent.name :
-"ieinstal.exe" and process.parent.args : "-Embedding" /* uncomment
-once in winlogbeat */ /* and not (process.code_signature.subject_name
-== "Microsoft Corporation" and process.code_signature.trusted == true)
-*/
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : "C:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe" and
+ process.parent.name : "ieinstal.exe" and process.parent.args : "-Embedding"
+
+ /* uncomment once in winlogbeat */
+ /* and not (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) */
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -77,46 +75,7 @@ once in winlogbeat */ /* and not (process.code_signature.subject_name
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.executable : "C:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe" and
-process.parent.name : "ieinstal.exe" and process.parent.args :
-"-Embedding" /* uncomment once in winlogbeat */ /* and not
-(process.code_signature.subject_name == "Microsoft Corporation" and
-process.code_signature.trusted == true) */
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-wildcard(process.executable,
-"C:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe") and process.parent.name
-== "ieinstal.exe" and process.parent.args == "-Embedding" /*
-uncomment once in winlogbeat */ /* and not
-(process.code_signature.subject_name == "Microsoft Corporation" and
-process.code_signature.trusted == true) */
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
index 293fc34781..861448d30a 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
@@ -5,70 +5,65 @@ Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. A
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/hfiref0x/UACME
 * https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 101 (<<uac-bypass-attempt-via-privileged-ifileoperation-com-interface-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type : "change" and process.name : "dllhost.exe" and
-/* Known modules names side loaded into process running with high or
-system integrity level for UAC Bypass, update here for new modules */
-file.name : ("wow64log.dll", "comctl32.dll", "DismCore.dll",
-"OskSupport.dll", "duser.dll", "Accessibility.ni.dll") and /* has no
-impact on rule logic just to avoid OS install related FPs */ not
-file.path : ("C:\\Windows\\SoftwareDistribution\\*",
-"C:\\Windows\\WinSxS\\*")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type : "change" and process.name : "dllhost.exe" and
+  /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */
+  file.name : ("wow64log.dll", "comctl32.dll", "DismCore.dll", "OskSupport.dll", "duser.dll", "Accessibility.ni.dll") and
+  /* has no impact on rule logic just to avoid OS install related FPs */
+  not file.path : ("C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\WinSxS\\*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,28 +75,7 @@ file.path : ("C:\\Windows\\SoftwareDistribution\\*",
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-attempt-via-privileged-ifileoperation-com-interface-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index 20dd3107b5..405e88595d 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -10,12 +10,13 @@ Identifies an attempt to bypass User Account Control (UAC) by masquerading as a
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,69 +28,60 @@ Identifies an attempt to bypass User Account Control (UAC) by masquerading as a
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<uac-bypass-attempt-via-windows-directory-masquerading-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating UAC Bypass Attempt via Windows Directory Masquerading
 
-Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels)
-to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.
-UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the
-local administrators group and enter an administrator password when prompted.
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
 For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
 
-This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows
-directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
+This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze any suspicious spawned processes using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -103,30 +95,23 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.args : ("C:\\Windows
-\\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -138,35 +123,7 @@ process where event.type == "start" and process.args : ("C:\\Windows
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-attempt-via-windows-directory-masquerading-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows
-\\SysWOW64\\*.exe")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
index f3fa20fe92..536875c792 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
@@ -5,66 +5,63 @@ Identifies attempts to bypass User Account Control (UAC) by abusing an elevated
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/hfiref0x/UACME
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 101 (<<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "Clipup.exe"
-and not process.executable : "C:\\Windows\\System32\\ClipUp.exe" and
-process.parent.name : "dllhost.exe" and /* CLSID of the Elevated COM
-Interface IEditionUpgradeManager */ process.parent.args :
-"/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name : "Clipup.exe" and
+  not process.executable : "C:\\Windows\\System32\\ClipUp.exe" and process.parent.name : "dllhost.exe" and
+  /* CLSID of the Elevated COM Interface IEditionUpgradeManager */
+  process.parent.args : "/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,45 +73,7 @@ Interface IEditionUpgradeManager */ process.parent.args :
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "Clipup.exe" and not process.executable :
-"C:\\Windows\\System32\\ClipUp.exe" and process.parent.name :
-"dllhost.exe" and /* CLSID of the Elevated COM Interface
-IEditionUpgradeManager */ process.parent.args :
-"/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started", "info") and
-process.name == "Clipup.exe" and process.executable !=
-"C:\\Windows\\System32\\ClipUp.exe" and process.parent.name ==
-"dllhost.exe" and /* CLSID of the Elevated COM Interface
-IEditionUpgradeManager */ wildcard(process.parent.args,"/Processid:{B
-D54C901-076B-434E-B6C7-17C531F4AB41}")
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
index e06e211ee8..457078f40a 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
@@ -5,62 +5,62 @@ Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<uac-bypass-via-diskcleanup-scheduled-task-hijack-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.args : "/autoclean"
-and process.args : "/d" and not process.executable :
-("C:\\Windows\\System32\\cleanmgr.exe",
-"C:\\Windows\\SysWOW64\\cleanmgr.exe",
-"C:\\Windows\\System32\\taskhostw.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.args : "/autoclean" and process.args : "/d" and
+ not process.executable : ("C:\\Windows\\System32\\cleanmgr.exe",
+                           "C:\\Windows\\SysWOW64\\cleanmgr.exe",
+                           "C:\\Windows\\System32\\taskhostw.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,48 +72,7 @@ and process.args : "/d" and not process.executable :
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-via-diskcleanup-scheduled-task-hijack-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args:"/autoclean" and process.args:"/d" and not
-process.executable : ("C:\\Windows\\System32\\cleanmgr.exe",
-"C:\\Windows\\SysWOW64\\cleanmgr.exe")
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:(/autoclean or /AUTOCLEAN) and
-process.parent.name:svchost.exe and not
-process.executable:("C:\Windows\System32\cleanmgr.exe" or
-"C:\Windows\SysWOW64\cleanmgr.exe")
-----------------------------------
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
index 2c9bec1c90..8bb33e7955 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
@@ -5,62 +5,61 @@ Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevate
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 101 (<<uac-bypass-via-icmluautil-elevated-com-interface-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name ==
-"dllhost.exe" and process.parent.args in
-("/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",
-"/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}") and
-process.pe.original_file_name != "WerFault.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name == "dllhost.exe" and
+ process.parent.args in ("/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}", "/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}") and
+ process.pe.original_file_name != "WerFault.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,34 +71,7 @@ process.pe.original_file_name != "WerFault.exe"
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-via-icmluautil-elevated-com-interface-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name == "dllhost.exe" and process.parent.args in
-("/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",
-"/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}") and
-process.pe.original_file_name != "WerFault.exe"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index 9fca862dd4..30aa79bd23 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -10,12 +10,13 @@ Identifies attempts to bypass User Account Control (UAC) by hijacking the Micros
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -27,69 +28,60 @@ Identifies attempts to bypass User Account Control (UAC) by hijacking the Micros
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<uac-bypass-via-windows-firewall-snap-in-hijack-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating UAC Bypass via Windows Firewall Snap-In Hijack
 
-Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels)
-to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.
-UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the
-local administrators group and enter an administrator password when prompted.
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
 For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
 
-This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC)
-Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
+This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze any suspicious spawned processes using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 ### False positive analysis
 
@@ -103,33 +95,26 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name ==
-"mmc.exe" and /* process.Ext.token.integrity_level_name == "high" can
-be added in future for tuning */ /* args of the Windows Firewall
-SnapIn */ process.parent.args == "WF.msc" and process.name !=
-"WerFault.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name == "mmc.exe" and
+ /* process.Ext.token.integrity_level_name == "high" can be added in future for tuning */
+ /* args of the Windows Firewall SnapIn */
+  process.parent.args == "WF.msc" and process.name != "WerFault.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -141,37 +126,7 @@ SnapIn */ process.parent.args == "WF.msc" and process.name !=
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[uac-bypass-via-windows-firewall-snap-in-hijack-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name == "mmc.exe" and /*
-process.Ext.token.integrity_level_name == "high" can be added in
-future for tuning */ /* args of the Windows Firewall SnapIn */
-process.parent.args == "WF.msc" and process.name != "WerFault.exe"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc
index 4b3d4248e0..b273b0a35f 100644
--- a/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc
@@ -5,7 +5,7 @@ Identifies unauthorized access attempts to Okta applications.
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-okta*
@@ -14,56 +14,51 @@ Identifies unauthorized access attempts to Okta applications.
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://developer.okta.com/docs/reference/api/system-log/
 * https://developer.okta.com/docs/reference/api/event-types/
 * https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-
-*Version*: 102 (<<unauthorized-access-to-an-okta-application-history, version history>>)
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:okta.system and
-event.action:app.generic.unauth_app_access_attempt
+[source, js]
 ----------------------------------
+event.dataset:okta.system and event.action:app.generic.unauth_app_access_attempt
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,37 +70,15 @@ event.action:app.generic.unauth_app_access_attempt
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
-
-
 * Tactic:
 ** Name: Persistence
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
 ** Reference URL: https://attack.mitre.org/tactics/TA0004/
-
-[[unauthorized-access-to-an-okta-application-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc b/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc
index a89d48f4a4..3b815e731f 100644
--- a/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc
@@ -5,7 +5,7 @@ Detects changes to registry persistence keys that are not commonly used or modif
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,126 +13,99 @@ Detects changes to registry persistence keys that are not commonly used or modif
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<uncommon-registry-persistence-change-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where /* uncomment once stable
-length(registry.data.strings) > 0 and */ registry.path : (
-"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Serve
-r\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Serve
-r\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\Load",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\Run",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\IconServiceLib",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\AppSetup",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Taskman",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Userinit",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\VmApplet", "HKLM\\SOFTWARE\\Micros
-oft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", "HKLM
-\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shel
-l", "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scrip
-ts\\Logoff\\Script", "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windo
-ws\\System\\Scripts\\Logon\\Script", "HKLM\\SOFTWARE\\Policies\\
-Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", "HKLM\\S
-OFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Scrip
-t", "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion
-\\Policies\\Explorer\\Run\\*", "HKEY_USERS\\*\\SOFTWARE\\Microso
-ft\\Windows\\CurrentVersion\\Policies\\System\\Shell", "HKEY_USE
-RS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff
-\\Script", "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Window
-s\\System\\Scripts\\Logon\\Script", "HKEY_USERS\\*\\SOFTWARE\\Po
-licies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", 
-"HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Script
-s\\Startup\\Script", "HKLM\\SOFTWARE\\Microsoft\\Active
-Setup\\Installed Components\\*\\ShellComponent",
-"HKLM\\SOFTWARE\\Microsoft\\Windows CE
-Services\\AutoStartOnConnect\\MicrosoftActiveSync",
-"HKLM\\SOFTWARE\\Microsoft\\Windows CE
-Services\\AutoStartOnDisconnect\\MicrosoftActiveSync",
-"HKLM\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
-"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
-"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
-"HKLM\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Exec",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
-"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File
-Execution Options\\*\\VerifierDlls",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\GpExtensions\\*\\DllName",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\SafeBoot\\AlternateShell",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal
-Server\\Wds\\rdpwd\\StartupPrograms",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal
-Server\\WinStations\\RDP-Tcp\\InitialProgram",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecute",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecute",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\Execute",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session
-Manager\\S0InitialCommand",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\ServiceControlManagerExtension",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\BootVerificationProgram\\ImagePat
-h", "HKLM\\SYSTEM\\Setup\\CmdLine",
-"HKEY_USERS\\*\\Environment\\UserInitMprLogonScript") and not
-registry.data.strings : ("C:\\Windows\\system32\\userinit.exe",
-"cmd.exe", "C:\\Program Files (x86)\\*.exe",
-"C:\\Program Files\\*.exe") and not (process.name : "rundll32.exe"
-and registry.path : "*\\Software\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Script") and not process.executable :
-("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe",
-"C:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe",
-"C:\\Program Files\\*.exe", "C:\\Program
-Files (x86)\\*.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+  /* uncomment once stable length(registry.data.strings) > 0 and */
+ registry.path : (
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IconServiceLib",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AppSetup",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Taskman",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\VmApplet",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+      "HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\*\\ShellComponent",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnConnect\\MicrosoftActiveSync",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect\\MicrosoftActiveSync",
+      "HKLM\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+      "HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+      "HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+      "HKLM\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+      "HKEY_USERS\\*\\Control Panel\\Desktop\\scrnsave.exe",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\VerifierDlls",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GpExtensions\\*\\DllName",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\SafeBoot\\AlternateShell",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\Wds\\rdpwd\\StartupPrograms",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecute",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecute",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\Execute",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\S0InitialCommand",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\ServiceControlManagerExtension",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\BootVerificationProgram\\ImagePath",
+      "HKLM\\SYSTEM\\Setup\\CmdLine",
+      "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript") and
+
+ not registry.data.strings : ("C:\\Windows\\system32\\userinit.exe", "cmd.exe", "C:\\Program Files (x86)\\*.exe",
+                              "C:\\Program Files\\*.exe") and
+ not (process.name : "rundll32.exe" and registry.path : "*\\Software\\Microsoft\\Internet Explorer\\Extensions\\*\\Script") and
+ not process.executable : ("C:\\Windows\\System32\\msiexec.exe",
+                           "C:\\Windows\\SysWOW64\\msiexec.exe",
+                           "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+                           "C:\\Program Files\\*.exe",
+                           "C:\\Program Files (x86)\\*.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -144,8 +117,10 @@ Files (x86)\\*.exe")
 ** Name: Boot or Logon Autostart Execution
 ** ID: T1547
 ** Reference URL: https://attack.mitre.org/techniques/T1547/
-
-
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -154,119 +129,3 @@ Files (x86)\\*.exe")
 ** Name: Modify Registry
 ** ID: T1112
 ** Reference URL: https://attack.mitre.org/techniques/T1112/
-
-[[uncommon-registry-persistence-change-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where /* uncomment once stable
-length(registry.data.strings) > 0 and */ registry.path : (
-"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Serve
-r\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
-"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Serve
-r\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\Load",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\Run",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Windows\\IconServiceLib",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Shell",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\AppSetup",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Taskman",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\Userinit",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\VmApplet", "HKLM\\SOFTWARE\\Micros
-oft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", "HKLM
-\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shel
-l", "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scrip
-ts\\Logoff\\Script", "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windo
-ws\\System\\Scripts\\Logon\\Script", "HKLM\\SOFTWARE\\Policies\\
-Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", "HKLM\\S
-OFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Scrip
-t", "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion
-\\Policies\\Explorer\\Run\\*", "HKEY_USERS\\*\\SOFTWARE\\Microso
-ft\\Windows\\CurrentVersion\\Policies\\System\\Shell", "HKEY_USE
-RS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff
-\\Script", "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Window
-s\\System\\Scripts\\Logon\\Script", "HKEY_USERS\\*\\SOFTWARE\\Po
-licies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", 
-"HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Script
-s\\Startup\\Script", "HKLM\\SOFTWARE\\Microsoft\\Active
-Setup\\Installed Components\\*\\ShellComponent",
-"HKLM\\SOFTWARE\\Microsoft\\Windows CE
-Services\\AutoStartOnConnect\\MicrosoftActiveSync",
-"HKLM\\SOFTWARE\\Microsoft\\Windows CE
-Services\\AutoStartOnDisconnect\\MicrosoftActiveSync",
-"HKLM\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
-"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
-"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
-"HKLM\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Exec",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Script",
-"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
-"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File
-Execution Options\\*\\VerifierDlls",
-"HKLM\\SOFTWARE\\Microsoft\\Windows
-NT\\CurrentVersion\\Winlogon\\GpExtensions\\*\\DllName",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\SafeBoot\\AlternateShell",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal
-Server\\Wds\\rdpwd\\StartupPrograms",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal
-Server\\WinStations\\RDP-Tcp\\InitialProgram",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecute",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecute",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\Execute",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\Session
-Manager\\S0InitialCommand",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\ServiceControlManagerExtension",
-"HKLM\\SYSTEM\\ControlSet*\\Control\\BootVerificationProgram\\ImagePat
-h", "HKLM\\SYSTEM\\Setup\\CmdLine",
-"HKEY_USERS\\*\\Environment\\UserInitMprLogonScript") and not
-registry.data.strings : ("C:\\Windows\\system32\\userinit.exe",
-"cmd.exe", "C:\\Program Files (x86)\\*.exe",
-"C:\\Program Files\\*.exe") and not (process.name : "rundll32.exe"
-and registry.path : "*\\Software\\Microsoft\\Internet
-Explorer\\Extensions\\*\\Script") and not process.executable :
-("C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\SysWOW64\\msiexec.exe",
-"C:\\ProgramData\\Microsoft\\Windows
-Defender\\Platform\\*\\MsMpEng.exe",
-"C:\\Program Files\\*.exe", "C:\\Program
-Files (x86)\\*.exe")
-----------------------------------
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.16.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc b/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
index 0ca5c69b97..9589f824ea 100644
--- a/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
@@ -5,7 +5,7 @@ Identifies when a child process is spawned by the screensaver engine process, wh
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,39 +14,37 @@ Identifies when a child process is spawned by the screensaver engine process, wh
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://posts.specterops.io/saving-your-access-d562bf5bf90b
 * https://github.com/D00MFist/PersistentJXA
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<unexpected-child-process-of-macos-screensaver-engine-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -56,17 +54,14 @@ as a download of a payload from a server.
 identify whether the file is malicious or not.
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name ==
-"ScreenSaverEngine"
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type == "start" and process.parent.name == "ScreenSaverEngine"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,19 +73,7 @@ process where event.type == "start" and process.parent.name ==
 ** Name: Event Triggered Execution
 ** ID: T1546
 ** Reference URL: https://attack.mitre.org/techniques/T1546/
-
-[[unexpected-child-process-of-macos-screensaver-engine-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Screensaver
+** ID: T1546.002
+** Reference URL: https://attack.mitre.org/techniques/T1546/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc
new file mode 100644
index 0000000000..c3ffcbbaa6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc
@@ -0,0 +1,152 @@
+[[unsigned-dll-loaded-by-svchost]]
+=== Unsigned DLL Loaded by Svchost
+
+Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and
+
+ process.executable : 
+     ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\Syswow64\\svchost.exe") and 
+     
+ dll.code_signature.trusted != true and 
+ 
+ not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and 
+ 
+ dll.hash.sha256 != null and 
+ 
+ (
+       /* DLL created within 5 minutes of the library load event - compatible with Elastic Endpoint 8.4+ */
+       dll.Ext.relative_file_creation_time <= 300 or 
+   
+       /* unusual paths */
+       dll.path :("?:\\ProgramData\\*",
+                  "?:\\Users\\*",
+                  "?:\\PerfLogs\\*",
+                  "?:\\Windows\\Tasks\\*",
+                  "?:\\Intel\\*",
+                  "?:\\AMD\\Temp\\*",
+                  "?:\\Windows\\AppReadiness\\*",
+                  "?:\\Windows\\ServiceState\\*",
+                  "?:\\Windows\\security\\*",
+                  "?:\\Windows\\IdentityCRL\\*",
+                  "?:\\Windows\\Branding\\*",
+                  "?:\\Windows\\csc\\*",
+                  "?:\\Windows\\DigitalLocker\\*",
+                  "?:\\Windows\\en-US\\*",
+                  "?:\\Windows\\wlansvc\\*",
+                  "?:\\Windows\\Prefetch\\*",
+                  "?:\\Windows\\Fonts\\*",
+                  "?:\\Windows\\diagnostics\\*",
+                  "?:\\Windows\\TAPI\\*",
+                  "?:\\Windows\\INF\\*",
+                  "?:\\Windows\\System32\\Speech\\*",
+                  "?:\\windows\\tracing\\*",
+                  "?:\\windows\\IME\\*",
+                  "?:\\Windows\\Performance\\*",
+                  "?:\\windows\\intel\\*",
+                  "?:\\windows\\ms\\*",
+                  "?:\\Windows\\dot3svc\\*",
+                  "?:\\Windows\\panther\\*",
+                  "?:\\Windows\\RemotePackages\\*",
+                  "?:\\Windows\\OCR\\*",
+                  "?:\\Windows\\appcompat\\*",
+                  "?:\\Windows\\apppatch\\*",
+                  "?:\\Windows\\addins\\*",
+                  "?:\\Windows\\Setup\\*",
+                  "?:\\Windows\\Help\\*",
+                  "?:\\Windows\\SKB\\*",
+                  "?:\\Windows\\Vss\\*",
+                  "?:\\Windows\\servicing\\*",
+                  "?:\\Windows\\CbsTemp\\*",
+                  "?:\\Windows\\Logs\\*",
+                  "?:\\Windows\\WaaS\\*",
+                  "?:\\Windows\\twain_32\\*",
+                  "?:\\Windows\\ShellExperiences\\*",
+                  "?:\\Windows\\ShellComponents\\*",
+                  "?:\\Windows\\PLA\\*",
+                  "?:\\Windows\\Migration\\*",
+                  "?:\\Windows\\debug\\*",
+                  "?:\\Windows\\Cursors\\*",
+                  "?:\\Windows\\Containers\\*",
+                  "?:\\Windows\\Boot\\*",
+                  "?:\\Windows\\bcastdvr\\*",
+                  "?:\\Windows\\TextInput\\*",
+                  "?:\\Windows\\security\\*",
+                  "?:\\Windows\\schemas\\*",
+                  "?:\\Windows\\SchCache\\*",
+                  "?:\\Windows\\Resources\\*",
+                  "?:\\Windows\\rescache\\*",
+                  "?:\\Windows\\Provisioning\\*",
+                  "?:\\Windows\\PrintDialog\\*",
+                  "?:\\Windows\\PolicyDefinitions\\*",
+                  "?:\\Windows\\media\\*",
+                  "?:\\Windows\\Globalization\\*",
+                  "?:\\Windows\\L2Schemas\\*",
+                  "?:\\Windows\\LiveKernelReports\\*",
+                  "?:\\Windows\\ModemLogs\\*",
+                  "?:\\Windows\\ImmersiveControlPanel\\*",
+                  "?:\\$Recycle.Bin\\*")
+  ) and 
+  
+  not dll.hash.sha256 : 
+            ("3ed33e71641645367442e65dca6dab0d326b22b48ef9a4c2a2488e67383aa9a6", 
+             "b4db053f6032964df1b254ac44cb995ffaeb4f3ade09597670aba4f172cf65e4", 
+             "214c75f678bc596bbe667a3b520aaaf09a0e50c364a28ac738a02f867a085eba", 
+             "23aa95b637a1bf6188b386c21c4e87967ede80242327c55447a5bb70d9439244", 
+             "5050b025909e81ae5481db37beb807a80c52fc6dd30c8aa47c9f7841e2a31be7")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
new file mode 100644
index 0000000000..1db0d7881e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
@@ -0,0 +1,152 @@
+[[unsigned-dll-side-loading-from-a-suspicious-folder]]
+=== Unsigned DLL Side-Loading from a Suspicious Folder
+
+Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and
+
+ process.code_signature.trusted == true and 
+ 
+ (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and 
+ 
+  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining") and 
+  
+      /* Suspicious Paths */
+      dll.path : ("?:\\PerfLogs\\*.dll",
+                  "?:\\Users\\*\\Pictures\\*.dll",
+                  "?:\\Users\\*\\Music\\*.dll",
+                  "?:\\Users\\Public\\*.dll",
+                  "?:\\Users\\*\\Documents\\*.dll",
+                  "?:\\Windows\\Tasks\\*.dll",
+                  "?:\\Windows\\System32\\Tasks\\*.dll",
+                  "?:\\Intel\\*.dll",
+                  "?:\\AMD\\Temp\\*.dll",
+                  "?:\\Windows\\AppReadiness\\*.dll",
+                  "?:\\Windows\\ServiceState\\*.dll",
+                  "?:\\Windows\\security\\*.dll",
+		  "?:\\Windows\\System\\*.dll",
+                  "?:\\Windows\\IdentityCRL\\*.dll",
+                  "?:\\Windows\\Branding\\*.dll",
+                  "?:\\Windows\\csc\\*.dll",
+                  "?:\\Windows\\DigitalLocker\\*.dll",
+                  "?:\\Windows\\en-US\\*.dll",
+                  "?:\\Windows\\wlansvc\\*.dll",
+                  "?:\\Windows\\Prefetch\\*.dll",
+                  "?:\\Windows\\Fonts\\*.dll",
+                  "?:\\Windows\\diagnostics\\*.dll",
+                  "?:\\Windows\\TAPI\\*.dll",
+                  "?:\\Windows\\INF\\*.dll",
+                  "?:\\windows\\tracing\\*.dll",
+                  "?:\\windows\\IME\\*.dll",
+                  "?:\\Windows\\Performance\\*.dll",
+                  "?:\\windows\\intel\\*.dll",
+                  "?:\\windows\\ms\\*.dll",
+                  "?:\\Windows\\dot3svc\\*.dll",
+                  "?:\\Windows\\ServiceProfiles\\*.dll",
+                  "?:\\Windows\\panther\\*.dll",
+                  "?:\\Windows\\RemotePackages\\*.dll",
+                  "?:\\Windows\\OCR\\*.dll",
+                  "?:\\Windows\\appcompat\\*.dll",
+                  "?:\\Windows\\apppatch\\*.dll",
+                  "?:\\Windows\\addins\\*.dll",
+                  "?:\\Windows\\Setup\\*.dll",
+                  "?:\\Windows\\Help\\*.dll",
+                  "?:\\Windows\\SKB\\*.dll",
+                  "?:\\Windows\\Vss\\*.dll",
+                  "?:\\Windows\\Web\\*.dll",
+                  "?:\\Windows\\servicing\\*.dll",
+                  "?:\\Windows\\CbsTemp\\*.dll",
+                  "?:\\Windows\\Logs\\*.dll",
+                  "?:\\Windows\\WaaS\\*.dll",
+                  "?:\\Windows\\twain_32\\*.dll",
+                  "?:\\Windows\\ShellExperiences\\*.dll",
+                  "?:\\Windows\\ShellComponents\\*.dll",
+                  "?:\\Windows\\PLA\\*.dll",
+                  "?:\\Windows\\Migration\\*.dll",
+                  "?:\\Windows\\debug\\*.dll",
+                  "?:\\Windows\\Cursors\\*.dll",
+                  "?:\\Windows\\Containers\\*.dll",
+                  "?:\\Windows\\Boot\\*.dll",
+                  "?:\\Windows\\bcastdvr\\*.dll",
+                  "?:\\Windows\\TextInput\\*.dll",
+                  "?:\\Windows\\schemas\\*.dll",
+                  "?:\\Windows\\SchCache\\*.dll",
+                  "?:\\Windows\\Resources\\*.dll",
+                  "?:\\Windows\\rescache\\*.dll",
+                  "?:\\Windows\\Provisioning\\*.dll",
+                  "?:\\Windows\\PrintDialog\\*.dll",
+                  "?:\\Windows\\PolicyDefinitions\\*.dll",
+                  "?:\\Windows\\media\\*.dll",
+                  "?:\\Windows\\Globalization\\*.dll",
+                  "?:\\Windows\\L2Schemas\\*.dll",
+                  "?:\\Windows\\LiveKernelReports\\*.dll",
+                  "?:\\Windows\\ModemLogs\\*.dll",
+                  "?:\\Windows\\ImmersiveControlPanel\\*.dll",
+                  "?:\\$Recycle.Bin\\*.dll") and 
+	 
+	 /* DLL loaded from the process.executable current directory */
+	 endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
new file mode 100644
index 0000000000..9bd183d9a7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -0,0 +1,134 @@
+[[untrusted-driver-loaded]]
+=== Untrusted Driver Loaded
+
+Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://github.com/hfiref0x/TDL
+* https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN
+
+*Tags*:
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*:
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Untrusted Driver Loaded
+
+Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets.
+
+This protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.
+
+This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
+  - Identify the path that the driver was loaded from. If you're using Elastic Defend, path information can be found in the `dll.path` field.
+  - Examine the file creation and modification timestamps:
+    - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `dll.Ext.relative_file_name_modify_time` fields. The values are in seconds.
+    - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.
+      - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+  - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Use Osquery to investigate the drivers loaded into the system.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+### False positive analysis
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+### Related Rules
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+driver where host.os.type == "windows" and process.pid == 4 and
+  dll.code_signature.trusted != true and
+  not dll.code_signature.status : ("errorExpired", "errorRevoked")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Code Signing Policy Modification
+** ID: T1553.006
+** Reference URL: https://attack.mitre.org/techniques/T1553/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc
index 8936f4b2d5..395bcdf6d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc
@@ -5,93 +5,74 @@ A machine learning job detected an AWS API command that, while not inherently su
 
 *Rule type*: machine_learning
 
-*Machine learning job*: rare_method_for_a_username
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* ML
-* Investigation Guide
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Resources: Investigation Guide
 
-*Version*: 102 (<<unusual-aws-command-for-a-user-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 7.9.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-New or unusual user command activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; or changes in the way services are used.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual AWS Command for a User
 
-CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and
-understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity
-when deviations occur.
+CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
-This rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is
-being made by a user context that does not normally use the command. This can be the result of compromised credentials or
-keys as someone uses a valid account to persist, move laterally, or exfiltrate data.
+This rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data.
 
-Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM
-user.
+Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user.
 
 #### Possible investigation steps
 
 - Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
-    - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
-    `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
+    - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
     - The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Validate the activity is not related to planned patches, updates, or network administrator activity.
 - Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal
-time of day?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
-- Examine the history of the command. If the command only manifested recently, it might be part of a new automation
-module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence),
-it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
+- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 
 ### Related Rules
 
@@ -110,47 +91,12 @@ it might be part of a housekeeping or maintenance process. You can find the comm
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-
-
-[[unusual-aws-command-for-a-user-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.16.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
index 7a0daa5258..04486039db 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
@@ -5,7 +5,7 @@ Identifies a suspicious child process of the Windows virtual system process, whi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,51 +16,49 @@ Identifies a suspicious child process of the Windows virtual system process, whi
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<unusual-child-process-from-a-system-virtual-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.pid == 4 and
-not process.executable : ("Registry", "MemCompression",
-"?:\\Windows\\System32\\smss.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.pid == 4 and
+  not process.executable : ("Registry", "MemCompression", "?:\\Windows\\System32\\smss.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,42 +70,3 @@ not process.executable : ("Registry", "MemCompression",
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[unusual-child-process-from-a-system-virtual-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.pid == 4 and not process.executable : ("Registry",
-"MemCompression", "?:\\Windows\\System32\\smss.exe")
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.pid:4 and not process.executable:(Registry or
-MemCompression or "C:\Windows\System32\smss.exe")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
new file mode 100644
index 0000000000..658d856863
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
@@ -0,0 +1,112 @@
+[[unusual-child-process-of-dns-exe]]
+=== Unusual Child Process of dns.exe
+
+Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://github.com/maxpl0it/CVE-2020-1350-DoS
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Unusual Child Process of dns.exe
+
+SIGRed (CVE-2020-1350) is a wormable, critical vulnerability in the Windows DNS server that affects Windows Server versions 2003 to 2019 and can be triggered by a malicious DNS response. Because the service is running in elevated privileges (SYSTEM), an attacker that successfully exploits it is granted Domain Administrator rights. This can effectively compromise the entire corporate infrastructure.
+
+This rule looks for unusual children of the `dns.exe` process, which can indicate the exploitation of the SIGRed or a similar remote code execution vulnerability in the DNS server.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes.
+  - Any suspicious or abnormal child process spawned from dns.exe should be carefully reviewed and investigated. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (`whoami.exe`, `netstat.exe`, `systeminfo.exe`, `tasklist.exe`).
+  - Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be considered. This is not an exhaustive list, but ideal candidates to start out would be: `mshta.exe`, `powershell.exe`, `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `wmic.exe`.
+  - If a denial-of-service (DoS) exploit is successful and DNS Server service crashes, be mindful of potential child processes related to `werfault.exe` occurring.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the host during the past 48 hours.
+- Check whether the server is vulnerable to CVE-2020-1350.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system or restore the compromised server to a clean state.
+- Install the latest patches on systems that run Microsoft DNS Server.
+- Consider the implementation of a patch management system, such as the Windows Server Update Services (WSUS).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.parent.name : "dns.exe" and
+  not process.name : "conhost.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: External Remote Services
+** ID: T1133
+** Reference URL: https://attack.mitre.org/techniques/T1133/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
index 3a8ae4092b..3a87dcc852 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
@@ -5,7 +5,7 @@ Identifies child processes of unusual instances of RunDLL32 where the command li
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,43 +15,44 @@ Identifies child processes of unusual instances of RunDLL32 where the command li
 
 *Risk score*: 73
 
-*Runs every*: 30 minutes
+*Runs every*: 30m
 
 *Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 101 (<<unusual-child-processes-of-rundll32-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence with maxspan=1h [process where event.type == "start" and
-(process.name : "rundll32.exe" or process.pe.original_file_name ==
-"RUNDLL32.EXE") and process.args_count == 1 ] by
-process.entity_id [process where event.type == "start" and
-process.parent.name : "rundll32.exe" ] by process.parent.entity_id
+[source, js]
 ----------------------------------
+sequence with maxspan=1h
+  [process where host.os.type == "windows" and event.type == "start" and
+     (process.name : "rundll32.exe" or process.pe.original_file_name == "RUNDLL32.EXE") and
+      process.args_count == 1
+  ] by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "rundll32.exe"
+  ] by process.parent.entity_id
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -63,43 +64,7 @@ process.parent.name : "rundll32.exe" ] by process.parent.entity_id
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[unusual-child-processes-of-rundll32-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1h [process where event.type in ("start",
-"process_started") and (process.name : "rundll32.exe" or
-process.pe.original_file_name == "RUNDLL32.EXE") and
-process.args_count == 1 ] by process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"rundll32.exe" ] by process.parent.entity_id
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.14.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence with maxspan=1h [process where event.type in ("start",
-"process_started") and /*
-uncomment once in winlogbeat */ (process.name : "rundll32.exe" /*
-or process.pe.original_file_name == "RUNDLL32.EXE" */ ) and
-process.args_count < 2 ] by process.entity_id [process where
-event.type in ("start", "process_started") and process.parent.name :
-"rundll32.exe" ] by process.parent.entity_id
-----------------------------------
-
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc
index a209b33444..7992a4a25d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc
@@ -5,94 +5,75 @@ A machine learning job detected AWS command activity that, while not inherently
 
 *Rule type*: machine_learning
 
-*Machine learning job*: rare_method_for_a_city
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* ML
-* Investigation Guide
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Resources: Investigation Guide
 
-*Version*: 102 (<<unusual-city-for-an-aws-command-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 7.9.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-New or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual City For an AWS Command
 
-CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and
-understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity
-when deviations occur.
+CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
-This rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is
-sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or
-keys used by a threat actor in a different geography than the authorized user(s).
+This rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys used by a threat actor in a different geography than the authorized user(s).
 
-Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation
-of the source IP address.
+Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address.
 
 #### Possible investigation steps
 
 - Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
-    - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
-    `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
+    - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
     - The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Validate the activity is not related to planned patches, updates, or network administrator activity.
 - Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal
-time of day?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False positive analysis
 
 - False positives can occur if activity is coming from new employees based in a city with no previous history in AWS.
-- Examine the history of the command. If the command only manifested recently, it might be part of a new automation
-module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence),
-it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
+- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 
 ### Related Rules
 
@@ -111,47 +92,12 @@ it might be part of a housekeeping or maintenance process. You can find the comm
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-
-
-[[unusual-city-for-an-aws-command-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.16.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc
index 954a35a9f5..5c06d56746 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc
@@ -5,94 +5,75 @@ A machine learning job detected AWS command activity that, while not inherently
 
 *Rule type*: machine_learning
 
-*Machine learning job*: rare_method_for_a_country
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* AWS
-* ML
-* Investigation Guide
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Resources: Investigation Guide
 
-*Version*: 102 (<<unusual-country-for-an-aws-command-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 7.9.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-New or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual Country For an AWS Command
 
-CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and
-understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity
-when deviations occur.
+CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
-This rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is
-sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials
-or keys used by a threat actor in a different geography than the authorized user(s).
+This rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys used by a threat actor in a different geography than the authorized user(s).
 
-Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation
-of the source IP address.
+Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address.
 
 #### Possible investigation steps
 
 - Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
-    - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
-    `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
+    - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
     - The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Validate the activity is not related to planned patches, updates, or network administrator activity.
 - Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
 - Considering the source IP address and geolocation of the user who issued the command:
     - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal
-time of day?
+    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
+    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
+- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
 ### False Positive Analysis
 
 - False positives can occur if activity is coming from new employees based in a country with no previous history in AWS.
-- Examine the history of the command. If the command only manifested recently, it might be part of a new automation
-module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence),
-it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
+- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 
 ### Related Rules
 
@@ -111,53 +92,12 @@ it might be part of a housekeeping or maintenance process. You can find the comm
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
 - Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
-
-
-[[unusual-country-for-an-aws-command-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.2.0 release)::
-* Formatting only
-
-Version 8 (8.1.0 release)::
-* Formatting only
-
-Version 7 (7.16.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-dns-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-dns-activity.asciidoc
index fdd51dd054..27b6745fcc 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-dns-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-dns-activity.asciidoc
@@ -5,47 +5,37 @@ A machine learning job detected a rare and unusual DNS query that indicate netwo
 
 *Rule type*: machine_learning
 
-*Machine learning job*: packetbeat_rare_dns_question
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Network
-* Threat Detection
-* ML
-* Command and Control
+*Tags*: 
 
-*Version*: 100 (<<unusual-dns-activity-history, version history>>)
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert. Network activity that occurs rarely, in small quantities, can trigger this alert. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,22 +47,7 @@ A newly installed program or one that runs rarely as part of a monthly or quarte
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[unusual-dns-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: DNS
+** ID: T1071.004
+** Reference URL: https://attack.mitre.org/techniques/T1071/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index ebe38b6ebf..e53205fa88 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -16,73 +16,67 @@ Identifies an unexpected executable file being created or modified by a Windows
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+*Tags*:
 
-*Version*: 102 (<<unusual-executable-file-creation-by-a-system-critical-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual Executable File Creation by a System Critical Process
 
-Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these
-characteristics is file operations.
+Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is file operations.
 
-This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation
-of a vulnerability or a malicious process masquerading as a system-critical process.
+This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
@@ -97,31 +91,31 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type != "deletion" and file.extension : ("exe",
-"dll") and process.name : ("smss.exe",
-"autochk.exe", "csrss.exe",
-"wininit.exe", "services.exe",
-"lsass.exe", "winlogon.exe",
-"userinit.exe", "LogonUI.exe")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.extension : ("exe", "dll") and
+  process.name : ("smss.exe",
+                  "autochk.exe",
+                  "csrss.exe",
+                  "wininit.exe",
+                  "services.exe",
+                  "lsass.exe",
+                  "winlogon.exe",
+                  "userinit.exe",
+                  "LogonUI.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -133,36 +127,3 @@ file where event.type != "deletion" and file.extension : ("exe",
 ** Name: Exploitation for Defense Evasion
 ** ID: T1211
 ** Reference URL: https://attack.mitre.org/techniques/T1211/
-
-[[unusual-executable-file-creation-by-a-system-critical-process-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and not event.type:deletion and
-file.extension:(exe or dll) and process.name:(smss.exe or autochk.exe
-or csrss.exe or wininit.exe or services.exe or lsass.exe or
-winlogon.exe or userinit.exe or LogonUI.exe)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index 4eedf4bda9..a68f7d0bf7 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -15,85 +15,76 @@ Identifies suspicious creation of Alternate Data Streams on highly targeted file
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
+*Tags*:
 
-*Version*: 102 (<<unusual-file-creation-alternate-data-stream-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 109
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual File Creation - Alternate Data Stream
 
-Alternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are
-built up from a couple of attributes; one of them is $Data, also known as the data attribute.
+Alternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are built up from a couple of attributes; one of them is $Data, also known as the data attribute.
 
-The regular data stream, also referred to as the unnamed data stream since the name string of this attribute is empty,
-contains the data inside the file. So any data stream that has a name is considered an alternate data stream.
+The regular data stream, also referred to as the unnamed data stream since the name string of this attribute is empty, contains the data inside the file. So any data stream that has a name is considered an alternate data stream.
 
-Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the
-creation of alternate data streams on highly targeted file types.
+Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the
-following PowerShell cmdlet to accomplish this:
-  - `Get-Content -file C:\Path\To\file.exe -stream ADSname`
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
+- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:
+  - `Get-Content C:\Path\To\file.exe -stream SampleAlternateDataStreamName`
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
 
-- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination
-of process executable and file conditions.
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process executable and file conditions.
 
 ### Response and remediation
 
@@ -103,51 +94,81 @@ of process executable and file conditions.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "creation" and file.path : "C:\\*:*" and
-not file.path : "C:\\*:zone.identifier*" and not process.executable
-: ("?:\\windows\\System32\\svchost.exe",
-"?:\\Windows\\System32\\inetsrv\\w3wp.exe",
-"?:\\Windows\\explorer.exe",
-"?:\\Windows\\System32\\sihost.exe",
-"?:\\Windows\\System32\\PickerHost.exe",
-"?:\\Windows\\System32\\SearchProtocolHost.exe",
-"?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe",
-"?:\\Program Files\\Rivet
-Networks\\SmartByte\\SmartByteNetworkService.exe",
-"?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
-"?:\\Program Files\\ExpressConnect\\ExpressConnectNetworkService.exe",
-"?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
-"?:\\Program Files\\Mozilla Firefox\\firefox.exe") and
-file.extension : ( "pdf", "dll", "png",
-"exe", "dat", "com", "bat", "cmd",
-"sys", "vbs", "ps1", "hta", "txt",
-"vbe", "js", "wsh", "docx", "doc",
-"xlsx", "xls", "pptx", "ppt", "rtf",
-"gif", "jpg", "png", "bmp", "img", "iso"
-)
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+
+  file.path : "C:\\*:*" and
+  not file.path : "C:\\*:zone.identifier*" and
+
+  not process.executable :
+          ("?:\\windows\\System32\\svchost.exe",
+           "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+           "?:\\Windows\\explorer.exe",
+           "?:\\Windows\\System32\\sihost.exe",
+           "?:\\Windows\\System32\\PickerHost.exe",
+           "?:\\Windows\\System32\\SearchProtocolHost.exe",
+           "?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe",
+           "?:\\Program Files\\Rivet Networks\\SmartByte\\SmartByteNetworkService.exe",
+           "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+           "?:\\Program Files\\ExpressConnect\\ExpressConnectNetworkService.exe",
+           "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+           "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+           "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
+           "?:\\Program Files(x86)\\Microsoft Office\\root\\*\\EXCEL.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\EXCEL.EXE",
+           "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
+           "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\POWERPNT.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\POWERPNT.EXE",
+           "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\WINWORD.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\WINWORD.EXE") and
+
+  file.extension :
+    (
+      "pdf",
+      "dll",
+      "png",
+      "exe",
+      "dat",
+      "com",
+      "bat",
+      "cmd",
+      "sys",
+      "vbs",
+      "ps1",
+      "hta",
+      "txt",
+      "vbe",
+      "js",
+      "wsh",
+      "docx",
+      "doc",
+      "xlsx",
+      "xls",
+      "pptx",
+      "ppt",
+      "rtf",
+      "gif",
+      "jpg",
+      "png",
+      "bmp",
+      "img",
+      "iso"
+    )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -159,31 +180,7 @@ file.extension : ( "pdf", "dll", "png",
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-[[unusual-file-creation-alternate-data-stream-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "creation" and file.path : "C:\\*:*" and
-not file.path : "C:\\*:zone.identifier*" and file.extension : (
-"pdf", "dll", "png", "exe", "dat",
-"com", "bat", "cmd", "sys", "vbs",
-"ps1", "hta", "txt", "vbe", "js", "wsh",
-"docx", "doc", "xlsx", "xls", "pptx",
-"ppt", "rtf", "gif", "jpg", "png",
-"bmp", "img", "iso" )
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: NTFS File Attributes
+** ID: T1564.004
+** Reference URL: https://attack.mitre.org/techniques/T1564/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
new file mode 100644
index 0000000000..ae1c4ba2ea
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
@@ -0,0 +1,82 @@
+[[unusual-file-modification-by-dns-exe]]
+=== Unusual File Modification by dns.exe
+
+Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Unusual File Write
+Detection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:
+- Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.
+- Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and process.name : "dns.exe" and event.type in ("creation", "deletion", "change") and
+  not file.name : "dns.log" and not
+  (file.extension : ("old", "temp", "bak", "dns", "arpa") and file.path : "C:\\Windows\\System32\\dns\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: External Remote Services
+** ID: T1133
+** Reference URL: https://attack.mitre.org/techniques/T1133/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc
index 1b3e3f7a3f..334f11566b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc
@@ -5,47 +5,69 @@ A machine learning job detected a user logging in at a time of day that is unusu
 
 *Rule type*: machine_learning
 
-*Machine learning job*: auth_rare_hour_for_a_user
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 103
+
+*Rule authors*: 
 
 * Elastic
-* Authentication
-* Threat Detection
-* ML
-* Initial Access
 
-*Version*: 100 (<<unusual-hour-for-a-user-to-logon-history, version history>>)
+*Rule license*: Elastic License v2
 
-*Added ({stack} release)*: 7.14.0
 
-*Last modified ({stack} release)*: 8.5.0
+==== Investigation guide
 
-*Rule authors*: Elastic
 
-*Rule license*: Elastic License v2
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Unusual Hour for a User to Logon
+
+This rule uses a machine learning job to detect a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. It can also indicate unauthorized user activity, as it often occurs during non-business hours.
 
-==== Potential false positives
+#### Possible investigation steps
 
-Users working late, or logging in from unusual time zones while traveling, may trigger this rule.
-==== Threat mapping
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, network connections, data access, and logon events.
+- Investigate other alerts associated with the involved users during the past 48 hours.
+
+### False positive analysis
+
+- Users may need to log in during non-business hours to perform work-related tasks. Examine whether the company policies authorize this or if the activity is done under change management.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,13 +79,3 @@ Users working late, or logging in from unusual time zones while traveling, may t
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[unusual-hour-for-a-user-to-logon-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc
index 42c39cefbf..e2e775766e 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc
@@ -5,47 +5,43 @@ Identifies Linux processes that do not usually use the network but have unexpect
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_anomalous_network_activity
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-network-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -57,29 +53,3 @@ Detection alerts from this rule indicate the presence of network activity from a
 - Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business or maintenance process.
 - Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
 ----------------------------------
-
-
-[[unusual-linux-network-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.3.0 release)::
-* Formatting only
-
-Version 6 (7.15.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-configuration-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-configuration-discovery.asciidoc
new file mode 100644
index 0000000000..9563aa6faa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-configuration-discovery.asciidoc
@@ -0,0 +1,49 @@
+[[unusual-linux-network-configuration-discovery]]
+=== Unusual Linux Network Configuration Discovery
+
+Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Discovery
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-connection-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-connection-discovery.asciidoc
index ea74288113..d37e8b6205 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-connection-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-connection-discovery.asciidoc
@@ -5,43 +5,37 @@ Looks for commands related to system network connection discovery from an unusua
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_network_connection_discovery
-
-*Machine learning anomaly threshold*: 25
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-network-connection-discovery-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -53,16 +47,3 @@ Uncommon user command activity can be due to an engineer logging onto a server i
 ** Name: System Network Connections Discovery
 ** ID: T1049
 ** Reference URL: https://attack.mitre.org/techniques/T1049/
-
-[[unusual-linux-network-connection-discovery-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-port-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-port-activity.asciidoc
index 526cdd6204..3f2edab123 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-port-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-port-activity.asciidoc
@@ -5,65 +5,35 @@ Identifies unusual destination port activity that can indicate command-and-contr
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_anomalous_network_port_activity
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-network-port-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that rarely uses the network could trigger this alert.
-
-[[unusual-linux-network-port-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-calling-the-metadata-service.asciidoc
index 01978c35ef..a6b16090da 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-calling-the-metadata-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-calling-the-metadata-service.asciidoc
@@ -5,44 +5,37 @@ Looks for anomalous access to the metadata service by an unusual process. The me
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_rare_metadata_process
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-process-calling-the-metadata-service-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this detection rule.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -54,22 +47,7 @@ A newly installed program or one that runs very rarely as part of a monthly or q
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-[[unusual-linux-process-calling-the-metadata-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (7.14.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Instance Metadata API
+** ID: T1552.005
+** Reference URL: https://attack.mitre.org/techniques/T1552/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-discovery-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-discovery-activity.asciidoc
index a336620445..df06d650ea 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-discovery-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-process-discovery-activity.asciidoc
@@ -5,43 +5,37 @@ Looks for commands related to system process discovery from an unusual user cont
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_system_process_discovery
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-process-discovery-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -53,16 +47,3 @@ Uncommon user command activity can be due to an engineer logging onto a server i
 ** Name: Process Discovery
 ** ID: T1057
 ** Reference URL: https://attack.mitre.org/techniques/T1057/
-
-[[unusual-linux-process-discovery-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-information-discovery-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-information-discovery-activity.asciidoc
index 7265d972c8..ec4c8a85fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-information-discovery-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-information-discovery-activity.asciidoc
@@ -5,43 +5,37 @@ Looks for commands related to system information discovery from an unusual user
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_system_information_discovery
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-system-information-discovery-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -53,16 +47,3 @@ Uncommon user command activity can be due to an engineer logging onto a server i
 ** Name: System Information Discovery
 ** ID: T1082
 ** Reference URL: https://attack.mitre.org/techniques/T1082/
-
-[[unusual-linux-system-information-discovery-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-calling-the-metadata-service.asciidoc
index 2a9c36eb3f..ae99963a1a 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-calling-the-metadata-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-calling-the-metadata-service.asciidoc
@@ -5,44 +5,37 @@ Looks for anomalous access to the cloud platform metadata service by an unusual
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_rare_metadata_user
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<unusual-linux-user-calling-the-metadata-service-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program, or one that runs under a new or rarely used user context, could trigger this detection rule. Manual interrogation of the metadata service during debugging or troubleshooting could trigger this rule.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -54,22 +47,7 @@ A newly installed program, or one that runs under a new or rarely used user cont
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-[[unusual-linux-user-calling-the-metadata-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (7.14.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Instance Metadata API
+** ID: T1552.005
+** Reference URL: https://attack.mitre.org/techniques/T1552/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-discovery-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-discovery-activity.asciidoc
new file mode 100644
index 0000000000..db6828aed6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-user-discovery-activity.asciidoc
@@ -0,0 +1,49 @@
+[[unusual-linux-user-discovery-activity]]
+=== Unusual Linux User Discovery Activity
+
+Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery in order to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping or privilege elevation activity.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Discovery
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Owner/User Discovery
+** ID: T1033
+** Reference URL: https://attack.mitre.org/techniques/T1033/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc
index b6edb1735a..ee56ead4ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc
@@ -5,52 +5,44 @@ A machine learning job detected activity for a username that is not normally act
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_anomalous_user_name
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-* Initial Access
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Initial Access
 
-*Version*: 100 (<<unusual-linux-username-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.7.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -61,8 +53,6 @@ Detection alerts from this rule indicate activity for a Linux user name that is
 - Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.
 ----------------------------------
 
-==== Threat mapping
-
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
@@ -73,34 +63,3 @@ Detection alerts from this rule indicate activity for a Linux user name that is
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[unusual-linux-username-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-login-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-login-activity.asciidoc
index d9240e028a..2db78a6dc4 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-login-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-login-activity.asciidoc
@@ -5,47 +5,38 @@ Identifies an unusually high number of authentication attempts.
 
 *Rule type*: machine_learning
 
-*Machine learning job*: suspicious_login_activity
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Authentication
-* Threat Detection
-* ML
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<unusual-login-activity-history, version history>>)
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Security audits may trigger this alert. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,25 +48,3 @@ Security audits may trigger this alert. Conditions that generate bursts of faile
 ** Name: Brute Force
 ** ID: T1110
 ** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[unusual-login-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index 2ca6554ee2..e82a5f6cef 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -15,64 +15,150 @@ Identifies network activity from unexpected system applications. This may indica
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
+*References*: None
+
 *Tags*:
 
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 106
+
+*Rule authors*:
+
 * Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
 
-*Version*: 101 (<<unusual-network-activity-from-a-windows-system-binary-history, version history>>)
+*Rule license*: Elastic License v2
+
 
-*Added ({stack} release)*: 7.10.0
+==== Investigation guide
 
-*Last modified ({stack} release)*: 8.5.0
 
-*Rule authors*: Elastic
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Unusual Network Activity from a Windows System Binary
+
+Attackers can abuse certain trusted developer utilities to proxy the execution of malicious payloads. Since these utilities are usually signed, they can bypass the security controls that were put in place to prevent or detect direct execution.
+
+This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- As trusted developer utilities have dual-use purposes, alerts derived from this rule are not essentially malicious. If these utilities are contacting internal or known trusted domains, review their security and consider creating exceptions if the domain is safe.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-*Rule license*: Elastic License v2
+----------------------------------
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id with maxspan=5m [process where
-event.type == "start" and /* known applocker bypasses */
-(process.name : "bginfo.exe" or process.name : "cdb.exe" or
-process.name : "control.exe" or process.name : "cmstp.exe" or
-process.name : "csi.exe" or process.name : "dnx.exe" or
-process.name : "fsi.exe" or process.name : "ieexec.exe" or
-process.name : "iexpress.exe" or process.name :
-"installutil.exe" or process.name :
-"Microsoft.Workflow.Compiler.exe" or process.name :
-"MSBuild.exe" or process.name : "msdt.exe" or process.name
-: "mshta.exe" or process.name : "msiexec.exe" or
-process.name : "msxsl.exe" or process.name : "odbcconf.exe" or
-process.name : "rcsi.exe" or process.name : "regsvr32.exe" or
-process.name : "xwizard.exe")] [network where (process.name :
-"bginfo.exe" or process.name : "cdb.exe" or process.name :
-"control.exe" or process.name : "cmstp.exe" or
-process.name : "csi.exe" or process.name : "dnx.exe" or
-process.name : "fsi.exe" or process.name : "ieexec.exe" or
-process.name : "iexpress.exe" or process.name :
-"installutil.exe" or process.name :
-"Microsoft.Workflow.Compiler.exe" or process.name :
-"MSBuild.exe" or process.name : "msdt.exe" or process.name
-: "mshta.exe" or process.name : "msiexec.exe" or
-process.name : "msxsl.exe" or process.name : "odbcconf.exe" or
-process.name : "rcsi.exe" or process.name : "regsvr32.exe" or
-process.name : "xwizard.exe")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id with maxspan=5m
+  [process where host.os.type == "windows" and event.type == "start" and
+
+     /* known applocker bypasses */
+     (process.name : "bginfo.exe" or
+      process.name : "cdb.exe" or
+      process.name : "control.exe" or
+      process.name : "cmstp.exe" or
+      process.name : "csi.exe" or
+      process.name : "dnx.exe" or
+      process.name : "fsi.exe" or
+      process.name : "ieexec.exe" or
+      process.name : "iexpress.exe" or
+      process.name : "installutil.exe" or
+      process.name : "Microsoft.Workflow.Compiler.exe" or
+      process.name : "MSBuild.exe" or
+      process.name : "msdt.exe" or
+      process.name : "mshta.exe" or
+      process.name : "msiexec.exe" or
+      process.name : "msxsl.exe" or
+      process.name : "odbcconf.exe" or
+      process.name : "rcsi.exe" or
+      process.name : "regsvr32.exe" or
+      process.name : "xwizard.exe")]
+  [network where
+     (process.name : "bginfo.exe" or
+      process.name : "cdb.exe" or
+      process.name : "control.exe" or
+      process.name : "cmstp.exe" or
+      process.name : "csi.exe" or
+      process.name : "dnx.exe" or
+      process.name : "fsi.exe" or
+      process.name : "ieexec.exe" or
+      process.name : "iexpress.exe" or
+      process.name : "installutil.exe" or
+      process.name : "Microsoft.Workflow.Compiler.exe" or
+      process.name : "MSBuild.exe" or
+      process.name : "msdt.exe" or
+      process.name : "mshta.exe" or
+      (
+         process.name : "msiexec.exe" and not
+         dns.question.name : (
+            "ocsp.digicert.com", "ocsp.verisign.com", "ocsp.comodoca.com", "ocsp.entrust.net", "ocsp.usertrust.com",
+            "ocsp.godaddy.com", "ocsp.camerfirma.com", "ocsp.globalsign.com", "ocsp.sectigo.com", "*.local"
+         )
+      ) or
+      process.name : "msxsl.exe" or
+      process.name : "odbcconf.exe" or
+      process.name : "rcsi.exe" or
+      process.name : "regsvr32.exe" or
+      process.name : "xwizard.exe")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -84,46 +170,3 @@ process.name : "xwizard.exe")]
 ** Name: Trusted Developer Utilities Proxy Execution
 ** ID: T1127
 ** Reference URL: https://attack.mitre.org/techniques/T1127/
-
-[[unusual-network-activity-from-a-windows-system-binary-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id with maxspan=5m [process where
-event.type in ("start", "process_started") and /* known
-applocker bypasses */ (process.name : "bginfo.exe" or
-process.name : "cdb.exe" or process.name : "control.exe" or
-process.name : "cmstp.exe" or process.name : "csi.exe" or
-process.name : "dnx.exe" or process.name : "fsi.exe" or
-process.name : "ieexec.exe" or process.name : "iexpress.exe" or
-process.name : "installutil.exe" or process.name :
-"Microsoft.Workflow.Compiler.exe" or process.name :
-"MSBuild.exe" or process.name : "msdt.exe" or process.name
-: "mshta.exe" or process.name : "msiexec.exe" or
-process.name : "msxsl.exe" or process.name : "odbcconf.exe" or
-process.name : "rcsi.exe" or process.name : "regsvr32.exe" or
-process.name : "xwizard.exe")] [network where (process.name :
-"bginfo.exe" or process.name : "cdb.exe" or process.name :
-"control.exe" or process.name : "cmstp.exe" or
-process.name : "csi.exe" or process.name : "dnx.exe" or
-process.name : "fsi.exe" or process.name : "ieexec.exe" or
-process.name : "iexpress.exe" or process.name :
-"installutil.exe" or process.name :
-"Microsoft.Workflow.Compiler.exe" or process.name :
-"MSBuild.exe" or process.name : "msdt.exe" or process.name
-: "mshta.exe" or process.name : "msiexec.exe" or
-process.name : "msxsl.exe" or process.name : "odbcconf.exe" or
-process.name : "rcsi.exe" or process.name : "regsvr32.exe" or
-process.name : "xwizard.exe")]
-----------------------------------
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-dllhost.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-dllhost.asciidoc
index 75d8a6ce18..641686e994 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-dllhost.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-dllhost.asciidoc
@@ -5,7 +5,7 @@ Identifies unusual instances of dllhost.exe making outbound network connections.
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,55 +15,49 @@ Identifies unusual instances of dllhost.exe making outbound network connections.
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
 * https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-
-*Version*: 101 (<<unusual-network-connection-via-dllhost-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=1m [process
-where event.type == "start" and process.name : "dllhost.exe" and
-process.args_count == 1] [network where process.name : "dllhost.exe"
-and not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
-"169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
-"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
-"192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
-"192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
-"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
-"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-"FE80::/10", "FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id with maxspan=1m
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "dllhost.exe" and process.args_count == 1]
+  [network where host.os.type == "windows" and process.name : "dllhost.exe" and
+   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+    "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
+    "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
+    "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
+    "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,31 +69,3 @@ and not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8",
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[unusual-network-connection-via-dllhost-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=1m [process
-where event.type in ("start", "process_started") and process.name :
-"dllhost.exe" and process.args_count == 1] [network where
-process.name : "dllhost.exe" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
-"192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
-"192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc
index 05ae58a9b9..c4e964413c 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc
@@ -5,7 +5,7 @@ Identifies unusual instances of rundll32.exe making outbound network connections
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,56 +15,51 @@ Identifies unusual instances of rundll32.exe making outbound network connections
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 * https://redcanary.com/threat-detection-report/techniques/rundll32/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-
-*Version*: 102 (<<unusual-network-connection-via-rundll32-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Command and Control
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual Network Connection via RunDLL32
 
-RunDLL32 is a built-in Windows utility and also a vital component used by the operating system itself. The functionality
-provided by RunDLL32 to execute Dynamic Link Libraries (DLLs) is widely abused by attackers, because it makes it hard to
-differentiate malicious activity from normal operations.
+RunDLL32 is a built-in Windows utility and also a vital component used by the operating system itself. The functionality provided by RunDLL32 to execute Dynamic Link Libraries (DLLs) is widely abused by attackers, because it makes it hard to differentiate malicious activity from normal operations.
 
-This rule looks for external network connections established using RunDLL32 when the utility is being executed with no
-arguments, which can potentially indicate command and control activity.
+This rule looks for external network connections established using RunDLL32 when the utility is being executed with no arguments, which can potentially indicate command and control activity.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the target host that RunDLL32 is communicating with.
   - Check if the domain is newly registered or unexpected.
@@ -80,39 +75,29 @@ for prevalence, whether they are located in expected locations, and if they are
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=1m [process
-where event.type == "start" and process.name : "rundll32.exe" and
-process.args_count == 1] [network where process.name :
-"rundll32.exe" and not cidrmatch(destination.ip, "10.0.0.0/8",
-"127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
-"192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16",
-"192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
-"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8")]
+[source, js]
 ----------------------------------
+sequence by host.id, process.entity_id with maxspan=1m
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "rundll32.exe" and process.args_count == 1]
+  [network where host.os.type == "windows" and process.name : "rundll32.exe" and
+   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+       "FE80::/10", "FF00::/8")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -124,115 +109,19 @@ process.args_count == 1] [network where process.name :
 ** Name: System Binary Proxy Execution
 ** ID: T1218
 ** Reference URL: https://attack.mitre.org/techniques/T1218/
-
-[[unusual-network-connection-via-rundll32-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=1m [process
-where event.type in ("start", "process_started") and process.name :
-"rundll32.exe" and process.args_count == 1] [network where
-process.name : "rundll32.exe" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
-"192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
-"192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
-"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
-"192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
-"100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24",
-"203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
-"FF00::/8")]
-----------------------------------
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=1m [process
-where event.type in ("start", "process_started") and process.name :
-"rundll32.exe" and process.args_count == 1] [network where
-process.name : "rundll32.exe" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8",
-"FE80::/10", "::1/128")]
-----------------------------------
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id, process.entity_id with maxspan=1m [process
-where event.type in ("start", "process_started", "info") and
-process.name : "rundll32.exe" and process.args_count == 1] [network
-where process.name : "rundll32.exe" and network.protocol != "dns" and
-network.direction == "outgoing" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")]
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by process.entity_id [process where process.name :
-"rundll32.exe" and event.type == "start"] [network where
-process.name : "rundll32.exe" and not cidrmatch(destination.ip,
-"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")]
-----------------------------------
-
-Version 6 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:rundll32.exe and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16 or 127.0.0.0/8)
-----------------------------------
-
-Version 5 (7.9.1 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:rundll32.exe and event.action:"Network connection
-detected (rule: NetworkConnect)" and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16 or 127.0.0.0/8)
-----------------------------------
-
-Version 3 (7.8.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:rundll32.exe and event.action:"Network connection
-detected (rule: NetworkConnect)" and not destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:rundll32.exe and event.action:"Network connection
-detected (rule: NetworkConnect)" and not destination.ip:10.0.0.0/8 and
-not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16
-----------------------------------
-
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-destination-domain-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-destination-domain-name.asciidoc
index 7237d6eb71..8799b879d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-destination-domain-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-destination-domain-name.asciidoc
@@ -5,58 +5,33 @@ A machine learning job detected an unusual network destination domain name. This
 
 *Rule type*: machine_learning
 
-*Machine learning job*: packetbeat_rare_server_domain
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Network
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-network-destination-domain-name-history, version history>>)
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Web activity that occurs rarely in small quantities can trigger this alert. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this alert when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these.
-
-[[unusual-network-destination-domain-name-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index 16e51ebf62..4e4c56b488 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -10,12 +10,13 @@ Identifies Windows programs run from unexpected parent processes. This could ind
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -28,64 +29,57 @@ Identifies Windows programs run from unexpected parent processes. This could ind
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-* Investigation Guide
-
-*Version*: 102 (<<unusual-parent-child-relationship-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual Parent-Child Relationship
 
-Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these
-characteristics is parent-child relationships. These relationships can be used to baseline the typical behavior of the
-system and then alert on occurrences that don't comply with the baseline.
+Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is parent-child relationships. These relationships can be used to baseline the typical behavior of the system and then alert on occurrences that don't comply with the baseline.
 
 This rule uses this information to spot suspicious parent and child processes.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the host for derived artifacts that indicates suspicious activities:
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the process executable using a private sandboxed analysis system.
   - Observe and collect information about the following activities in both the sandbox and the alert subject host:
     - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
       - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
     - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
 ### False positive analysis
@@ -100,69 +94,50 @@ and any spawned child processes.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name != null
-and ( /* suspicious parent processes */
-(process.name:"autochk.exe" and not process.parent.name:"smss.exe") or
-(process.name:("fontdrvhost.exe", "dwm.exe") and not
-process.parent.name:("wininit.exe", "winlogon.exe")) or
-(process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and
-not process.parent.name:"svchost.exe") or
-(process.name:"SearchIndexer.exe" and not
-process.parent.name:"services.exe") or
-(process.name:"SearchProtocolHost.exe" and not
-process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or
-(process.name:"dllhost.exe" and not
-process.parent.name:("services.exe", "svchost.exe")) or
-(process.name:"smss.exe" and not process.parent.name:("System",
-"smss.exe")) or (process.name:"csrss.exe" and not
-process.parent.name:("smss.exe", "svchost.exe")) or
-(process.name:"wininit.exe" and not process.parent.name:"smss.exe") or
-(process.name:"winlogon.exe" and not process.parent.name:"smss.exe")
-or (process.name:("lsass.exe", "LsaIso.exe") and not
-process.parent.name:"wininit.exe") or (process.name:"LogonUI.exe"
-and not process.parent.name:("wininit.exe", "winlogon.exe")) or
-(process.name:"services.exe" and not
-process.parent.name:"wininit.exe") or (process.name:"svchost.exe"
-and not process.parent.name:("MsMpEng.exe", "services.exe")) or
-(process.name:"spoolsv.exe" and not
-process.parent.name:"services.exe") or (process.name:"taskhost.exe"
-and not process.parent.name:("services.exe", "svchost.exe")) or
-(process.name:"taskhostw.exe" and not
-process.parent.name:("services.exe", "svchost.exe")) or
-(process.name:"userinit.exe" and not process.parent.name:("dwm.exe",
-"winlogon.exe")) or (process.name:("wmiprvse.exe",
-"wsmprovhost.exe", "winrshost.exe") and not
-process.parent.name:"svchost.exe") or /* suspicious child processes
-*/ (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe",
-"csrss.exe") and not process.name:("werfault.exe", "wermgr.exe",
-"WerFaultSecure.exe")) or (process.parent.name:"autochk.exe" and
-not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or
-(process.parent.name:"smss.exe" and not process.name:("autochk.exe",
-"smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe",
-"WerFault.exe")) or (process.parent.name:"wermgr.exe" and not
-process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or
-(process.parent.name:"conhost.exe" and not
-process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe",
-"WerFaultSecure.exe")) )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+process.parent.name != null and
+ (
+   /* suspicious parent processes */
+   (process.name:"autochk.exe" and not process.parent.name:"smss.exe") or
+   (process.name:("fontdrvhost.exe", "dwm.exe") and not process.parent.name:("wininit.exe", "winlogon.exe")) or
+   (process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and not process.parent.name:"svchost.exe") or
+   (process.name:"SearchIndexer.exe" and not process.parent.name:"services.exe") or
+   (process.name:"SearchProtocolHost.exe" and not process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or
+   (process.name:"dllhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
+   (process.name:"smss.exe" and not process.parent.name:("System", "smss.exe")) or
+   (process.name:"csrss.exe" and not process.parent.name:("smss.exe", "svchost.exe")) or
+   (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or
+   (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or
+   (process.name:("lsass.exe", "LsaIso.exe") and not process.parent.name:"wininit.exe") or
+   (process.name:"LogonUI.exe" and not process.parent.name:("wininit.exe", "winlogon.exe")) or
+   (process.name:"services.exe" and not process.parent.name:"wininit.exe") or
+   (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe")) or
+   (process.name:"spoolsv.exe" and not process.parent.name:"services.exe") or
+   (process.name:"taskhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
+   (process.name:"taskhostw.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
+   (process.name:"userinit.exe" and not process.parent.name:("dwm.exe", "winlogon.exe")) or
+   (process.name:("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") and not process.parent.name:"svchost.exe") or
+   /* suspicious child processes */
+   (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe")) or
+   (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or
+   (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe")) or
+   (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or
+   (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe"))
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -174,196 +149,7 @@ process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe",
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[unusual-parent-child-relationship-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name != null and ( /* suspicious parent processes
-*/ (process.name:"autochk.exe" and not
-process.parent.name:"smss.exe") or
-(process.name:("fontdrvhost.exe", "dwm.exe") and not
-process.parent.name:("wininit.exe", "winlogon.exe")) or
-(process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and
-not process.parent.name:"svchost.exe") or
-(process.name:"SearchIndexer.exe" and not
-process.parent.name:"services.exe") or
-(process.name:"SearchProtocolHost.exe" and not
-process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or
-(process.name:"dllhost.exe" and not
-process.parent.name:("services.exe", "svchost.exe")) or
-(process.name:"smss.exe" and not process.parent.name:("System",
-"smss.exe")) or (process.name:"csrss.exe" and not
-process.parent.name:("smss.exe", "svchost.exe")) or
-(process.name:"wininit.exe" and not process.parent.name:"smss.exe") or
-(process.name:"winlogon.exe" and not process.parent.name:"smss.exe")
-or (process.name:("lsass.exe", "LsaIso.exe") and not
-process.parent.name:"wininit.exe") or (process.name:"LogonUI.exe"
-and not process.parent.name:("wininit.exe", "winlogon.exe")) or
-(process.name:"services.exe" and not
-process.parent.name:"wininit.exe") or (process.name:"svchost.exe"
-and not process.parent.name:("MsMpEng.exe", "services.exe")) or
-(process.name:"spoolsv.exe" and not
-process.parent.name:"services.exe") or (process.name:"taskhost.exe"
-and not process.parent.name:("services.exe", "svchost.exe")) or
-(process.name:"taskhostw.exe" and not
-process.parent.name:("services.exe", "svchost.exe")) or
-(process.name:"userinit.exe" and not process.parent.name:("dwm.exe",
-"winlogon.exe")) or (process.name:("wmiprvse.exe",
-"wsmprovhost.exe", "winrshost.exe") and not
-process.parent.name:"svchost.exe") or /* suspicious child processes
-*/ (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe",
-"csrss.exe") and not process.name:("werfault.exe", "wermgr.exe",
-"WerFaultSecure.exe")) or (process.parent.name:"autochk.exe" and
-not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or
-(process.parent.name:"smss.exe" and not process.name:("autochk.exe",
-"smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe",
-"WerFault.exe")) or (process.parent.name:"wermgr.exe" and not
-process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or
-(process.parent.name:"conhost.exe" and not
-process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe",
-"WerFaultSecure.exe")) )
-----------------------------------
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Formatting only
-
-Version 9 (7.15.0 release)::
-* Formatting only
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.executable:* and (process.parent.name:autochk.exe and
-not process.name:(chkdsk.exe or doskey.exe or WerFault.exe) or
-process.parent.name:smss.exe and not process.name:(autochk.exe or
-smss.exe or csrss.exe or wininit.exe or winlogon.exe or WerFault.exe)
-or process.name:autochk.exe and not process.parent.name:smss.exe or
-process.name:(fontdrvhost.exe or dwm.exe) and not
-process.parent.name:(wininit.exe or winlogon.exe) or
-process.name:(consent.exe or RuntimeBroker.exe or TiWorker.exe) and
-not process.parent.name:svchost.exe or process.name:wermgr.exe and not
-process.parent.name:(svchost.exe or TiWorker.exe) or
-process.name:SearchIndexer.exe and not
-process.parent.name:services.exe or
-process.name:SearchProtocolHost.exe and not
-process.parent.name:(SearchIndexer.exe or dllhost.exe) or
-process.name:dllhost.exe and not process.parent.name:(services.exe or
-svchost.exe) or process.name:smss.exe and not
-process.parent.name:(System or smss.exe) or process.name:csrss.exe and
-not process.parent.name:(smss.exe or svchost.exe) or
-process.name:wininit.exe and not process.parent.name:smss.exe or
-process.name:winlogon.exe and not process.parent.name:smss.exe or
-process.name:(lsass.exe or LsaIso.exe) and not
-process.parent.name:wininit.exe or process.name:LogonUI.exe and not
-process.parent.name:(wininit.exe or winlogon.exe) or
-process.name:services.exe and not process.parent.name:wininit.exe or
-process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or
-services.exe) or process.name:spoolsv.exe and not
-process.parent.name:services.exe or process.name:taskhost.exe and not
-process.parent.name:(services.exe or svchost.exe) or
-process.name:taskhostw.exe and not process.parent.name:(services.exe
-or svchost.exe) or process.name:userinit.exe and not
-process.parent.name:(dwm.exe or winlogon.exe))
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.executable:* and (process.name:smss.exe and not
-process.parent.name:(System or smss.exe) or process.name:csrss.exe and
-not process.parent.name:(smss.exe or svchost.exe) or
-process.name:wininit.exe and not process.parent.name:smss.exe or
-process.name:winlogon.exe and not process.parent.name:smss.exe or
-process.name:lsass.exe and not process.parent.name:wininit.exe or
-process.name:LogonUI.exe and not process.parent.name:(wininit.exe or
-winlogon.exe) or process.name:services.exe and not
-process.parent.name:wininit.exe or process.name:svchost.exe and not
-process.parent.name:(MsMpEng.exe or services.exe) or
-process.name:spoolsv.exe and not process.parent.name:services.exe or
-process.name:taskhost.exe and not process.parent.name:(services.exe or
-svchost.exe) or process.name:taskhostw.exe and not
-process.parent.name:(services.exe or svchost.exe) or
-process.name:userinit.exe and not process.parent.name:(dwm.exe or
-winlogon.exe))
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.executable:* and (process.name:smss.exe and not
-process.parent.name:(System or smss.exe) or process.name:csrss.exe and
-not process.parent.name:(smss.exe or svchost.exe) or
-process.name:wininit.exe and not process.parent.name:smss.exe or
-process.name:winlogon.exe and not process.parent.name:smss.exe or
-process.name:lsass.exe and not process.parent.name:wininit.exe or
-process.name:LogonUI.exe and not process.parent.name:(wininit.exe or
-winlogon.exe) or process.name:services.exe and not
-process.parent.name:wininit.exe or process.name:svchost.exe and not
-process.parent.name:(MsMpEng.exe or services.exe) or
-process.name:spoolsv.exe and not process.parent.name:services.exe or
-process.name:taskhost.exe and not process.parent.name:(services.exe or
-svchost.exe) or process.name:taskhostw.exe and not
-process.parent.name:(services.exe or svchost.exe) or
-process.name:userinit.exe and not process.parent.name:(dwm.exe or
-winlogon.exe))
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.executable:* and ( (process.name:"smss.exe" and not
-process.parent.name:("System" or "smss.exe")) or
-(process.name:"csrss.exe" and not process.parent.name:("smss.exe" or
-"svchost.exe")) or (process.name:"wininit.exe" and not
-process.parent.name:"smss.exe") or (process.name:"winlogon.exe" and
-not process.parent.name:"smss.exe") or (process.name:"lsass.exe" and
-not process.parent.name:"wininit.exe") or (process.name:"LogonUI.exe"
-and not process.parent.name:("winlogon.exe" or "wininit.exe")) or
-(process.name:"services.exe" and not
-process.parent.name:"wininit.exe") or (process.name:"svchost.exe" and
-not process.parent.name:("services.exe" or "MsMpEng.exe")) or
-(process.name:"spoolsv.exe" and not
-process.parent.name:"services.exe") or (process.name:"taskhost.exe"
-and not process.parent.name:("services.exe" or "svchost.exe")) or
-(process.name:"taskhostw.exe" and not
-process.parent.name:("services.exe" or "svchost.exe")) or
-(process.name:"userinit.exe" and not process.parent.name:("dwm.exe" or
-"winlogon.exe")) )
-----------------------------------
-
+* Sub-technique:
+** Name: Process Hollowing
+** ID: T1055.012
+** Reference URL: https://attack.mitre.org/techniques/T1055/012/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
new file mode 100644
index 0000000000..087cd8e2b6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
@@ -0,0 +1,95 @@
+[[unusual-parent-process-for-cmd-exe]]
+=== Unusual Parent Process for cmd.exe
+
+Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "cmd.exe" and
+  process.parent.name : ("lsass.exe",
+                         "csrss.exe",
+                         "epad.exe",
+                         "regsvr32.exe",
+                         "dllhost.exe",
+                         "LogonUI.exe",
+                         "wermgr.exe",
+                         "spoolsv.exe",
+                         "jucheck.exe",
+                         "jusched.exe",
+                         "ctfmon.exe",
+                         "taskhostw.exe",
+                         "GoogleUpdate.exe",
+                         "sppsvc.exe",
+                         "sihost.exe",
+                         "slui.exe",
+                         "SIHClient.exe",
+                         "SearchIndexer.exe",
+                         "SearchProtocolHost.exe",
+                         "FlashPlayerUpdateService.exe",
+                         "WerFault.exe",
+                         "WUDFHost.exe",
+                         "unsecapp.exe",
+                         "wlanext.exe" )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc
index 2cbf39ea65..6db4622891 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc
@@ -5,62 +5,68 @@ Identifies processes modifying the services registry key directly, instead of th
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<unusual-persistence-via-services-registry-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where registry.path :
-("HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL",
-"HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath") and not
-registry.data.strings : ("?:\\windows\\system32\\Drivers\\*.sys",
-"\\SystemRoot\\System32\\drivers\\*.sys",
-"\\??\\?:\\Windows\\system32\\Drivers\\*.SYS",
-"system32\\DRIVERS\\USBSTOR") and not (process.name :
-"procexp??.exe" and registry.data.strings : "?:\\*\\procexp*.sys") and
-not process.executable : ("?:\\Program Files\\*.exe",
-"?:\\Program Files (x86)\\*.exe",
-"?:\\Windows\\System32\\svchost.exe",
-"?:\\Windows\\winsxs\\*\\TiWorker.exe",
-"?:\\Windows\\System32\\drvinst.exe",
-"?:\\Windows\\System32\\services.exe",
-"?:\\Windows\\System32\\msiexec.exe",
-"?:\\Windows\\System32\\regsvr32.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and
+  registry.path : (
+      "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL",
+      "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath"
+  ) and not registry.data.strings : (
+      "?:\\windows\\system32\\Drivers\\*.sys",
+      "\\SystemRoot\\System32\\drivers\\*.sys",
+      "\\??\\?:\\Windows\\system32\\Drivers\\*.SYS",
+      "system32\\DRIVERS\\USBSTOR") and
+  not (process.name : "procexp??.exe" and registry.data.strings : "?:\\*\\procexp*.sys") and
+  not process.executable : (
+      "?:\\Program Files\\*.exe",
+      "?:\\Program Files (x86)\\*.exe",
+      "?:\\Windows\\System32\\svchost.exe",
+      "?:\\Windows\\winsxs\\*\\TiWorker.exe",
+      "?:\\Windows\\System32\\drvinst.exe",
+      "?:\\Windows\\System32\\services.exe",
+      "?:\\Windows\\System32\\msiexec.exe",
+      "?:\\Windows\\System32\\regsvr32.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,43 +78,7 @@ not process.executable : ("?:\\Program Files\\*.exe",
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[unusual-persistence-via-services-registry-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.1.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where registry.path :
-("HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL",
-"HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath") and not
-registry.data.strings : ("C:\\windows\\system32\\Drivers\\*.sys",
-"\\SystemRoot\\System32\\drivers\\*.sys",
-"system32\\DRIVERS\\USBSTOR") and not (process.name :
-"procexp??.exe" and registry.data.strings : "C:\\*\\procexp*.sys") and
-not process.executable : ("C:\\Program Files*\\*.exe",
-"C:\\Windows\\System32\\svchost.exe",
-"C:\\Windows\\winsxs\\*\\TiWorker.exe",
-"C:\\Windows\\System32\\drvinst.exe",
-"C:\\Windows\\System32\\services.exe",
-"C:\\Windows\\System32\\msiexec.exe",
-"C:\\Windows\\System32\\regsvr32.exe")
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
index 4ec9026f65..acf424613f 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
@@ -5,7 +5,7 @@ Detects unusual Print Spooler service (spoolsv.exe) child processes. This may in
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,68 +15,60 @@ Detects unusual Print Spooler service (spoolsv.exe) child processes. This may in
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<unusual-print-spooler-child-process-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Install or update of a legitimate printing driver. Verify the printer driver file metadata such as manufacturer and signature information.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"spoolsv.exe" and (?process.Ext.token.integrity_level_name : "System"
-or ?winlog.event_data.IntegrityLevel : "System") and /* exclusions
-for FP control below */ not process.name : ("splwow64.exe",
-"PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe",
-"route.exe", "WerFault.exe") and not process.command_line :
-"*\\WINDOWS\\system32\\spool\\DRIVERS*" and not (process.name :
-"net.exe" and process.command_line : ("*stop*", "*start*")) and not
-(process.name : ("cmd.exe", "powershell.exe") and process.command_line
-: ("*.spl*", "*\\program files*", "*route add*")) and not
-(process.name : "netsh.exe" and process.command_line : ("*add
-portopening*", "*rule name*")) and not (process.name : "regsvr32.exe"
-and process.command_line : "*PrintConfig.dll*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "spoolsv.exe" and
+ (?process.Ext.token.integrity_level_name : "System" or
+ ?winlog.event_data.IntegrityLevel : "System") and
+
+ /* exclusions for FP control below */
+ not process.name : ("splwow64.exe", "PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe", "route.exe", "WerFault.exe") and
+ not process.command_line : "*\\WINDOWS\\system32\\spool\\DRIVERS*" and
+ not (process.name : "net.exe" and process.command_line : ("*stop*", "*start*")) and
+ not (process.name : ("cmd.exe", "powershell.exe") and process.command_line : ("*.spl*", "*\\program files*", "*route add*")) and
+ not (process.name : "netsh.exe" and process.command_line : ("*add portopening*", "*rule name*")) and
+ not (process.name : "regsvr32.exe" and process.command_line : "*PrintConfig.dll*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -88,55 +80,3 @@ and process.command_line : "*PrintConfig.dll*")
 ** Name: Exploitation for Privilege Escalation
 ** ID: T1068
 ** Reference URL: https://attack.mitre.org/techniques/T1068/
-
-[[unusual-print-spooler-child-process-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"spoolsv.exe" and (process.Ext.token.integrity_level_name : "System"
-or winlog.event_data.IntegrityLevel : "System") and /* exclusions
-for FP control below */ not process.name : ("splwow64.exe",
-"PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe",
-"route.exe", "WerFault.exe") and not process.command_line :
-"*\\WINDOWS\\system32\\spool\\DRIVERS*" and not (process.name :
-"net.exe" and process.command_line : ("*stop*", "*start*")) and not
-(process.name : ("cmd.exe", "powershell.exe") and process.command_line
-: ("*.spl*", "*\\program files*", "*route add*")) and not
-(process.name : "netsh.exe" and process.command_line : ("*add
-portopening*", "*rule name*")) and not (process.name : "regsvr32.exe"
-and process.command_line : "*PrintConfig.dll*")
-----------------------------------
-
-Version 3 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"spoolsv.exe" and user.id : "S-1-5-18" and /* exclusions for FP
-control below */ not process.name : ("splwow64.exe",
-"PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe",
-"route.exe", "WerFault.exe") and not process.command_line :
-"*\\WINDOWS\\system32\\spool\\DRIVERS*" and not (process.name :
-"net.exe" and process.command_line : ("*stop*", "*start*")) and not
-(process.name : ("cmd.exe", "powershell.exe") and process.command_line
-: ("*.spl*", "*\\program files*", "*route add*")) and not
-(process.name : "netsh.exe" and process.command_line : ("*add
-portopening*", "*rule name*")) and not (process.name : "regsvr32.exe"
-and process.command_line : "*PrintConfig.dll*")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
index bc18e1826c..a3023df83e 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
@@ -5,7 +5,7 @@ Identifies processes running from an Alternate Data Stream. This is uncommon for
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,50 +16,48 @@ Identifies processes running from an Alternate Data Stream. This is uncommon for
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 101 (<<unusual-process-execution-path-alternate-data-stream-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.args : "?:\\*:*" and
-process.args_count == 1
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.args : "?:\\*:*" and process.args_count == 1
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -71,37 +69,7 @@ process.args_count == 1
 ** Name: Hide Artifacts
 ** ID: T1564
 ** Reference URL: https://attack.mitre.org/techniques/T1564/
-
-[[unusual-process-execution-path-alternate-data-stream-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.args : "C:\\*:*"
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: NTFS File Attributes
+** ID: T1564.004
+** Reference URL: https://attack.mitre.org/techniques/T1564/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc
index 7db8c0e37e..1416a1b4a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc
@@ -5,63 +5,83 @@ Identifies rare processes that do not usually run on individual hosts, which can
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_rare_process_by_host_linux
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<unusual-process-for-a-linux-host-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-### Investigating an Unusual Linux Process
-Detection alerts from this rule indicate the presence of a Linux process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation:
-- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?
-- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.
-- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
-----------------------------------
+###  Investigating Unusual Process For a Linux Host
+
+Searching for abnormal Linux processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
+
+This rule uses a machine learning job to detect a Linux process that is rare and unusual for an individual Linux host in your environment.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, and whether they are located in expected locations.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
+- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
+
+### False Positive Analysis
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+### Response and Remediation
 
-==== Threat mapping
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,34 +93,7 @@ Detection alerts from this rule indicate the presence of a Linux process that is
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[unusual-process-for-a-linux-host-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Systemd Service
+** ID: T1543.002
+** Reference URL: https://attack.mitre.org/techniques/T1543/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
index 1ee5e0a99f..a4db1dba3b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
@@ -5,16 +5,13 @@ Identifies rare processes that do not usually run on individual hosts, which can
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_rare_process_by_host_windows
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -26,71 +23,90 @@ Identifies rare processes that do not usually run on individual hosts, which can
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<unusual-process-for-a-windows-host-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
-###  Investigating an Unusual Windows Process
+###  Investigating Unusual Process For a Windows Host
+
+Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
-Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network.
-Understanding what is commonly run within an environment and developing baselines for legitimate activity can help
-uncover potential malware and suspicious behaviors.
+This rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.
 
-#### Possible investigation steps:
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
+  - Investigate the process metadata — such as the digital signature, directory, etc. — to obtain more context that can indicate whether the executable is associated with an expected software vendor or package.
+- Investigate other alerts associated with the user/host during the past 48 hours.
 - Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?
-- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.
-- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.
-- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
-- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
-- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
+- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR user_account == null)"}}
+      - !{osquery{"label":"Retrieve Service Unisgned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
 ### False Positive Analysis
-- Validate the unusual Windows process is not related to new benign software installation activity. If related to
-legitimate software, this can be done by leveraging the exception workflow in the Kibana Security App or Elasticsearch
-API to tune this rule to your environment.
-- Try to understand the context of the execution by thinking about the user, machine, or business purpose.  It's possible that a small number of endpoints
-such as servers that have very unique software that might appear to be unusual, but satisfy a specific business need.
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
 ### Related Rules
-- Anomalous Windows Process Creation
-- Unusual Windows Path Activity
-- Unusual Windows Process Calling the Metadata Service
+
+- Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76
+- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
+- Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b
 
 ### Response and Remediation
-- This rule is related to process execution events and should be immediately reviewed and investigated to determine if malicious.
-- Based on validation and if malicious, the impacted machine should be isolated and analyzed to determine other post-compromise
-behavior such as setting up persistence or performing lateral movement.
-- Look into preventive measures such as Windows Defender Application Control and AppLocker to gain better control on
-what is allowed to run on Windows infrastructure.
 
-----------------------------------
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -102,46 +118,7 @@ what is allowed to run on Windows infrastructure.
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[unusual-process-for-a-windows-host-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 11 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (8.1.0 release)::
-* Formatting only
-
-Version 8 (7.16.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc
index 4721705e7a..7c75fd4899 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc
@@ -5,7 +5,7 @@ Identifies network activity from unexpected system applications. This may indica
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -15,47 +15,45 @@ Identifies network activity from unexpected system applications. This may indica
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<unusual-process-network-connection-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Unusual Process Network Connection
 
-This rule identifies network activity from unexpected system utilities and applications. These applications are commonly
-abused by attackers to execute code, evade detections, and bypass security protections.
+This rule identifies network activity from unexpected system utilities and applications. These applications are commonly abused by attackers to execute code, evade detections, and bypass security protections.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the target host that the process is communicating with.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
@@ -68,45 +66,47 @@ for prevalence, whether they are located in expected locations, and if they are
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by process.entity_id [process where (process.name :
-"Microsoft.Workflow.Compiler.exe" or process.name :
-"bginfo.exe" or process.name : "cdb.exe" or
-process.name : "cmstp.exe" or process.name :
-"csi.exe" or process.name : "dnx.exe" or
-process.name : "fsi.exe" or process.name :
-"ieexec.exe" or process.name : "iexpress.exe" or
-process.name : "odbcconf.exe" or process.name :
-"rcsi.exe" or process.name : "xwizard.exe") and
-event.type == "start"] [network where (process.name :
-"Microsoft.Workflow.Compiler.exe" or process.name :
-"bginfo.exe" or process.name : "cdb.exe" or
-process.name : "cmstp.exe" or process.name :
-"csi.exe" or process.name : "dnx.exe" or
-process.name : "fsi.exe" or process.name :
-"ieexec.exe" or process.name : "iexpress.exe" or
-process.name : "odbcconf.exe" or process.name :
-"rcsi.exe" or process.name : "xwizard.exe")]
+[source, js]
 ----------------------------------
+sequence by process.entity_id
+  [process where host.os.type == "windows" and (process.name : "Microsoft.Workflow.Compiler.exe" or
+                  process.name : "bginfo.exe" or
+                  process.name : "cdb.exe" or
+                  process.name : "cmstp.exe" or
+                  process.name : "csi.exe" or
+                  process.name : "dnx.exe" or
+                  process.name : "fsi.exe" or
+                  process.name : "ieexec.exe" or
+                  process.name : "iexpress.exe" or
+                  process.name : "odbcconf.exe" or
+                  process.name : "rcsi.exe" or
+                  process.name : "xwizard.exe") and
+     event.type == "start"]
+  [network where host.os.type == "windows" and (process.name : "Microsoft.Workflow.Compiler.exe" or
+                  process.name : "bginfo.exe" or
+                  process.name : "cdb.exe" or
+                  process.name : "cmstp.exe" or
+                  process.name : "csi.exe" or
+                  process.name : "dnx.exe" or
+                  process.name : "fsi.exe" or
+                  process.name : "ieexec.exe" or
+                  process.name : "iexpress.exe" or
+                  process.name : "odbcconf.exe" or
+                  process.name : "rcsi.exe" or
+                  process.name : "xwizard.exe")]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,59 +118,3 @@ process.name : "odbcconf.exe" or process.name :
 ** Name: Trusted Developer Utilities Proxy Execution
 ** ID: T1127
 ** Reference URL: https://attack.mitre.org/techniques/T1127/
-
-[[unusual-process-network-connection-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:network and event.type:connection and
-process.name:(Microsoft.Workflow.Compiler.exe or bginfo.exe or cdb.exe
-or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or
-iexpress.exe or odbcconf.exe or rcsi.exe or xwizard.exe)
-----------------------------------
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Network connection detected (rule: NetworkConnect)" and
-process.name:(Microsoft.Workflow.Compiler.exe or bginfo.exe or cdb.exe
-or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or
-iexpress.exe or odbcconf.exe or rcsi.exe or xwizard.exe)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Network connection detected (rule: NetworkConnect)" and
-process.name:(bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe
-or fsi.exe or ieexec.exe or iexpress.exe or
-Microsoft.Workflow.Compiler.exe or odbcconf.exe or rcsi.exe or
-xwizard.exe)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
index bfa0ed4951..dcdddabe9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
@@ -5,81 +5,78 @@ Identifies unusual child processes of Service Host (svchost.exe) that traditiona
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 101 (<<unusual-service-host-child-process-childless-service-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Changes to Windows services or a rarely executed child process.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"svchost.exe" and /* based on svchost service arguments -s
-svcname where the service is known to be childless */
-process.parent.args : ("WdiSystemHost","LicenseManager",
-"StorSvc","CDPSvc","cdbhsvc","BthAvctpSvc","SstpSvc","WdiServiceHost",
-"imgsvc","TrkWks","WpnService","IKEEXT","PolicyAgent","CryptSvc",
-"netprofm","ProfSvc","StateRepository","camsvc","LanmanWorkstation",
-"NlaSvc","EventLog","hidserv","DisplayEnhancementService","ShellHWDete
-ction", "AppHostSvc","fhsvc","CscService","PushToInstall") and
-/* unknown FPs can be added here */ not process.name :
-("WerFault.exe","WerFaultSecure.exe","wermgr.exe") and not
-(process.executable : "?:\\Windows\\System32\\RelPost.exe" and
-process.parent.args : "WdiSystemHost") and not (process.name :
-"rundll32.exe" and process.args :
-"?:\\WINDOWS\\System32\\winethc.dll,ForceProxyDetectionOnNextRun" and
-process.parent.args : "WdiServiceHost") and not
-(process.executable : ("?:\\Program Files\\*", "?:\\Program Files
-(x86)\\*", "?:\\Windows\\System32\\Kodak\\kds_i4x50\\lib\\lexexe.exe")
-and process.parent.args : "imgsvc")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+     process.parent.name : "svchost.exe" and
+
+     /* based on svchost service arguments -s svcname where the service is known to be childless */
 
-==== Threat mapping
+    process.parent.args : ("WdiSystemHost","LicenseManager",
+      "StorSvc","CDPSvc","cdbhsvc","BthAvctpSvc","SstpSvc","WdiServiceHost",
+      "imgsvc","TrkWks","WpnService","IKEEXT","PolicyAgent","CryptSvc",
+      "netprofm","ProfSvc","StateRepository","camsvc","LanmanWorkstation",
+      "NlaSvc","EventLog","hidserv","DisplayEnhancementService","ShellHWDetection",
+      "AppHostSvc","fhsvc","CscService","PushToInstall") and
+
+      /* unknown FPs can be added here */
+
+     not process.name : ("WerFault.exe","WerFaultSecure.exe","wermgr.exe") and
+     not (process.executable : "?:\\Windows\\System32\\RelPost.exe" and process.parent.args : "WdiSystemHost") and
+     not (process.name : "rundll32.exe" and
+          process.args : "?:\\WINDOWS\\System32\\winethc.dll,ForceProxyDetectionOnNextRun" and process.parent.args : "WdiServiceHost") and
+     not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\System32\\Kodak\\kds_i4x50\\lib\\lexexe.exe") and
+          process.parent.args : "imgsvc")
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -91,8 +88,10 @@ and process.parent.args : "imgsvc")
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-
+* Sub-technique:
+** Name: Process Hollowing
+** ID: T1055.012
+** Reference URL: https://attack.mitre.org/techniques/T1055/012/
 * Tactic:
 ** Name: Defense Evasion
 ** ID: TA0005
@@ -101,62 +100,3 @@ and process.parent.args : "imgsvc")
 ** Name: Process Injection
 ** ID: T1055
 ** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-[[unusual-service-host-child-process-childless-service-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "svchost.exe" and /* based on svchost
-service arguments -s svcname where the service is known to be
-childless */ process.parent.args :
-("WdiSystemHost","LicenseManager",
-"StorSvc","CDPSvc","cdbhsvc","BthAvctpSvc","SstpSvc","WdiServiceHost",
-"imgsvc","TrkWks","WpnService","IKEEXT","PolicyAgent","CryptSvc",
-"netprofm","ProfSvc","StateRepository","camsvc","LanmanWorkstation",
-"NlaSvc","EventLog","hidserv","DisplayEnhancementService","ShellHWDete
-ction", "AppHostSvc","fhsvc","CscService","PushToInstall") and
-/* unknown FPs can be added here */ not process.name :
-("WerFault.exe","WerFaultSecure.exe","wermgr.exe") and not
-(process.executable : "?:\\Windows\\System32\\RelPost.exe" and
-process.parent.args : "WdiSystemHost") and not (process.name :
-"rundll32.exe" and process.args :
-"?:\\WINDOWS\\System32\\winethc.dll,ForceProxyDetectionOnNextRun" and
-process.parent.args : "WdiServiceHost") and not
-(process.executable : ("?:\\Program Files\\*", "?:\\Program Files
-(x86)\\*", "?:\\Windows\\System32\\Kodak\\kds_i4x50\\lib\\lexexe.exe")
-and process.parent.args : "imgsvc")
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : "svchost.exe" and /* based on svchost
-service arguments -s svcname where the service is known to be
-childless */ process.parent.args :
-("WdiSystemHost","LicenseManager",
-"StorSvc","CDPSvc","cdbhsvc","BthAvctpSvc","SstpSvc","WdiServiceHost",
-"imgsvc","TrkWks","WpnService","IKEEXT","PolicyAgent","CryptSvc",
-"netprofm","ProfSvc","StateRepository","camsvc","LanmanWorkstation",
-"NlaSvc","EventLog","hidserv","DisplayEnhancementService","ShellHWDete
-ction", "AppHostSvc","fhsvc","CscService","PushToInstall") and
-/* unknown FPs can be added here */ not process.name :
-("WerFault.exe","WerFaultSecure.exe","wermgr.exe")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-source-ip-for-a-user-to-logon-from.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-source-ip-for-a-user-to-logon-from.asciidoc
index 235bd322d7..978dc27b1c 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-source-ip-for-a-user-to-logon-from.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-source-ip-for-a-user-to-logon-from.asciidoc
@@ -5,47 +5,38 @@ A machine learning job detected a user logging in from an IP address that is unu
 
 *Rule type*: machine_learning
 
-*Machine learning job*: auth_rare_source_ip_for_a_user
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Authentication
-* Threat Detection
-* ML
-* Initial Access
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Initial Access
 
-*Version*: 100 (<<unusual-source-ip-for-a-user-to-logon-from-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.14.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Business travelers who roam to new locations may trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,13 +48,3 @@ Business travelers who roam to new locations may trigger this alert.
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[unusual-source-ip-for-a-user-to-logon-from-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-sudo-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-sudo-activity.asciidoc
index 99a01eb185..e22228df3f 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-sudo-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-sudo-activity.asciidoc
@@ -5,43 +5,37 @@ Looks for sudo activity from an unusual user context. An unusual sudo user could
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_linux_rare_sudo_user
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
+*Tags*: 
 
-*Version*: 100 (<<unusual-sudo-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon sudo activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -53,8 +47,6 @@ Uncommon sudo activity can be due to an engineer logging onto a server instance
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-
 * Tactic:
 ** Name: Privilege Escalation
 ** ID: TA0004
@@ -63,16 +55,3 @@ Uncommon sudo activity can be due to an engineer logging onto a server instance
 ** Name: Abuse Elevation Control Mechanism
 ** ID: T1548
 ** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[unusual-sudo-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-web-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-web-request.asciidoc
index 9347d2ce00..38ad9e61a2 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-web-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-web-request.asciidoc
@@ -5,47 +5,37 @@ A machine learning job detected a rare and unusual URL that indicates unusual we
 
 *Rule type*: machine_learning
 
-*Machine learning job*: packetbeat_rare_urls
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Network
-* Threat Detection
-* ML
-* Command and Control
+*Tags*: 
 
-*Version*: 100 (<<unusual-web-request-history, version history>>)
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Web activity that occurs rarely in small quantities can trigger this alert. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this alert when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,22 +47,7 @@ Web activity that occurs rarely in small quantities can trigger this alert. Poss
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[unusual-web-request-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-web-user-agent.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-web-user-agent.asciidoc
index fad69f804c..69bf0e2d53 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-web-user-agent.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-web-user-agent.asciidoc
@@ -5,47 +5,37 @@ A machine learning job detected a rare and unusual user agent indicating web bro
 
 *Rule type*: machine_learning
 
-*Machine learning job*: packetbeat_rare_user_agent
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Network
-* Threat Detection
-* ML
-* Command and Control
+*Tags*: 
 
-*Version*: 100 (<<unusual-web-user-agent-history, version history>>)
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Command and Control
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Web activity that is uncommon, like security scans, may trigger this alert and may need to be excluded. A new or rarely used program that calls web services may trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -57,22 +47,7 @@ Web activity that is uncommon, like security scans, may trigger this alert and m
 ** Name: Application Layer Protocol
 ** ID: T1071
 ** Reference URL: https://attack.mitre.org/techniques/T1071/
-
-[[unusual-web-user-agent-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc
index f505ea6997..1951ecb943 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc
@@ -5,51 +5,43 @@ Identifies Windows processes that do not usually use the network but have unexpe
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_network_activity
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
 
-*Version*: 100 (<<unusual-windows-network-activity-history, version history>>)
+*Version*: 102
 
-*Added ({stack} release)*: 7.7.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that rarely uses the network could trigger this alert.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -63,32 +55,3 @@ Detection alerts from this rule indicate the presence of network activity from a
 - Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
 - If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.
 ----------------------------------
-
-
-[[unusual-windows-network-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-path-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-path-activity.asciidoc
index 4e64919ba4..8735206623 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-path-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-path-activity.asciidoc
@@ -5,48 +5,40 @@ Identifies processes started from atypical folders in the file system, which mig
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_path_activity
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Persistence
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
+* Tactic: Execution
 
-*Version*: 100 (<<unusual-windows-path-activity-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.7.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this alert. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -58,28 +50,19 @@ A new and unusual program or artifact download in the course of software upgrade
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[unusual-windows-path-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (7.14.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-process-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-process-calling-the-metadata-service.asciidoc
index 70ae069341..9ec105a752 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-process-calling-the-metadata-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-process-calling-the-metadata-service.asciidoc
@@ -5,44 +5,37 @@ Looks for anomalous access to the metadata service by an unusual process. The me
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_rare_metadata_process
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<unusual-windows-process-calling-the-metadata-service-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this detection rule.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -54,22 +47,7 @@ A newly installed program or one that runs very rarely as part of a monthly or q
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-[[unusual-windows-process-calling-the-metadata-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (7.14.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Instance Metadata API
+** ID: T1552.005
+** Reference URL: https://attack.mitre.org/techniques/T1552/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc
index bb86e09f0e..ad11bef618 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc
@@ -5,52 +5,44 @@ A machine learning job detected an unusual remote desktop protocol (RDP) usernam
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_rare_user_type10_remote_login
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Initial Access
+*Tags*: 
 
-*Version*: 100 (<<unusual-windows-remote-user-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -60,8 +52,6 @@ Detection alerts from this rule indicate activity for a rare and unusual Windows
 - Consider the source of the login. If the source is remote, could this be related to occasional troubleshooting or support activity by a vendor or an employee working remotely?
 ----------------------------------
 
-==== Threat mapping
-
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
@@ -72,28 +62,3 @@ Detection alerts from this rule indicate activity for a rare and unusual Windows
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[unusual-windows-remote-user-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-service.asciidoc
index b1adf42b9c..040e420d37 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-service.asciidoc
@@ -5,48 +5,39 @@ A machine learning job detected an unusual Windows service, This can indicate ex
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_service
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Persistence
+*Tags*: 
 
-*Version*: 100 (<<unusual-windows-service-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -58,25 +49,7 @@ A newly installed program or one that runs rarely as part of a monthly or quarte
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[unusual-windows-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-calling-the-metadata-service.asciidoc
index a9d2d09d54..5553dde529 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-calling-the-metadata-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-calling-the-metadata-service.asciidoc
@@ -5,44 +5,37 @@ Looks for anomalous access to the cloud platform metadata service by an unusual
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_rare_metadata_user
-
-*Machine learning anomaly threshold*: 75
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Credential Access
+*Tags*: 
 
-*Version*: 100 (<<unusual-windows-user-calling-the-metadata-service-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-A newly installed program, or one that runs under a new or rarely used user context, could trigger this detection rule. Manual interrogation of the metadata service during debugging or troubleshooting could trigger this rule.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -54,22 +47,7 @@ A newly installed program, or one that runs under a new or rarely used user cont
 ** Name: Unsecured Credentials
 ** ID: T1552
 ** Reference URL: https://attack.mitre.org/techniques/T1552/
-
-[[unusual-windows-user-calling-the-metadata-service-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (7.14.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Cloud Instance Metadata API
+** ID: T1552.005
+** Reference URL: https://attack.mitre.org/techniques/T1552/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-privilege-elevation-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-privilege-elevation-activity.asciidoc
index fca0e16dba..97eddf431b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-privilege-elevation-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-user-privilege-elevation-activity.asciidoc
@@ -5,48 +5,39 @@ A machine learning job detected an unusual user context switch, using the runas
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_rare_user_runas_event
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Privilege Escalation
+*Tags*: 
 
-*Version*: 100 (<<unusual-windows-user-privilege-elevation-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration.
-==== Threat mapping
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -54,25 +45,3 @@ Uncommon user privilege elevation activity can be due to an administrator, help
 ** Name: Privilege Escalation
 ** ID: TA0004
 ** Reference URL: https://attack.mitre.org/tactics/TA0004/
-
-[[unusual-windows-user-privilege-elevation-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc
index 173f300bd4..4085171aab 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc
@@ -5,52 +5,44 @@ A machine learning job detected activity for a username that is not normally act
 
 *Rule type*: machine_learning
 
-*Machine learning job*: v3_windows_anomalous_user_name
-
-*Machine learning anomaly threshold*: 50
-
+*Rule indices*: None
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 15 minutes
+*Runs every*: 15m
 
 *Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* ML
-* Initial Access
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Initial Access
 
-*Version*: 100 (<<unusual-windows-username-history, version history>>)
+*Version*: 103
 
-*Added ({stack} release)*: 7.7.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -62,8 +54,6 @@ Detection alerts from this rule indicate activity for a Windows user name that i
 - Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
 ----------------------------------
 
-==== Threat mapping
-
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
@@ -74,34 +64,11 @@ Detection alerts from this rule indicate activity for a Windows user name that i
 ** Name: Valid Accounts
 ** ID: T1078
 ** Reference URL: https://attack.mitre.org/techniques/T1078/
-
-[[unusual-windows-username-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (7.15.0 release)::
-* Formatting only
-
-Version 6 (7.14.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Domain Accounts
+** ID: T1078.002
+** Reference URL: https://attack.mitre.org/techniques/T1078/002/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
index 3bbdd9e194..d4641d2818 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
@@ -5,45 +5,47 @@ Identifies attempts to create new users. This is sometimes done by attackers to
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<user-account-creation-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
@@ -55,16 +57,14 @@ This rule identifies the usage of `net.exe` to create new accounts.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Identify if the account was added to privileged groups or assigned special privileges after creation.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
 ### False positive analysis
 
-- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before
-investigating further, verify that this activity is not benign.
+- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
 
 ### Related rules
 
@@ -76,26 +76,22 @@ investigating further, verify that this activity is not benign.
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Delete the created account.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : ("net.exe",
-"net1.exe") and not process.parent.name : "net.exe" and
-(process.args : "user" and process.args : ("/ad", "/add"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("net.exe", "net1.exe") and
+  not process.parent.name : "net.exe" and
+  (process.args : "user" and process.args : ("/ad", "/add"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -107,76 +103,7 @@ process where event.type == "start" and process.name : ("net.exe",
 ** Name: Create Account
 ** ID: T1136
 ** Reference URL: https://attack.mitre.org/techniques/T1136/
-
-[[user-account-creation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("net.exe", "net1.exe") and not process.parent.name :
-"net.exe" and (process.args : "user" and process.args : ("/ad",
-"/add"))
-----------------------------------
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 11 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.16.0 release)::
-* Formatting only
-
-Version 8 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(net.exe or net1.exe) and not process.parent.name:net.exe
-and process.args:(user and (/ad or /add))
-----------------------------------
-
-Version 7 (7.12.0 release)::
-* Formatting only
-
-Version 6 (7.11.2 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:(net.exe or net1.exe) and not process.parent.name:net.exe
-and process.args:(user and (/ad or /add))
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:("net.exe" or "net1.exe") and not
-process.parent.name:"net.exe" and process.args:("user" and ("/add" or
-"/ad"))
-----------------------------------
-
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
index 151f53a3b1..0afde209d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
@@ -5,22 +5,23 @@ Detects when a user account has the servicePrincipalName attribute modified. Att
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.thehacker.recipes/ad/movement/access-controls/targeted-kerberoasting
 * https://www.qomplx.com/qomplx-knowledge-kerberoasting-attacks-explained/
@@ -29,53 +30,43 @@ Detects when a user account has the servicePrincipalName attribute modified. Att
 * https://adsecurity.org/?p=280
 * https://github.com/OTRF/Set-AuditRule
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Active Directory
-* Investigation Guide
-
-*Version*: 102 (<<user-account-exposed-to-kerberoasting-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating User account exposed to Kerberoasting
 
-Service Principal Names (SPNs) are names by which Kerberos clients uniquely identify service instances for Kerberos target
-computers.
+Service Principal Names (SPNs) are names by which Kerberos clients uniquely identify service instances for Kerberos target computers.
 
-By default, only computer accounts have SPNs, which creates no significant risk, since machine accounts have a default
-domain policy that rotates their passwords every 30 days, and the password is composed of 120 random characters, making
-them invulnerable to Kerberoasting.
+By default, only computer accounts have SPNs, which creates no significant risk, since machine accounts have a default domain policy that rotates their passwords every 30 days, and the password is composed of 120 random characters, making them invulnerable to Kerberoasting.
 
-A user account with an SPN assigned is considered a service account, and is accessible to the entire domain. If any
-user in the directory requests a ticket-granting service (TGS), the domain controller will encrypt it with the secret
-key of the account executing the service. An attacker can potentially perform a Kerberoasting attack with this
-information, as the human-defined password is likely to be less complex.
+A user account with an SPN assigned is considered a service account, and is accessible to the entire domain. If any user in the directory requests a ticket-granting service (TGS), the domain controller will encrypt it with the secret key of the account executing the service. An attacker can potentially perform a Kerberoasting attack with this information, as the human-defined password is likely to be less complex.
 
-For scenarios where SPNs cannot be avoided on user accounts, Microsoft provides the Group Managed Service Accounts (gMSA)
-feature, which ensures that account passwords are robust and changed regularly and automatically. More information can
-be found [here](https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview).
+For scenarios where SPNs cannot be avoided on user accounts, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that account passwords are robust and changed regularly and automatically. More information can be found [here](https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview).
 
-Attackers can also perform "Targeted Kerberoasting", which consists of adding fake SPNs to user accounts that they have
-write privileges to, making them potentially vulnerable to Kerberoasting.
+Attackers can also perform "Targeted Kerberoasting", which consists of adding fake SPNs to user accounts that they have write privileges to, making them potentially vulnerable to Kerberoasting.
 
 #### Possible investigation steps
 
@@ -87,36 +78,27 @@ write privileges to, making them potentially vulnerable to Kerberoasting.
 
 ### False positive analysis
 
-- The use of user accounts as service accounts is a bad security practice and should not be allowed in the domain. The
-security team should map and monitor any potential benign true positive (B-TP), especially if the account is privileged.
-Domain Administrators that define this kind of setting can put the domain at risk as user accounts don't have the same
-security standards as computer accounts (which have long, complex, random passwords that change frequently), exposing
-them to credential cracking attacks (Kerberoasting, brute force, etc.).
+- The use of user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor any potential benign true positive (B-TP), especially if the account is privileged. Domain Administrators that define this kind of setting can put the domain at risk as user accounts don't have the same security standards as computer accounts (which have long, complex, random passwords that change frequently), exposing them to credential cracking attacks (Kerberoasting, brute force, etc.).
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services. Prioritize privileged accounts.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.action:"Directory Service Changes" and event.code:5136 and
-winlog.event_data.ObjectClass:"user" and
-winlog.event_data.AttributeLDAPDisplayName:"servicePrincipalName"
-----------------------------------
+  winlog.event_data.ObjectClass:"user" and
+  winlog.event_data.AttributeLDAPDisplayName:"servicePrincipalName"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -128,26 +110,7 @@ winlog.event_data.AttributeLDAPDisplayName:"servicePrincipalName"
 ** Name: Steal or Forge Kerberos Tickets
 ** ID: T1558
 ** Reference URL: https://attack.mitre.org/techniques/T1558/
-
-[[user-account-exposed-to-kerberoasting-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Directory Service Changes" and event.code:5136 and
-winlog.event_data.ObjectClass:"user" and
-winlog.event_data.AttributeLDAPDisplayName:"servicePrincipalName"
-----------------------------------
-
-Version 2 (8.3.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc
index 3046ac769a..f35f51192a 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc
@@ -5,7 +5,7 @@ Identifies when a user is added as an owner for an Azure application. An adversa
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,50 +14,46 @@ Identifies when a user is added as an owner for an Azure application. An adversa
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
+*Tags*: 
 
-*Version*: 101 (<<user-added-as-owner-for-azure-application-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-owner to application" and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add owner to application" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -69,34 +65,3 @@ owner to application" and event.outcome:(Success or success)
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[user-added-as-owner-for-azure-application-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-owner to application" and event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc
index 041478bd36..ea60b5220a 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc
@@ -5,7 +5,7 @@ Identifies when a user is added as an owner for an Azure service principal. The
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 * logs-azure*
@@ -14,54 +14,48 @@ Identifies when a user is added as an owner for an Azure service principal. The
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Cloud
-* Azure
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 101 (<<user-added-as-owner-for-azure-service-principal-history, version history>>)
+* Domain: Cloud
+* Data Source: Azure
+* Use Case: Configuration Audit
+* Tactic: Persistence
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-owner to service principal" and event.outcome:(Success or success)
+[source, js]
 ----------------------------------
+event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add owner to service principal" and event.outcome:(Success or success)
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,34 +67,3 @@ owner to service principal" and event.outcome:(Success or success)
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[user-added-as-owner-for-azure-service-principal-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add
-owner to service principal" and event.outcome:Success
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc
index fcd479bb74..e1fa519fd6 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc
@@ -5,58 +5,58 @@ Identifies a user being added to a privileged group in Active Directory. Privile
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<user-added-to-privileged-group-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
+* Data Source: Active Directory
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Skoetting
+* Elastic
+* Skoetting
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating User Added to Privileged Group in Active Directory
 
-Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are
-granted that allow them to perform nearly any action in Active Directory and on domain-joined systems.
+Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems.
 
-Attackers can add users to privileged groups to maintain a level of access if their other privileged accounts are
-uncovered by the security team. This allows them to keep operating after the security team discovers abused accounts.
+Attackers can add users to privileged groups to maintain a level of access if their other privileged accounts are uncovered by the security team. This allows them to keep operating after the security team discovers abused accounts.
 
 This rule monitors events related to a user being added to a privileged group.
 
@@ -68,9 +68,7 @@ This rule monitors events related to a user being added to a privileged group.
 
 ### False positive analysis
 
-- This attack abuses a legitimate Active Directory mechanism, so it is important to determine whether the activity is
-legitimate, if the administrator is authorized to perform this operation, and if there is a need to grant the account
-this level of privilege.
+- This attack abuses a legitimate Active Directory mechanism, so it is important to determine whether the activity is legitimate, if the administrator is authorized to perform this operation, and if there is a need to grant the account this level of privilege.
 
 ### Response and remediation
 
@@ -79,24 +77,25 @@ this level of privilege.
 - If the user does not need the administrator privileges, remove the account from the privileged group.
 - Review the privileges of the administrator account that performed the action.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-iam where event.action == "added-member-to-group" and group.name :
-("Admin*", "Local Administrators",
-"Domain Admins", "Enterprise Admins",
-"Backup Admins", "Schema Admins",
-"DnsAdmins", "Exchange Organization Administrators")
+[source, js]
 ----------------------------------
+iam where winlog.api:"wineventlog" and event.action == "added-member-to-group" and
+  group.name : ("Admin*",
+                "Local Administrators",
+                "Domain Admins",
+                "Enterprise Admins",
+                "Backup Admins",
+                "Schema Admins",
+                "DnsAdmins",
+                "Exchange Organization Administrators")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -108,35 +107,3 @@ iam where event.action == "added-member-to-group" and group.name :
 ** Name: Account Manipulation
 ** ID: T1098
 ** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[user-added-to-privileged-group-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Rule name changed from: User Added to Privileged Group in Active Directory
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:iam and event.action:"added-member-to-group" and
-group.name:(Administrators or "Local Administrators" or "Domain
-Admins" or "Enterprise Admins" or "Backup Admins" or "Schema Admins"
-or "DnsAdmins")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc
index 1d13dbdada..5f42b2c18a 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc
@@ -5,7 +5,7 @@ An adversary may attempt to get detailed information about the operating system
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,62 +14,52 @@ An adversary may attempt to get detailed information about the operating system
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://objective-see.com/blog/blog_0x4F.html
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Linux
-* Threat Detection
-* Discovery
-
-*Version*: 100 (<<virtual-machine-fingerprinting-via-grep-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain tools or automated software may enumerate hardware information. These tools can be exempted via user name or process arguments to eliminate potential noise.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name in ("grep",
-"egrep") and user.id != "0" and process.args : ("parallels*",
-"vmware*", "virtualbox*") and process.args : "Manufacturer*" and not
-process.parent.executable in
-("/Applications/Docker.app/Contents/MacOS/Docker",
-"/usr/libexec/kcare/virt-what")
+[source, js]
 ----------------------------------
+process where event.type == "start" and
+ process.name in ("grep", "egrep") and user.id != "0" and
+ process.args : ("parallels*", "vmware*", "virtualbox*") and process.args : "Manufacturer*" and
+ not process.parent.executable in ("/Applications/Docker.app/Contents/MacOS/Docker", "/usr/libexec/kcare/virt-what")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -81,26 +71,3 @@ process.parent.executable in
 ** Name: System Information Discovery
 ** ID: T1082
 ** Reference URL: https://attack.mitre.org/techniques/T1082/
-
-[[virtual-machine-fingerprinting-via-grep-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.name in ("grep",
-"egrep") and user.id != "0" and process.args : ("parallels*",
-"vmware*", "virtualbox*") and process.args : "Manufacturer*" and not
-process.parent.executable in
-("/Applications/Docker.app/Contents/MacOS/Docker",
-"/usr/libexec/kcare/virt-what")
-----------------------------------
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc
index 8973622421..e59c5f5c8e 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc
@@ -5,57 +5,55 @@ An adversary may attempt to get detailed information about the operating system
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Discovery
+*Tags*: 
 
-*Version*: 100 (<<virtual-machine-fingerprinting-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.8.0
+*Version*: 104
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Certain tools or automated software may enumerate hardware information. These tools can be exempted via user name or process arguments to eliminate potential noise.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:("/sys/class/dmi/id/bios_version" or
-"/sys/class/dmi/id/product_name" or
-"/sys/class/dmi/id/chassis_vendor" or
-"/proc/scsi/scsi" or "/proc/ide/hd0/model") and not
-user.name:root
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
+  process.args:("/sys/class/dmi/id/bios_version" or
+                "/sys/class/dmi/id/product_name" or
+                "/sys/class/dmi/id/chassis_vendor" or
+                "/proc/scsi/scsi" or
+                "/proc/ide/hd0/model") and
+  not user.name:root
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -67,36 +65,3 @@ user.name:root
 ** Name: System Information Discovery
 ** ID: T1082
 ** Reference URL: https://attack.mitre.org/techniques/T1082/
-
-[[virtual-machine-fingerprinting-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.1 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:executed and
-process.args:("/sys/class/dmi/id/bios_version" or
-"/sys/class/dmi/id/product_name" or "/sys/class/dmi/id/chassis_vendor"
-or "/proc/scsi/scsi" or "/proc/ide/hd0/model") and not user.name:root
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
index 2fa95ecd8e..1d675fed1e 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
@@ -5,7 +5,7 @@ Identifies the execution of macOS built-in commands to connect to an existing Vi
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,59 +14,55 @@ Identifies the execution of macOS built-in commands to connect to an existing Vi
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/manage/vpn.rb
 * https://www.unix.com/man-page/osx/8/networksetup/
 * https://superuser.com/questions/358513/start-configured-vpn-from-command-line-osx
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Lateral Movement
-
-*Version*: 100 (<<virtual-private-network-connection-attempt-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type in ("start", "process_started") and (
-(process.name : "networksetup" and process.args :
-"-connectpppoeservice") or (process.name : "scutil" and
-process.args : "--nc" and process.args : "start") or (process.name
-: "osascript" and process.command_line : "osascript*set VPN to
-service*") )
+[source, js]
 ----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  (
+    (process.name : "networksetup" and process.args : "-connectpppoeservice") or
+    (process.name : "scutil" and process.args : "--nc" and process.args : "start") or
+    (process.name : "osascript" and process.command_line : "osascript*set VPN to service*")
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -78,16 +74,3 @@ service*") )
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[virtual-private-network-connection-attempt-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc
index 31fe6e5058..0d84812a26 100644
--- a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc
@@ -5,70 +5,82 @@ This rule detects network events that may indicate the use of VNC traffic from t
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<vnc-virtual-network-computing-from-the-internet-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port >= 5800 and destination.port <= 5810 and not
-source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.0.0.0/24 or 192.0.0.0/29 or
-192.0.0.8/32 or 192.0.0.9/32 or 192.0.0.10/32 or
-192.0.0.170/32 or 192.0.0.171/32 or 192.0.2.0/24 or
-192.31.196.0/24 or 192.52.193.0/24 or 192.168.0.0/16 or
-192.88.99.0/24 or 224.0.0.0/4 or 100.64.0.0/10 or
-192.175.48.0/24 or 198.18.0.0/15 or 198.51.100.0/24 or
-203.0.113.0/24 or 240.0.0.0/4 or "::1" or "FE80::/10" or
-"FF00::/8" ) and destination.ip:( 10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16 )
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,8 +92,6 @@ source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
 ** Name: Remote Access Software
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
-
-
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -90,75 +100,3 @@ source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[vnc-virtual-network-computing-from-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 11 (7.15.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port >= 5800 and destination.port <= 5810 and not
-source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or "::1" or "FE80::/10"
-or "FF00::/8" ) and destination.ip:( 10.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 )
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port >= 5800 and destination.port <= 5810 and not
-source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1") and destination.ip:(10.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port >= 5800 and
-destination.port <= 5810 and not source.ip:(10.0.0.0/8 or 127.0.0.0/8
-or 172.16.0.0/12 or 192.168.0.0/16 or "::1") and
-destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
-----------------------------------
-
-Version 3 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport: tcp and (destination.port >= 5800 and
-destination.port <= 5810) and ( network.direction: inbound or ( not
-source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and
-destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) ) )
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc
index 5cbf53ddf2..3ce420c0d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc
@@ -5,70 +5,82 @@ This rule detects network events that may indicate the use of VNC traffic to the
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
-* auditbeat-*
-* filebeat-*
 * packetbeat-*
-* logs-endpoint.events.*
+* logs-network_traffic.*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Network
-* Threat Detection
-* Command and Control
-* Host
-
-*Version*: 100 (<<vnc-virtual-network-computing-to-the-internet-history, version history>>)
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port >= 5800 and destination.port <= 5810 and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16
-) and not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or
-169.254.0.0/16 or 172.16.0.0/12 or 192.0.0.0/24 or
-192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or
-192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or
-192.0.2.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or
-192.168.0.0/16 or 192.88.99.0/24 or 224.0.0.0/4 or
-100.64.0.0/10 or 192.175.48.0/24 or 198.18.0.0/15 or
-198.51.100.0/24 or 203.0.113.0/24 or 240.0.0.0/4 or "::1"
-or "FE80::/10" or "FF00::/8" )
+[source, js]
 ----------------------------------
+event.dataset: network_traffic.flow and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -80,75 +92,3 @@ or "FE80::/10" or "FF00::/8" )
 ** Name: Remote Access Software
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
-
-[[vnc-virtual-network-computing-to-the-internet-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 12 (8.4.0 release)::
-* Formatting only
-
-Version 11 (7.15.0 release)::
-* Formatting only
-
-Version 10 (7.14.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port >= 5800 and destination.port <= 5810 and
-source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 ) and not
-destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or
-172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or "::1" or "FE80::/10"
-or "FF00::/8" )
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:(network or network_traffic) and network.transport:tcp
-and destination.port >= 5800 and destination.port <= 5810 and
-source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not
-destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport:tcp and destination.port >= 5800 and
-destination.port <= 5810 and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or
-192.168.0.0/16) and not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or
-172.16.0.0/12 or 192.168.0.0/16 or "::1")
-----------------------------------
-
-Version 3 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-network.transport: tcp and (destination.port >= 5800 and
-destination.port <= 5810) and ( network.direction: outbound or (
-source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and not
-destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) ) )
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Removed auditbeat-\*, packetbeat-*, and winlogbeat-* from the rule indices.
-
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
index cdab4ef972..c7ae863128 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
@@ -5,63 +5,61 @@ Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<volume-shadow-copy-deleted-or-resized-via-vssadmin-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Volume Shadow Copy Deleted or Resized via VssAdmin
 
-The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes
-that can later be restored or mounted to recover specific files or folders.
+The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
 
-A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow
-Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow
-copies worth monitoring.
+A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.
 
 This rule monitors the execution of Vssadmin.exe to either delete or resize shadow copies.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.
@@ -81,8 +79,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This rule may produce benign true positives (B-TPs). If this activity is expected and noisy in your
-environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+- This rule may produce benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Related rules
 
@@ -98,33 +95,26 @@ environment, consider adding exceptions — preferably with a combination of use
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - If data was encrypted, deleted, or modified, activate your data recovery plan.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-"vssadmin.exe" or process.pe.original_file_name == "VSSADMIN.EXE") and
-process.args in ("delete", "resize") and process.args : "shadows*"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start"
+  and (process.name : "vssadmin.exe" or process.pe.original_file_name == "VSSADMIN.EXE") and
+  process.args in ("delete", "resize") and process.args : "shadows*"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -136,96 +126,3 @@ process.args in ("delete", "resize") and process.args : "shadows*"
 ** Name: Inhibit System Recovery
 ** ID: T1490
 ** Reference URL: https://attack.mitre.org/techniques/T1490/
-
-[[volume-shadow-copy-deleted-or-resized-via-vssadmin-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "vssadmin.exe" or process.pe.original_file_name ==
-"VSSADMIN.EXE") and process.args in ("delete", "resize") and
-process.args : "shadows*"
-----------------------------------
-
-Version 15 (8.4.0 release)::
-* Formatting only
-
-Version 13 (8.3.0 release)::
-* Formatting only
-
-Version 12 (8.2.0 release)::
-* Formatting only
-
-Version 11 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-event.action == "start" and (process.name : "vssadmin.exe" or
-process.pe.original_file_name == "VSSADMIN.EXE") and process.args in
-("delete", "resize") and process.args : "shadows*"
-----------------------------------
-
-Version 10 (7.16.0 release)::
-* Rule name changed from: Volume Shadow Copy Deletion via VssAdmin
-+
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "vssadmin.exe" or process.pe.original_file_name ==
-"VSSADMIN.EXE") and process.args : "delete" and process.args :
-"shadows"
-----------------------------------
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:vssadmin.exe and process.args:(delete and shadows)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:vssadmin.exe and process.args:(delete and shadows)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"vssadmin.exe" and process.args:("delete" and "shadows")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
index 8d52038149..62883d7204 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
@@ -5,65 +5,62 @@ Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy
 * https://powershell.one/wmi/root/cimv2/win32_shadowcopy
 * https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
-
-*Version*: 102 (<<volume-shadow-copy-deletion-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.16.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Austin Songer
+* Elastic
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Volume Shadow Copy Deletion via PowerShell
 
-The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes
-that can later be restored or mounted to recover specific files or folders.
+The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
 
-A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow
-Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow
-copies worth monitoring.
+A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.
 
-This rule monitors the execution of PowerShell cmdlets to interact with the Win32_ShadowCopy WMI class, retrieve shadow
-copy objects, and delete them.
+This rule monitors the execution of PowerShell cmdlets to interact with the Win32_ShadowCopy WMI class, retrieve shadow copy objects, and delete them.
 
 #### Possible investigation steps
 
@@ -86,8 +83,7 @@ copy objects, and delete them.
 
 ### False positive analysis
 
-- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your
-environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Related rules
 
@@ -103,36 +99,28 @@ environment, consider adding exceptions — preferably with a combination of use
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - If data was encrypted, deleted, or modified, activate your data recovery plan.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
-process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-CimInstance*",
-"*gcim*") and process.args : ("*Win32_ShadowCopy*") and
-process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*",
-"*Remove-CimInstance*", "*rcim*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+  process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-CimInstance*", "*gcim*") and
+  process.args : ("*Win32_ShadowCopy*") and
+  process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*", "*Remove-CimInstance*", "*rcim*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -144,42 +132,3 @@ process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*",
 ** Name: Inhibit System Recovery
 ** ID: T1490
 ** Reference URL: https://attack.mitre.org/techniques/T1490/
-
-[[volume-shadow-copy-deletion-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
-and process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-
-CimInstance*", "*gcim*") and process.args : ("*Win32_ShadowCopy*")
-and process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*",
-"*Remove-CimInstance*", "*rcim*")
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
-and process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-
-CimInstance*", "*gcim*") and process.args : ("*Win32_ShadowCopy*")
-and process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*",
-"*Remove-CimInstance*", "*rcim*")
-----------------------------------
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
index 262e1c403a..246789186d 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
@@ -5,56 +5,55 @@ Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Impact
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<volume-shadow-copy-deletion-via-wmic-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Volume Shadow Copy Deletion via WMIC
 
-The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes
-that can later be restored or mounted to recover specific files or folders.
+The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
 
-A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow
-Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow
-copies worth monitoring.
+A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.
 
 This rule monitors the execution of `wmic.exe` to interact with VSS via the `shadowcopy` alias and delete parameter.
 
@@ -80,8 +79,7 @@ This rule monitors the execution of `wmic.exe` to interact with VSS via the `sha
 
 ### False positive analysis
 
-- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your
-environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
 ### Related rules
 
@@ -97,33 +95,26 @@ environment, consider adding exceptions — preferably with a combination of use
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - If data was encrypted, deleted, or modified, activate your data recovery plan.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name : "WMIC.exe"
-or process.pe.original_file_name == "wmic.exe") and process.args :
-"delete" and process.args : "shadowcopy"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "WMIC.exe" or process.pe.original_file_name == "wmic.exe") and
+  process.args : "delete" and process.args : "shadowcopy"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,75 +126,3 @@ or process.pe.original_file_name == "wmic.exe") and process.args :
 ** Name: Inhibit System Recovery
 ** ID: T1490
 ** Reference URL: https://attack.mitre.org/techniques/T1490/
-
-[[volume-shadow-copy-deletion-via-wmic-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-(process.name : "WMIC.exe" or process.pe.original_file_name ==
-"wmic.exe") and process.args : "delete" and process.args :
-"shadowcopy"
-----------------------------------
-
-Version 14 (8.4.0 release)::
-* Formatting only
-
-Version 12 (8.3.0 release)::
-* Formatting only
-
-Version 11 (8.2.0 release)::
-* Formatting only
-
-Version 10 (7.16.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:WMIC.exe and process.args:(delete and shadowcopy)
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:WMIC.exe and process.args:(delete and shadowcopy)
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.name:"WMIC.exe" and process.args:("shadowcopy" and "delete")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-post-request-declined.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-post-request-declined.asciidoc
index 68be9d1074..9d3ed969d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-post-request-declined.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-post-request-declined.asciidoc
@@ -5,7 +5,7 @@ A POST request to a web application returned a 403 response, which indicates the
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * apm-*-transaction*
 * traces-apm*
@@ -14,76 +14,34 @@ A POST request to a web application returned a 403 response, which indicates the
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://en.wikipedia.org/wiki/HTTP_403
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* APM
-
-*Version*: 100 (<<web-application-suspicious-activity-post-request-declined-history, version history>>)
+* Data Source: APM
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-http.response.status_code:403 and http.request.method:post
-----------------------------------
-
-
-[[web-application-suspicious-activity-post-request-declined-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (7.15.0 release)::
-* Formatting only
-
-Version 7 (7.14.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
 http.response.status_code:403 and http.request.method:post
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-sqlmap-user-agent.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-sqlmap-user-agent.asciidoc
index 57116afe8e..3bf0a25608 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-sqlmap-user-agent.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-sqlmap-user-agent.asciidoc
@@ -5,7 +5,7 @@ This is an example of how to detect an unwanted web client user agent. This sear
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * apm-*-transaction*
 * traces-apm*
@@ -14,73 +14,34 @@ This is an example of how to detect an unwanted web client user agent. This sear
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * http://sqlmap.org/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* APM
-
-*Version*: 100 (<<web-application-suspicious-activity-sqlmap-user-agent-history, version history>>)
+* Data Source: APM
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-This rule does not indicate that a SQL injection attack occurred, only that the `sqlmap` tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-user_agent.original:"sqlmap/1.3.11#stable (http://sqlmap.org)"
-----------------------------------
-
-
-[[web-application-suspicious-activity-sqlmap-user-agent-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 7 (7.14.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
 user_agent.original:"sqlmap/1.3.11#stable (http://sqlmap.org)"
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-unauthorized-method.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-unauthorized-method.asciidoc
index 2c42542551..ad45382b80 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-unauthorized-method.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-application-suspicious-activity-unauthorized-method.asciidoc
@@ -5,7 +5,7 @@ A request to a web application returned a 405 response, which indicates the web
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * apm-*-transaction*
 * traces-apm*
@@ -14,76 +14,34 @@ A request to a web application returned a 405 response, which indicates the web
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://en.wikipedia.org/wiki/HTTP_405
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* APM
-
-*Version*: 100 (<<web-application-suspicious-activity-unauthorized-method-history, version history>>)
+* Data Source: APM
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity.
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-http.response.status_code:405
-----------------------------------
-
-
-[[web-application-suspicious-activity-unauthorized-method-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 9 (8.4.0 release)::
-* Formatting only
-
-Version 8 (7.15.0 release)::
-* Formatting only
-
-Version 7 (7.14.0 release)::
-* Updated query, changed from:
-+
 [source, js]
 ----------------------------------
 http.response.status_code:405
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
 
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
index 40b18908fe..4e5bb6f655 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
@@ -5,72 +5,63 @@ Identifies suspicious commands executed via a web server, which may suggest a vu
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/
 * https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965
 * https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<web-shell-detection-script-process-child-of-common-web-processes-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.15.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Security audits, maintenance, and network administrative scripts may trigger this alert when run under web processes.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Web Shell Detection: Script Process Child of Common Web Processes
 
-Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web
-script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a
-network. A web shell may provide a set of functions to execute or a command-line interface on the system that hosts the
-web server.
+Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a network. A web shell may provide a set of functions to execute or a command-line interface on the system that hosts the web server.
 
-This rule detects a web server process spawning script and command-line interface programs, potentially indicating
-attackers executing commands using the web shell.
+This rule detects a web server process spawning script and command-line interface programs, potentially indicating attackers executing commands using the web shell.
 
 #### Possible investigation steps
 
-- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file
-modifications, and any other spawned child processes.
+- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any other spawned child processes.
 - Examine the command line to determine which commands or scripts were executed.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
@@ -86,8 +77,7 @@ modifications, and any other spawned child processes.
 
 ### False positive analysis
 
-- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently
-malicious must be monitored by the security team.
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
 ### Response and remediation
 
@@ -97,33 +87,24 @@ malicious must be monitored by the security team.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe",
-"tomcat.exe") and process.name : ("cmd.exe", "cscript.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe",
-"wscript.exe")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and
+  process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe", "wscript.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -135,8 +116,10 @@ process where event.type == "start" and process.parent.name :
 ** Name: Server Software Component
 ** ID: T1505
 ** Reference URL: https://attack.mitre.org/techniques/T1505/
-
-
+* Sub-technique:
+** Name: Web Shell
+** ID: T1505.003
+** Reference URL: https://attack.mitre.org/techniques/T1505/003/
 * Tactic:
 ** Name: Initial Access
 ** ID: TA0001
@@ -145,38 +128,3 @@ process where event.type == "start" and process.parent.name :
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[web-shell-detection-script-process-child-of-common-web-processes-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Rule name changed from: Webshell Detection: Script Process Child of Common Web Processes
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe",
-"tomcat.exe") and process.name : ("cmd.exe", "cscript.exe",
-"powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe",
-"wscript.exe")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe",
-"tomcat.exe") and process.name : ("cmd.exe", "cscript.exe",
-"powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
index 182ac6b832..44da05252a 100644
--- a/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies the use of the built-in networksetup command to configure webproxy se
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * logs-endpoint.events.*
@@ -14,55 +14,45 @@ Identifies the use of the built-in networksetup command to configure webproxy se
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
 * https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Credential Access
-
-*Version*: 100 (<<webproxy-settings-modification-history, version history>>)
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Legitimate WebProxy Settings Modification
 
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.category : process and event.type : start and process.name :
-networksetup and process.args : (("-setwebproxy" or
-"-setsecurewebproxy" or "-setautoproxyurl") and not (Bluetooth or
-off)) and not process.parent.executable :
-("/Library/PrivilegedHelperTools/com.80pct.FreedomHelper" or
-"/Applications/Fiddler
-Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi" or
-"/usr/libexec/xpcproxy")
+[source, js]
 ----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+ process.name : networksetup and process.args : (("-setwebproxy" or "-setsecurewebproxy" or "-setautoproxyurl") and not (Bluetooth or off)) and
+ not process.parent.executable : ("/Library/PrivilegedHelperTools/com.80pct.FreedomHelper" or
+                                  "/Applications/Fiddler Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi" or
+                                  "/usr/libexec/xpcproxy")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -74,23 +64,3 @@ Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi" or
 ** Name: Steal Web Session Cookie
 ** ID: T1539
 ** Reference URL: https://attack.mitre.org/techniques/T1539/
-
-[[webproxy-settings-modification-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:start and
-process.name:networksetup and process.args:("-setwebproxy" or
-"-setsecurewebproxy" or "-setautoproxyurl")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc
index 5eaf8fb2ea..7dcf9c71f9 100644
--- a/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc
@@ -5,7 +5,7 @@ Identifies the deletion of WebServer access logs. This may indicate an attempt t
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * auditbeat-*
 * winlogbeat-*
@@ -16,55 +16,53 @@ Identifies the deletion of WebServer access logs. This may indicate an attempt t
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Linux
-* Windows
-* macOS
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<webserver-access-logs-deleted-history, version history>>)
+* Domain: Endpoint
+* OS: Linux
+* OS: Windows
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 102
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "deletion" and file.path :
-("C:\\inetpub\\logs\\LogFiles\\*.log",
-"/var/log/apache*/access.log",
-"/etc/httpd/logs/access_log",
-"/var/log/httpd/access_log",
-"/var/www/*/logs/access.log")
+[source, js]
 ----------------------------------
+file where event.type == "deletion" and
+  file.path : ("C:\\inetpub\\logs\\LogFiles\\*.log",
+               "/var/log/apache*/access.log",
+               "/etc/httpd/logs/access_log",
+               "/var/log/httpd/access_log",
+               "/var/www/*/logs/access.log")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -73,35 +71,6 @@ file where event.type == "deletion" and file.path :
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[webserver-access-logs-deleted-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "deletion" and file.path :
-("C:\\inetpub\\logs\\LogFiles\\*.log",
-"/var/log/apache*/access.log",
-"/etc/httpd/logs/access_log",
-"/var/log/httpd/access_log",
-"/var/www/*/logs/access.log")
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
index 7d463211ea..215bacee88 100644
--- a/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
@@ -5,7 +5,7 @@ Identifies suspicious use of whoami.exe which displays user, group, and privileg
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -17,65 +17,55 @@ Identifies suspicious use of whoami.exe which displays user, group, and privileg
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<whoami-process-activity-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Whoami Process Activity
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `whoami` utility. Attackers commonly use this utility to measure their current
-privileges, discover the current user, determine if a privilege escalation was successful, etc.
+This rule looks for the execution of the `whoami` utility. Attackers commonly use this utility to measure their current privileges, discover the current user, determine if a privilege escalation was successful, etc.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Related rules
 
@@ -85,41 +75,37 @@ suspicious activity related to the user or host, such alerts can be dismissed.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "whoami.exe"
-and ( (/* scoped for whoami execution under system privileges */
-(user.domain : ("NT AUTHORITY", "NT-AUTORITÄT", "AUTORITE NT", "IIS
-APPPOOL") or user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")) and
-not (process.parent.name : "cmd.exe" and process.parent.args :
-("chcp 437>nul 2>&1 & C:\\WINDOWS\\System32\\whoami.exe /groups",
-"chcp 437>nul 2>&1 & %systemroot%\\system32\\whoami /user",
-"C:\\WINDOWS\\System32\\whoami.exe /groups",
-"*WINDOWS\\system32\\config\\systemprofile*")) and not
-(process.parent.executable :
-"C:\\Windows\\system32\\inetsrv\\appcmd.exe" and process.parent.args :
-"LIST") and not process.parent.executable : ("C:\\Program
-Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe",
-"C:\\Program Files\\Cohesity\\cohesity_windows_agent_service.exe")) or
-process.parent.name : ("wsmprovhost.exe", "w3wp.exe", "wmiprvse.exe",
-"rundll32.exe", "regsvr32.exe") )
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name : "whoami.exe" and
+(
+
+ (/* scoped for whoami execution under system privileges */
+  (user.domain : ("NT AUTHORITY", "NT-AUTORITÄT", "AUTORITE NT", "IIS APPPOOL") or user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")) and
+
+   not (process.parent.name : "cmd.exe" and
+        process.parent.args : ("chcp 437>nul 2>&1 & C:\\WINDOWS\\System32\\whoami.exe  /groups",
+                               "chcp 437>nul 2>&1 & %systemroot%\\system32\\whoami /user",
+                               "C:\\WINDOWS\\System32\\whoami.exe /groups",
+                               "*WINDOWS\\system32\\config\\systemprofile*")) and
+   not (process.parent.executable : "C:\\Windows\\system32\\inetsrv\\appcmd.exe" and process.parent.args : "LIST") and
+   not process.parent.executable : ("C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe",
+                                    "C:\\Program Files\\Cohesity\\cohesity_windows_agent_service.exe")) or
+
+  process.parent.name : ("wsmprovhost.exe", "w3wp.exe", "wmiprvse.exe", "rundll32.exe", "regsvr32.exe")
 
-==== Threat mapping
+)
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -131,57 +117,3 @@ process.parent.name : ("wsmprovhost.exe", "w3wp.exe", "wmiprvse.exe",
 ** Name: System Owner/User Discovery
 ** ID: T1033
 ** Reference URL: https://attack.mitre.org/techniques/T1033/
-
-[[whoami-process-activity-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "whoami.exe"
-----------------------------------
-
-Version 11 (8.4.0 release)::
-* Formatting only
-
-Version 9 (8.3.0 release)::
-* Formatting only
-
-Version 8 (8.2.0 release)::
-* Formatting only
-
-Version 7 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:whoami.exe
-----------------------------------
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:whoami.exe and event.code:1
-----------------------------------
-
-Version 3 (7.9.0 release)::
-* Formatting only
-
-Version 2 (7.7.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball.asciidoc
index 8f9f0cc686..a804dc6ca2 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball.asciidoc
@@ -5,7 +5,7 @@ A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) valid
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-windows.*
@@ -14,40 +14,39 @@ A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) valid
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
+*Tags*: 
 
-*Version*: 100 (<<windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Use Case: Vulnerability
 
-*Added ({stack} release)*: 7.7.0
+*Version*: 103
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.provider:"Microsoft-Windows-Audit-CVE" and
-message:"[CVE-2020-0601]"
+[source, js]
 ----------------------------------
+event.provider:"Microsoft-Windows-Audit-CVE" and message:"[CVE-2020-0601]" and host.os.type:windows
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -59,28 +58,7 @@ message:"[CVE-2020-0601]"
 ** Name: Subvert Trust Controls
 ** ID: T1553
 ** Reference URL: https://attack.mitre.org/techniques/T1553/
-
-[[windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.12.0 release)::
-* Formatting only
-
-Version 5 (7.11.2 release)::
-* Formatting only
-
-Version 4 (7.11.0 release)::
-* Formatting only
-
-Version 3 (7.10.0 release)::
-* Formatting only
-
-Version 2 (7.9.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Code Signing
+** ID: T1553.002
+** Reference URL: https://attack.mitre.org/techniques/T1553/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
index c02a74f48d..a91103ecf6 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to the Windows Defender registry settings to disable th
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,56 +16,51 @@ Identifies modifications to the Windows Defender registry settings to disable th
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://thedfirreport.com/2020/12/13/defender-control/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<windows-defender-disabled-via-registry-modification-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Defender Disabled via Registry Modification
 
-Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple
-environments. Disabling it is a common step in threat actor playbooks.
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
 
 This rule monitors the registry for configurations that disable Windows Defender or the start of its service.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate
-software installations.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -73,9 +68,7 @@ software installations.
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity,
-the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting),
-and no other suspicious activity has been observed.
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
 
 ### Related rules
 
@@ -86,40 +79,43 @@ and no other suspicious activity has been observed.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Re-enable Windows Defender and restore the service configurations to automatic start.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-registry where event.type in ("creation", "change") and ( (
-registry.path: ( "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware",
-"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" ) and registry.data.strings:
-("1", "0x00000001") ) or ( registry.path: (
-"HKLM\\System\\*ControlSet*\\Services\\WinDefend\\Start", "\\R
-EGISTRY\\MACHINE\\System\\*ControlSet*\\Services\\WinDefend\\Start"
-) and registry.data.strings in ("3", "4", "0x00000003",
-"0x00000004") ) ) and not process.executable :
-("?:\\WINDOWS\\system32\\services.exe",
-"?:\\Windows\\System32\\svchost.exe", "?:\\Program Files
-(x86)\\Trend Micro\\Security Agent\\NTRmv.exe")
+[source, js]
 ----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  (
+    (
+      registry.path: (
+        "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
+        "\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware"
+      ) and
+      registry.data.strings: ("1", "0x00000001")
+   ) or
+   (
+      registry.path: (
+        "HKLM\\System\\*ControlSet*\\Services\\WinDefend\\Start",
+        "\\REGISTRY\\MACHINE\\System\\*ControlSet*\\Services\\WinDefend\\Start"
+      ) and
+      registry.data.strings in ("3", "4", "0x00000003", "0x00000004")
+   )
+  ) and
+
+  not process.executable :
+           ("?:\\WINDOWS\\system32\\services.exe",
+            "?:\\Windows\\System32\\svchost.exe",
+            "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\NTRmv.exe")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -131,65 +127,11 @@ EGISTRY\\MACHINE\\System\\*ControlSet*\\Services\\WinDefend\\Start"
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[windows-defender-disabled-via-registry-modification-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and ( (
-registry.path:"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" and registry.data.strings: ("1",
-"0x00000001") ) or (
-registry.path:"HKLM\\System\\*ControlSet*\\Services\\WinDefend\\Start"
-and registry.data.strings in ("3", "4", "0x00000003",
-"0x00000004") ) ) and not process.executable :
-("?:\\WINDOWS\\system32\\services.exe",
-"?:\\Windows\\System32\\svchost.exe", "?:\\Program Files
-(x86)\\Trend Micro\\Security Agent\\NTRmv.exe")
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and ( (
-registry.path:"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" and registry.data.strings: ("1",
-"0x00000001") ) or (
-registry.path:"HKLM\\System\\*ControlSet*\\Services\\WinDefend\\Start"
-and registry.data.strings in ("3", "4", "0x00000003",
-"0x00000004") ) )
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (8.1.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-registry where event.type in ("creation", "change") and
-((registry.path:"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows
-Defender\\DisableAntiSpyware" and registry.data.strings:"1") or
-(registry.path:"HKLM\\System\\ControlSet*\\Services\\WinDefend\\Start"
-and registry.data.strings in ("3", "4")))
-----------------------------------
-
-Version 3 (7.15.0 release)::
-* Formatting only
-
-Version 2 (7.13.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
index b68ce41225..3a3ab64598 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
@@ -5,7 +5,7 @@ Identifies modifications to the Windows Defender configuration settings using Po
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
@@ -16,55 +16,48 @@ Identifies modifications to the Windows Defender configuration settings using Po
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<windows-defender-exclusions-added-via-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.14.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Defender Exclusions Added via PowerShell
 
-Microsoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is
-used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration
-settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of
-the more notable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/)
-was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more notable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Examine the exclusion in order to determine the intent behind it.
@@ -81,9 +74,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This rule has a high chance to produce false positives due to how often network administrators legitimately configure
-exclusions. In order to validate the activity further, review the specific exclusion and its intent. There are many
-legitimate reasons for exclusions, so it's important to gain context.
+- This rule has a high chance to produce false positives due to how often network administrators legitimately configure exclusions. In order to validate the activity further, review the specific exclusion and its intent. There are many legitimate reasons for exclusions, so it's important to gain context.
 
 ### Related rules
 
@@ -98,31 +89,25 @@ legitimate reasons for exclusions, so it's important to gain context.
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Exclusion lists for antimalware capabilities should always be routinely monitored for review.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and (process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-process.pe.original_file_name in ("powershell.exe", "pwsh.dll",
-"powershell_ise.exe")) and process.args : ("*Add-MpPreference*",
-"*Set-MpPreference*") and process.args : ("*-Exclusion*")
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")) and
+  process.args : ("*Add-MpPreference*", "*Set-MpPreference*") and
+  process.args : ("*-Exclusion*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -134,8 +119,14 @@ process.pe.original_file_name in ("powershell.exe", "pwsh.dll",
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -144,51 +135,7 @@ process.pe.original_file_name in ("powershell.exe", "pwsh.dll",
 ** Name: Command and Scripting Interpreter
 ** ID: T1059
 ** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[windows-defender-exclusions-added-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 10 (8.4.0 release)::
-* Formatting only
-
-Version 8 (8.3.0 release)::
-* Formatting only
-
-Version 7 (8.2.0 release)::
-* Formatting only
-
-Version 6 (8.1.0 release)::
-* Formatting only
-
-Version 5 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-process.pe.original_file_name in ("powershell.exe", "pwsh.dll",
-"powershell_ise.exe")) and process.args : ("*Add-
-MpPreference*-Exclusion*", "*Set-MpPreference*-Exclusion*")
-----------------------------------
-
-Version 4 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and (process.name :
-("powershell.exe", "pwsh.exe") or process.pe.original_file_name :
-("powershell.exe", "pwsh.exe")) and process.args : ("*Add-
-MpPreference*-Exclusion*", "*Set-MpPreference*-Exclusion*")
-----------------------------------
-
-Version 2 (7.15.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc
index 6c10e26580..b28dd0c843 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc
@@ -5,58 +5,58 @@ Identifies attempts to clear Windows event log stores. This is often done by att
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<windows-event-logs-cleared-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 7.12.0
+*Version*: 107
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic, Anabella Cristaldi
+* Elastic
+* Anabella Cristaldi
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Event Logs Cleared
 
-Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries
-can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
 
 This rule looks for the occurrence of clear actions on the `security` event log.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -70,30 +70,23 @@ for prevalence, whether they are located in expected locations, and if they are
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
-  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous
-  actions, if any, are investigated accordingly with their response playbooks.
+  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
 - Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.action:("audit-log-cleared" or "Log clear")
+[source, js]
 ----------------------------------
+event.action:("audit-log-cleared" or "Log clear") and winlog.api:"wineventlog"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -102,28 +95,10 @@ event.action:("audit-log-cleared" or "Log clear")
 ** ID: TA0005
 ** Reference URL: https://attack.mitre.org/tactics/TA0005/
 * Technique:
-** Name: Indicator Removal on Host
+** Name: Indicator Removal
 ** ID: T1070
 ** Reference URL: https://attack.mitre.org/techniques/T1070/
-
-[[windows-event-logs-cleared-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.3.0 release)::
-* Formatting only
-
-Version 3 (8.2.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
index cbbf52e3f4..e0a6de266d 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
@@ -5,7 +5,7 @@ Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,64 +16,55 @@ Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps
 * https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
 * http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
 * http://woshub.com/manage-windows-firewall-powershell/
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-* Elastic Endgame
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Version*: 102 (<<windows-firewall-disabled-via-powershell-history, version history>>)
+*Version*: 105
 
-*Added ({stack} release)*: 8.0.0
+*Rule authors*: 
 
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Austin Songer
+* Austin Songer
 
 *Rule license*: Elastic License v2
 
-==== Potential false positives
-
-Windows Firewall can be disabled by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Windows Profile being disabled by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Firewall Disabled via PowerShell
 
-Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a
-device and blocks unauthorized network traffic flowing into or out of the local device.
+Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
 
 Attackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.
 
-This rule identifies patterns related to disabling the Windows firewall or its rules using the `Set-NetFirewallProfile`
-PowerShell cmdlet.
+This rule identifies patterns related to disabling the Windows firewall or its rules using the `Set-NetFirewallProfile` PowerShell cmdlet.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -81,8 +72,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing
-troubleshooting.
+- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
 - In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
 
 ### Response and remediation
@@ -90,30 +80,24 @@ troubleshooting.
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
 - Re-enable the firewall with its desired configurations.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.action == "start" and (process.name :
-("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-process.pe.original_file_name == "PowerShell.EXE") and process.args
-: "*Set-NetFirewallProfile*" and (process.args : "*-Enabled*" and
-process.args : "*False*") and (process.args : "*-All*" or
-process.args : ("*Public*", "*Domain*", "*Private*"))
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.action == "start" and
+  (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or process.pe.original_file_name == "PowerShell.EXE") and
+   process.args : "*Set-NetFirewallProfile*" and
+  (process.args : "*-Enabled*" and process.args : "*False*") and
+  (process.args : "*-All*" or process.args : ("*Public*", "*Domain*", "*Private*"))
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -125,25 +109,7 @@ process.args : ("*Public*", "*Domain*", "*Private*"))
 ** Name: Impair Defenses
 ** ID: T1562
 ** Reference URL: https://attack.mitre.org/techniques/T1562/
-
-[[windows-firewall-disabled-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.3.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc
index d1891d913f..faf715b435 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc
@@ -5,7 +5,7 @@ Identifies attempts to enumerate hosts in a network using the built-in Windows n
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -16,97 +16,87 @@ Identifies attempts to enumerate hosts in a network using the built-in Windows n
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Investigation Guide
-* Elastic Endgame
+*Tags*: 
 
-*Version*: 102 (<<windows-network-enumeration-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Network Enumeration
 
-After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
-This can happen by running commands to enumerate network resources, users, connections, files, and installed security
-software.
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
-This rule looks for the execution of the `net` utility to enumerate servers in the environment that hosts shared drives
-or printers. This information is useful to attackers as they can identify targets for lateral movements and search for
-valuable shared data.
+This rule looks for the execution of the `net` utility to enumerate servers in the environment that hosts shared drives or printers. This information is useful to attackers as they can identify targets for lateral movements and search for valuable shared data.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
 ### False positive analysis
 
-- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
-suspicious activity related to the user or host, such alerts can be dismissed.
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
 ### Response and remediation
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and ((process.name : "net.exe"
-or process.pe.original_file_name == "net.exe") or ((process.name :
-"net1.exe" or process.pe.original_file_name == "net1.exe") and
-not process.parent.name : "net.exe")) and (process.args : "view" or
-(process.args : "time" and process.args : "\\\\*")) /* expand when
-ancestry is available and not descendant of [process where
-event.type == "start" and process.name : "cmd.exe" and
-((process.parent.name : "userinit.exe") or
-(process.parent.name : "gpscript.exe") or
-(process.parent.name : "explorer.exe" and
-process.args : "C:\\*\\Start Menu\\Programs\\Startup\\*.bat*"))] */
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  ((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or
+   ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and
+       not process.parent.name : "net.exe")) and
+  (process.args : "view" or (process.args : "time" and process.args : "\\\\*"))
+
 
-==== Threat mapping
+  /* expand when ancestry is available
+  and not descendant of [process where event.type == "start" and process.name : "cmd.exe" and
+                           ((process.parent.name : "userinit.exe") or
+                            (process.parent.name : "gpscript.exe") or
+                            (process.parent.name : "explorer.exe" and
+                               process.args : "C:\\*\\Start Menu\\Programs\\Startup\\*.bat*"))]
+  */
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -118,65 +108,7 @@ process.args : "C:\\*\\Start Menu\\Programs\\Startup\\*.bat*"))] */
 ** Name: Remote System Discovery
 ** ID: T1018
 ** Reference URL: https://attack.mitre.org/techniques/T1018/
-
-[[windows-network-enumeration-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name : "net.exe" or process.pe.original_file_name ==
-"net.exe") or ((process.name : "net1.exe" or
-process.pe.original_file_name == "net1.exe") and not
-process.parent.name : "net.exe")) and (process.args : "view" or
-(process.args : "time" and process.args : "\\\\*")) /* expand when
-ancestry is available and not descendant of [process where
-event.type == ("start", "process_started") and process.name :
-"cmd.exe" and ((process.parent.name :
-"userinit.exe") or (process.parent.name :
-"gpscript.exe") or (process.parent.name :
-"explorer.exe" and process.args :
-"C:\\*\\Start Menu\\Programs\\Startup\\*.bat*"))] */
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.3.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.15.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-((process.name : "net.exe" or process.pe.original_file_name ==
-"net.exe") or ((process.name : "net1.exe" or
-process.pe.original_file_name == "net1.exe") and not
-process.parent.name : "net.exe")) and (process.args : "view" or
-(process.args : "time" and process.args : "\\\\*")) /* expand when
-ancestory is available and not descendant of [process where
-event.type == ("start", "process_started") and process.name :
-"cmd.exe" and ((process.parent.name :
-"userinit.exe") or (process.parent.name :
-"gpscript.exe") or (process.parent.name :
-"explorer.exe" and process.args :
-"C:\\*\\Start Menu\\Programs\\Startup\\*.bat*"))] */
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
+* Technique:
+** Name: Network Share Discovery
+** ID: T1135
+** Reference URL: https://attack.mitre.org/techniques/T1135/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
index b6b7b42fde..b1f4507f65 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
@@ -5,7 +5,7 @@ Identifies the creation or modification of a medium-size registry hive file on a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 
@@ -13,53 +13,46 @@ Identifies the creation or modification of a medium-size registry hive file on a
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.elastic.co/security-labs/detect-credential-access
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
-* Credential Access
-* Investigation Guide
-
-*Version*: 102 (<<windows-registry-file-creation-in-smb-share-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Credential Access
+* Resources: Investigation Guide
 
-*Added ({stack} release)*: 8.2.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Registry File Creation in SMB Share
 
-Dumping registry hives is a common way to access credential information. Some hives store credential material, as is the
-case for the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain
-cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to
-decrypt these secrets.
+Dumping registry hives is a common way to access credential information. Some hives store credential material, as is the case for the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
 
-Attackers can try to evade detection on the host by transferring this data to a system that is not
-monitored to be parsed and decrypted. This rule identifies the creation or modification of a medium-size registry hive
-file on an SMB share, which may indicate this kind of exfiltration attempt.
+Attackers can try to evade detection on the host by transferring this data to a system that is not monitored to be parsed and decrypted. This rule identifies the creation or modification of a medium-size registry hive file on an SMB share, which may indicate this kind of exfiltration attempt.
 
 #### Possible investigation steps
 
@@ -71,8 +64,7 @@ file on an SMB share, which may indicate this kind of exfiltration attempt.
 
 ### False positive analysis
 
-- Administrators can export registry hives for backup purposes. Check whether the user should be performing this kind of
-activity and is aware of it.
+- Administrators can export registry hives for backup purposes. Check whether the user should be performing this kind of activity and is aware of it.
 
 ### Related rules
 
@@ -82,30 +74,25 @@ activity and is aware of it.
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Reimage the host operating system and restore compromised files to clean versions.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-file where event.type == "creation" and /* regf file header */
-file.Ext.header_bytes : "72656766*" and file.size >= 30000 and
-process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*")
+[source, js]
 ----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+ /* regf file header */
+ file.Ext.header_bytes : "72656766*" and file.size >= 30000 and
+ process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -117,8 +104,10 @@ process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*")
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
 * Tactic:
 ** Name: Lateral Movement
 ** ID: TA0008
@@ -127,26 +116,7 @@ process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*")
 ** Name: Remote Services
 ** ID: T1021
 ** Reference URL: https://attack.mitre.org/techniques/T1021/
-
-[[windows-registry-file-creation-in-smb-share-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-file where event.type == "creation" and /* regf file header */
-file.Ext.header_bytes : "72656766*" and file.size >= 30000 and
-process.pid == 4 and user.id : "s-1-5-21*"
-----------------------------------
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (8.3.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
index d5caa48095..5fb4ab4ab3 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
@@ -5,62 +5,61 @@ Identifies a PowerShell process launched by either cscript.exe or wscript.exe. O
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: low
 
 *Risk score*: 21
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-* Investigation Guide
+*Tags*: 
 
-*Version*: 102 (<<windows-script-executing-powershell-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.6.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.6.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 ## Triage and analysis
 
 ### Investigating Windows Script Executing PowerShell
 
-The Windows Script Host (WSH) is an Windows automation technology, which is ideal for non-interactive scripting needs,
-such as logon scripting, administrative scripting, and machine automation.
+The Windows Script Host (WSH) is an Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.
 
-Attackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but
-can also use them to download tools and utilities needed to accomplish their goals.
+Attackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but can also use them to download tools and utilities needed to accomplish their goals.
 
 This rule looks for the spawn of the `powershell.exe` process with `cscript.exe` or `wscript.exe` as its parent process.
 
 #### Possible investigation steps
 
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate commands executed by the spawned PowerShell process.
 - If unsigned files are found on the process tree, retrieve them and determine if they are malicious:
   - Use a private sandboxed malware analysis system to perform analysis.
@@ -76,8 +75,7 @@ for prevalence, whether they are located in expected locations, and if they are
 
 ### False positive analysis
 
-- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives
-(B-TPs), exceptions can be added.
+- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
 ### Response and remediation
 
@@ -87,8 +85,7 @@ for prevalence, whether they are located in expected locations, and if they are
   - Implement temporary network rules, procedures, and segmentation to contain the malware.
   - Stop suspicious processes.
   - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 - Remove and block malicious artifacts identified during triage.
 - If the malicious file was delivered via phishing:
   - Block the email sender from sending future emails.
@@ -96,24 +93,20 @@ for prevalence, whether they are located in expected locations, and if they are
   - Remove emails from the sender from mailboxes.
   - Consider improvements to the security awareness program.
 - Reimage the host operating system and restore compromised files to clean versions.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-("cscript.exe", "wscript.exe") and process.name : "powershell.exe"
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("cscript.exe", "wscript.exe") and process.name : "powershell.exe"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -125,74 +118,7 @@ process where event.type == "start" and process.parent.name :
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[windows-script-executing-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.parent.name : ("cscript.exe", "wscript.exe") and process.name
-: "powershell.exe"
-----------------------------------
-
-Version 13 (8.4.0 release)::
-* Formatting only
-
-Version 11 (8.3.0 release)::
-* Formatting only
-
-Version 10 (8.2.0 release)::
-* Formatting only
-
-Version 9 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.parent.name:(cscript.exe or wscript.exe) and
-process.name:powershell.exe
-----------------------------------
-
-Version 8 (7.12.0 release)::
-* Formatting only
-
-Version 7 (7.11.2 release)::
-* Formatting only
-
-Version 6 (7.11.0 release)::
-* Formatting only
-
-Version 5 (7.10.0 release)::
-* Formatting only
-
-Version 4 (7.9.1 release)::
-* Formatting only
-
-Version 3 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:(cscript.exe or wscript.exe) and
-process.name:powershell.exe
-----------------------------------
-
-Version 2 (7.7.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.action:"Process Create (rule: ProcessCreate)" and
-process.parent.name:("wscript.exe" or "cscript.exe") and
-process.name:"powershell.exe"
-----------------------------------
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc
index 85ed09f2ef..8163db40e3 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc
@@ -5,62 +5,79 @@ Identifies use of the built-in Windows script interpreters (cscript.exe or wscri
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-endpoint.events.*
 * logs-windows.*
+* endgame-*
 
 *Severity*: medium
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
+*Tags*: 
 
-*Version*: 101 (<<windows-script-interpreter-executing-process-via-wmi-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Endgame
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan = 5s [any where (event.category
-== "library" or (event.category == "process" and event.action : "Image
-loaded*")) and (dll.name : "wmiutils.dll" or file.name :
-"wmiutils.dll") and process.name : ("wscript.exe", "cscript.exe")]
-[process where event.type == "start" and process.parent.name :
-"wmiprvse.exe" and user.domain != "NT AUTHORITY" and
-(process.pe.original_file_name : ( "cscript.exe",
-"wscript.exe", "PowerShell.EXE", "Cmd.Exe",
-"MSHTA.EXE", "RUNDLL32.EXE", "REGSVR32.EXE",
-"MSBuild.exe", "InstallUtil.exe", "RegAsm.exe",
-"RegSvcs.exe", "msxsl.exe", "CONTROL.EXE",
-"EXPLORER.EXE", "Microsoft.Workflow.Compiler.exe",
-"msiexec.exe" ) or process.executable :
-("C:\\Users\\*.exe", "C:\\ProgramData\\*.exe") ) ]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan = 5s
+    [any where host.os.type == "windows" and 
+     (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+     (dll.name : "wmiutils.dll" or file.name : "wmiutils.dll") and process.name : ("wscript.exe", "cscript.exe")]
+    [process where host.os.type == "windows" and event.type == "start" and
+     process.parent.name : "wmiprvse.exe" and
+     user.domain != "NT AUTHORITY" and
+     (process.pe.original_file_name :
+        (
+          "cscript.exe",
+          "wscript.exe",
+          "PowerShell.EXE",
+          "Cmd.Exe",
+          "MSHTA.EXE",
+          "RUNDLL32.EXE",
+          "REGSVR32.EXE",
+          "MSBuild.exe",
+          "InstallUtil.exe",
+          "RegAsm.exe",
+          "RegSvcs.exe",
+          "msxsl.exe",
+          "CONTROL.EXE",
+          "EXPLORER.EXE",
+          "Microsoft.Workflow.Compiler.exe",
+          "msiexec.exe"
+        ) or
+      process.executable : ("C:\\Users\\*.exe", "C:\\ProgramData\\*.exe")
+     )
+    ]
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -72,73 +89,15 @@ loaded*")) and (dll.name : "wmiutils.dll" or file.name :
 ** Name: Phishing
 ** ID: T1566
 ** Reference URL: https://attack.mitre.org/techniques/T1566/
-
-[[windows-script-interpreter-executing-process-via-wmi-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 5s [any where (event.category
-== "library" or (event.category == "process" and event.action : "Image
-loaded*")) and (dll.name : "wmiutils.dll" or file.name :
-"wmiutils.dll") and process.name : ("wscript.exe", "cscript.exe")]
-[process where event.type in ("start", "process_started") and
-process.parent.name : "wmiprvse.exe" and user.domain != "NT
-AUTHORITY" and (process.pe.original_file_name : (
-"cscript.exe", "wscript.exe", "PowerShell.EXE",
-"Cmd.Exe", "MSHTA.EXE", "RUNDLL32.EXE",
-"REGSVR32.EXE", "MSBuild.exe", "InstallUtil.exe",
-"RegAsm.exe", "RegSvcs.exe", "msxsl.exe",
-"CONTROL.EXE", "EXPLORER.EXE",
-"Microsoft.Workflow.Compiler.exe", "msiexec.exe" )
-or process.executable : ("C:\\Users\\*.exe",
-"C:\\ProgramData\\*.exe") ) ]
-----------------------------------
-
-Version 4 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 5s [library where dll.name :
-"wmiutils.dll" and process.name : ("wscript.exe", "cscript.exe")]
-[process where event.type in ("start", "process_started") and
-process.parent.name : "wmiprvse.exe" and user.domain != "NT
-AUTHORITY" and (process.pe.original_file_name : (
-"cscript.exe", "wscript.exe", "PowerShell.EXE",
-"Cmd.Exe", "MSHTA.EXE", "RUNDLL32.EXE",
-"REGSVR32.EXE", "MSBuild.exe", "InstallUtil.exe",
-"RegAsm.exe", "RegSvcs.exe", "msxsl.exe",
-"CONTROL.EXE", "EXPLORER.EXE",
-"Microsoft.Workflow.Compiler.exe", "msiexec.exe" )
-or process.executable : ("C:\\Users\\*.exe",
-"C:\\ProgramData\\*.exe") ) ]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan=5s [library where file.name :
-"wmiutils.dll" and process.name : ("wscript.exe", "cscript.exe")]
-[process where event.type in ("start", "process_started") and
-process.parent.name : "wmiprvse.exe" and user.domain != "NT
-AUTHORITY" and (process.pe.original_file_name in
-( "cscript.exe",
-"wscript.exe", "PowerShell.EXE",
-"Cmd.Exe", "MSHTA.EXE",
-"RUNDLL32.EXE", "REGSVR32.EXE",
-"MSBuild.exe", "InstallUtil.exe",
-"RegAsm.exe", "RegSvcs.exe",
-"msxsl.exe", "CONTROL.EXE",
-"EXPLORER.EXE",
-"Microsoft.Workflow.Compiler.exe",
-"msiexec.exe" ) or
-process.executable : ("C:\\Users\\*.exe", "C:\\ProgramData\\*.exe")
-) ]
-----------------------------------
-
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
index ff285bee34..c8de372d30 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
@@ -5,65 +5,61 @@ Identifies the creation of a Windows service by an unusual client process. Servi
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * winlogbeat-*
 * logs-system.*
+* logs-windows.*
 
 *Severity*: high
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://www.x86matthew.com/view_post?id=create_svc_rpc
 * https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697
 * https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0100_windows_audit_security_system_extension.md
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Privilege Escalation
-
-*Version*: 100 (<<windows-service-installed-via-an-unusual-client-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
 
-*Added ({stack} release)*: 8.1.0
+*Version*: 105
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
+[source, js]
 ----------------------------------
 event.action:"service-installed" and
-(winlog.event_data.ClientProcessId:"0" or
-winlog.event_data.ParentProcessId:"0")
-----------------------------------
+  (winlog.event_data.ClientProcessId:"0" or winlog.event_data.ParentProcessId:"0")
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,13 +71,7 @@ winlog.event_data.ParentProcessId:"0")
 ** Name: Create or Modify System Process
 ** ID: T1543
 ** Reference URL: https://attack.mitre.org/techniques/T1543/
-
-[[windows-service-installed-via-an-unusual-client-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
new file mode 100644
index 0000000000..efd5d601ab
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
@@ -0,0 +1,71 @@
+[[windows-subsystem-for-linux-distribution-installed]]
+=== Windows Subsystem for Linux Distribution Installed
+
+Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows/wsl/wsl-config
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+ registry.path : 
+       ("HK*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lxss\\*\\PackageFamilyName",
+        "\\REGISTRY\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lxss\\*\\PackageFamilyName")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
new file mode 100644
index 0000000000..e5479c9d48
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
@@ -0,0 +1,66 @@
+[[windows-subsystem-for-linux-enabled-via-dism-utility]]
+=== Windows Subsystem for Linux Enabled via Dism Utility
+
+Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type : "start" and
+ (process.name : "Dism.exe" or process.pe.original_file_name == "DISM.EXE") and 
+ process.command_line : "*Microsoft-Windows-Subsystem-Linux*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-system-information-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-system-information-discovery.asciidoc
new file mode 100644
index 0000000000..2cdf7996c1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/windows-system-information-discovery.asciidoc
@@ -0,0 +1,79 @@
+[[windows-system-information-discovery]]
+=== Windows System Information Discovery
+
+Detects the execution of commands used to discover information about the system, which attackers may use after compromising a system to gain situational awareness.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-119m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    process.name : "cmd.exe" and process.args : "ver*" and not
+    process.parent.executable : (
+        "?:\\Users\\*\\AppData\\Local\\Keybase\\upd.exe",
+        "?:\\Users\\*\\python*.exe"
+    )
+  ) or 
+  process.name : ("systeminfo.exe", "hostname.exe") or 
+  (process.name : "wmic.exe" and process.args : "os" and process.args : "get")
+) and not
+process.parent.executable : (
+    "?:\\Program Files\\*",
+    "?:\\Program Files (x86)\\*",
+    "?:\\ProgramData\\*"
+) and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-user-account-creation.asciidoc
new file mode 100644
index 0000000000..c19f1cc29d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/windows-user-account-creation.asciidoc
@@ -0,0 +1,69 @@
+[[windows-user-account-creation]]
+=== Windows User Account Creation
+
+Identifies attempts to create a Windows User Account. This is sometimes done by attackers to persist or increase access to a system or domain.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Skoetting
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.module:("system" or "security") and winlog.api:"wineventlog" and
+  (event.code:"4720" or event.action:"added-user-account")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1136.002
+** Reference URL: https://attack.mitre.org/techniques/T1136/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index bc69197605..306ff43a6a 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -16,7 +16,7 @@ Identifies attempts to dump Wireless saved access keys in clear text using the W
 
 *Risk score*: 73
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
@@ -29,42 +29,81 @@ Identifies attempts to dump Wireless saved access keys in clear text using the W
 
 *Tags*:
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Credential Access
-* Discovery
-* Elastic Endgame
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 5
 
-*Added ({stack} release)*: 8.6.0
+*Rule authors*:
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
+## Triage and analysis
 
-----------------------------------
+### Investigating Wireless Credential Dumping using Netsh Command
 
+Netsh is a Windows command line tool used for network configuration and troubleshooting. It enables the management of network settings and adapters, wireless network profiles, and other network-related tasks.
 
-==== Rule query
+This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-[source,js]
 ----------------------------------
-process where event.type == "start" and (process.name : "netsh.exe"
-or process.pe.original_file_name == "netsh.exe") and process.args :
-"wlan" and process.args : "key*clear"
+
+==== Rule query
+
+
+[source, js]
 ----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "netsh.exe" or process.pe.original_file_name == "netsh.exe") and
+  process.args : "wlan" and process.args : "key*clear"
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -76,8 +115,10 @@ or process.pe.original_file_name == "netsh.exe") and process.args :
 ** Name: OS Credential Dumping
 ** ID: T1003
 ** Reference URL: https://attack.mitre.org/techniques/T1003/
-
-
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
 * Tactic:
 ** Name: Discovery
 ** ID: TA0007
diff --git a/docs/detections/prebuilt-rules/rule-details/wmi-incoming-lateral-movement.asciidoc b/docs/detections/prebuilt-rules/rule-details/wmi-incoming-lateral-movement.asciidoc
index 8f60a69fc2..fab5cf05b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/wmi-incoming-lateral-movement.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wmi-incoming-lateral-movement.asciidoc
@@ -5,7 +5,7 @@ Identifies processes executed via Windows Management Instrumentation (WMI) on a
 
 *Rule type*: eql
 
-*Rule indices*:
+*Rule indices*: 
 
 * logs-endpoint.events.*
 * winlogbeat-*
@@ -15,50 +15,55 @@ Identifies processes executed via Windows Management Instrumentation (WMI) on a
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*Tags*:
+*References*: None
 
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Lateral Movement
+*Tags*: 
 
-*Version*: 101 (<<wmi-incoming-lateral-movement-history, version history>>)
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
 
-*Added ({stack} release)*: 7.11.0
+*Version*: 106
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-sequence by host.id with maxspan = 2s /* Accepted Incoming RPC
-connection by Winmgmt service */ [network where process.name :
-"svchost.exe" and network.direction : ("incoming", "ingress") and
-source.ip != "127.0.0.1" and source.ip != "::1" and source.port >=
-49152 and destination.port >= 49152 ] /* Excluding Common FPs
-Nessus and SCCM */ [process where event.type == "start" and
-process.parent.name : "WmiPrvSE.exe" and not process.args :
-("C:\\windows\\temp\\nessus_*.txt",
-"C:\\windows\\TEMP\\nessus_*.TMP",
-"C:\\Windows\\CCM\\SystemTemp\\*",
-"C:\\Windows\\CCMCache\\*",
-"C:\\CCM\\Cache\\*") ]
+[source, js]
 ----------------------------------
+sequence by host.id with maxspan = 2s
+
+ /* Accepted Incoming RPC connection by Winmgmt service */
+
+  [network where host.os.type == "windows" and process.name : "svchost.exe" and network.direction : ("incoming", "ingress") and
+   source.ip != "127.0.0.1" and source.ip != "::1" and source.port >= 49152 and destination.port >= 49152
+  ]
 
-==== Threat mapping
+  /* Excluding Common FPs Nessus and SCCM */
+
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "WmiPrvSE.exe" and
+   not process.args : ("C:\\windows\\temp\\nessus_*.txt",
+                       "*C:\\windows\\TEMP\\nessus_*.TMP*",
+                       "*C:\\Windows\\CCM\\SystemTemp\\*",
+                       "C:\\Windows\\CCM\\ccmrepair.exe",
+                       "C:\\Windows\\CCMCache\\*",
+                       "C:\\CCM\\Cache\\*")
+   ]
+
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -66,8 +71,6 @@ process.parent.name : "WmiPrvSE.exe" and not process.args :
 ** Name: Lateral Movement
 ** ID: TA0008
 ** Reference URL: https://attack.mitre.org/tactics/TA0008/
-
-
 * Tactic:
 ** Name: Execution
 ** ID: TA0002
@@ -76,70 +79,3 @@ process.parent.name : "WmiPrvSE.exe" and not process.args :
 ** Name: Windows Management Instrumentation
 ** ID: T1047
 ** Reference URL: https://attack.mitre.org/techniques/T1047/
-
-[[wmi-incoming-lateral-movement-history]]
-==== Rule version history
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 2s /* Accepted Incoming RPC
-connection by Winmgmt service */ [network where process.name :
-"svchost.exe" and network.direction : ("incoming", "ingress") and
-source.ip != "127.0.0.1" and source.ip != "::1" and source.port >=
-49152 and destination.port >= 49152 ] /* Excluding Common FPs
-Nessus and SCCM */ [process where event.type in ("start",
-"process_started") and process.parent.name : "WmiPrvSE.exe" and not
-process.args : ("C:\\windows\\temp\\nessus_*.txt",
-"C:\\windows\\TEMP\\nessus_*.TMP",
-"C:\\Windows\\CCM\\SystemTemp\\*",
-"C:\\Windows\\CCMCache\\*",
-"C:\\CCM\\Cache\\*") ]
-----------------------------------
-
-Version 5 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.0.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 2s /* Accepted Incoming RPC
-connection by Winmgmt service */ [network where process.name :
-"svchost.exe" and network.direction : ("incoming", "ingress") and
-source.address != "127.0.0.1" and source.address != "::1" and
-source.port >= 49152 and destination.port >= 49152 ] /* Excluding
-Common FPs Nessus and SCCM */ [process where event.type in
-("start", "process_started") and process.parent.name : "WmiPrvSE.exe"
-and not process.args : ("C:\\windows\\temp\\nessus_*.txt",
-"C:\\windows\\TEMP\\nessus_*.TMP",
-"C:\\Windows\\CCM\\SystemTemp\\*",
-"C:\\Windows\\CCMCache\\*",
-"C:\\CCM\\Cache\\*") ]
-----------------------------------
-
-Version 3 (7.16.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-sequence by host.id with maxspan = 2s /* Accepted Incoming RPC
-connection by Winmgmt service */ [network where process.name :
-"svchost.exe" and network.direction == "incoming" and
-source.address != "127.0.0.1" and source.address != "::1" and
-source.port >= 49152 and destination.port >= 49152 ] /* Excluding
-Common FPs Nessus and SCCM */ [process where event.type in
-("start", "process_started") and process.parent.name : "WmiPrvSE.exe"
-and not process.args : ("C:\\windows\\temp\\nessus_*.txt",
-"C:\\windows\\TEMP\\nessus_*.TMP",
-"C:\\Windows\\CCM\\SystemTemp\\*",
-"C:\\Windows\\CCMCache\\*",
-"C:\\CCM\\Cache\\*") ]
-----------------------------------
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/wpad-service-exploit.asciidoc b/docs/detections/prebuilt-rules/rule-details/wpad-service-exploit.asciidoc
new file mode 100644
index 0000000000..2600eb895c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/wpad-service-exploit.asciidoc
@@ -0,0 +1,71 @@
+[[wpad-service-exploit]]
+=== WPAD Service Exploit
+
+Identifies probable exploitation of the Web Proxy Auto-Discovery Protocol (WPAD) service. Attackers who have access to the local network or upstream DNS traffic can inject malicious JavaScript to the WPAD service which can lead to a full system compromise.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* preference would be to use user.sid rather than domain+name, once it is available in ECS + datasources */
+/* didn't trigger successfully during testing */
+
+sequence with maxspan=5s
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "svchost.exe" and
+     user.domain : "NT AUTHORITY" and user.name : "LOCAL SERVICE"] by process.entity_id
+  [network where host.os.type == "windows" and network.protocol : "dns" and process.name : "svchost.exe" and
+     dns.question.name : "wpad" and process.name : "svchost.exe"] by process.entity_id
+  [network where host.os.type == "windows" and process.name : "svchost.exe"
+     and network.direction : ("outgoing", "egress") and destination.port == 80] by process.entity_id
+  [library where host.os.type == "windows" and event.type : "start" and process.name : "svchost.exe" and
+     dll.name : "jscript.dll" and process.name : "svchost.exe"] by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and
+     process.parent.name : "svchost.exe"] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc b/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc
index 5a0fe5b277..c94e226886 100644
--- a/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc
@@ -5,7 +5,7 @@ This rule identifies Zoom meetings that are created without a passcode. Meetings
 
 *Rule type*: query
 
-*Rule indices*:
+*Rule indices*: 
 
 * filebeat-*
 
@@ -13,57 +13,49 @@ This rule identifies Zoom meetings that are created without a passcode. Meetings
 
 *Risk score*: 47
 
-*Runs every*: 5 minutes
+*Runs every*: 5m
 
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
-*References*:
+*References*: 
 
 * https://blog.zoom.us/a-message-to-our-users/
 * https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic
 
-*Tags*:
+*Tags*: 
 
-* Elastic
-* Application
-* Communication
-* Zoom
-* Continuous Monitoring
-* SecOps
-* Configuration Audit
-
-*Version*: 100 (<<zoom-meeting-with-no-passcode-history, version history>>)
+* Data Source: Zoom
+* Use Case: Configuration Audit
+* Tactic: Initial Access
 
-*Added ({stack} release)*: 7.10.0
+*Version*: 101
 
-*Last modified ({stack} release)*: 8.5.0
+*Rule authors*: 
 
-*Rule authors*: Elastic
+* Elastic
 
 *Rule license*: Elastic License v2
 
+
 ==== Investigation guide
 
 
-[source,markdown]
+[source, markdown]
 ----------------------------------
 
 ----------------------------------
 
-
 ==== Rule query
 
 
-[source,js]
-----------------------------------
-event.type:creation and event.module:zoom and
-event.dataset:zoom.webhook and event.action:meeting.created and not
-zoom.meeting.password:*
+[source, js]
 ----------------------------------
+event.type:creation and event.module:zoom and event.dataset:zoom.webhook and
+  event.action:meeting.created and not zoom.meeting.password:*
 
-==== Threat mapping
+----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
@@ -75,22 +67,3 @@ zoom.meeting.password:*
 ** Name: Exploit Public-Facing Application
 ** ID: T1190
 ** Reference URL: https://attack.mitre.org/techniques/T1190/
-
-[[zoom-meeting-with-no-passcode-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-

From b727f492b5fec3641e7e616eedfebdb401933310 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 12:39:29 -0500
Subject: [PATCH 02/14] fix rule name

---
 .../prebuilt-rules/prebuilt-rules-changelog.asciidoc        | 2 +-
 .../enumerating-domain-trusts-via-nltest.exe.asciidoc       | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index a03bd422b2..592d0625f8 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -151,7 +151,7 @@ information about a rule's changes, see the rule's description page.
 
 <<encrypting-files-with-winrar-or-7z>>
 
-<<enumerating-domain-trusts-via-nltest.exe>>
+<<enumerating-domain-trusts-via-nltest-exe>>
 
 <<enumeration-command-spawned-via-wmiprvse>>
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc
index ae86e864b1..860062825c 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc
@@ -1,4 +1,4 @@
-[[enumerating-domain-trusts-via-nltest.exe]]
+[[enumerating-domain-trusts-via-nltest-exe]]
 === Enumerating Domain Trusts via NLTEST.EXE
 
 Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.
@@ -36,7 +36,7 @@ Identifies the use of nltest.exe for domain trust discovery purposes. Adversarie
 * Discovery
 * Elastic Endgame
 
-*Version*: 102 (<<enumerating-domain-trusts-via-nltest.exe-history, version history>>)
+*Version*: 102 (<<enumerating-domain-trusts-via-nltest-exe-history, version history>>)
 
 *Added ({stack} release)*: 8.4.0
 
@@ -83,7 +83,7 @@ process where event.type == "start" and process.name :
 ** ID: T1482
 ** Reference URL: https://attack.mitre.org/techniques/T1482/
 
-[[enumerating-domain-trusts-via-nltest.exe-history]]
+[[enumerating-domain-trusts-via-nltest-exe-history]]
 ==== Rule version history
 
 Version 102 (8.6.0 release)::

From 06f746541091d5c2064c8780af0a8e213ad5266c Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 12:50:54 -0500
Subject: [PATCH 03/14] final changes

---
 .../prebuilt-rules-changelog.asciidoc         |   2 +
 ...ebuilt-rules-downloadable-updates.asciidoc | 104 ------------------
 2 files changed, 2 insertions(+), 104 deletions(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index 592d0625f8..33c08952a4 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -5,6 +5,8 @@ The following lists prebuilt rule updates per release. Only rules with
 significant modifications to their query or scope are listed. For detailed
 information about a rule's changes, see the rule's description page.
 
+To see the updates for 8.7 and further releases, please visit the https://www.elastic.co/guide/en/security/8.7/prebuilt-rules-downloadable-updates.html[last version] for the updates.
+
 [float]
 === 8.6.0
 
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index f132f1e606..710583e85c 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -55,110 +55,6 @@ A Google Workspace rule has been added to detect potential phishing with Google
 Several ESXI rules have been added to detect discovery commands, timestomping and suspicious processes.
 A new promotional rule to promote alerts from the Cloud Defend integration has been added regarding container security.
 
-|<<prebuilt-rule-8-7-1-prebuilt-rules-8-7-1-summary, 8.7.1>> | 15 Feb 2023 | 29 | 110 |
-This release includes new rules for Windows and Linux endpoints.
-Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
-A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
-Machine learning rules related to failed logins have been adjusted for better scoring results.
-Additional investigation guides have been added for Windows and Linux rules.
-A https://www.elastic.co/guide/en/security/current/rules-ui-create.html[New Terms] rule has been created to identify loaded Windows drivers not seen in the last 30 days.
-A guided onboarding rule has been created to assist new SIEM users with getting started.
-
-|<<prebuilt-rule-8-6-1-prebuilt-rules-8-6-1-summary, 8.6.1>> | 15 Feb 2023 | 28 | 110 |
-This release includes new rules for Windows and Linux endpoints.
-Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
-A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
-Machine learning rules related to failed logins have been adjusted for better scoring results.
-Additional investigation guides have been added for Windows and Linux rules.
-A https://www.elastic.co/guide/en/security/current/rules-ui-create.html[New Terms] rule has been created to identify loaded Windows drivers not seen in the last 30 days.
-
-|<<prebuilt-rule-8-5-1-prebuilt-rules-8-5-1-summary, 8.5.1>> | 14 Feb 2023 | 27 | 110 |
-This release includes new rules for Windows and Linux endpoints.
-Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
-A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
-Machine learning rules related to failed logins have been adjusted for better scoring results.
-Additional investigation guides have been added for Windows and Linux rules.
-
-|<<prebuilt-rule-8-4-3-prebuilt-rules-8-4-3-summary, 8.4.3>> | 14 Feb 2023 | 27 | 110 |
-This release includes new rules for Windows and Linux endpoints.
-Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
-A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
-Machine learning rules related to failed logins have been adjusted for better scoring results.
-Additional investigation guides have been added for Windows and Linux rules.
-
-|<<prebuilt-rule-8-4-2-prebuilt-rules-8-4-2-summary, 8.4.2>> | 24 Jan 2023 | 5 | 494 |
-This release includes new rules for Windows regarding Microsoft Exchange interaction via Powershell.
-Additionally, significant rule tuning for Windows rules has been added for better rule efficacy.
-A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included.
-A new rule for multiple alerts involving a single user has been added.
-Related integration tags and recommended versions have been added to endpoint rules.
-Bug fixes for OSQuery execution in rule investigation guides has been added.
-
-|<<prebuilt-rule-8-3-4-prebuilt-rules-8-3-4-summary, 8.3.4>> | 24 Jan 2023 | 1 | 4 |
-This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell.
-A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included.
-Additionally, a new rule for multiple alerts involving a single user has been added.
-This release also includes rule tuning for suspicious Windows Error Reporting child processes.
-
-|<<prebuilt-rule-8-3-3-prebuilt-rules-8-3-3-summary, 8.3.3>> | 19 Jan 2023 | 17 | 500 |
-This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell.
-Additionally, significant rule tuning for Windows rules has been added for better rule efficacy.
-Related integration tags and recommended versions have been added to endpoint rules.
-Bug fixes for OSQuery execution in rule investigation guides has been added.
-
-|<<prebuilt-rule-8-4-1-prebuilt-rules-8-4-1-summary, 8.4.1>> | 05 Dec 2022 | 20 | 298 |
-This release includes new rules for Linux regarding reverse shells.
-Additionally, new windows rules have been added to supply coverage for credential access and access token manipulation.
-Specific Windows and Linux rules have been tuned to reduce false-positive signals.
-
-|<<prebuilt-rule-8-3-2-prebuilt-rules-8-3-2-summary, 8.3.2>> | 06 Oct 2022 | 25 | 232 |
-This release includes new rules for Linux, Windows, Google Workspace and Kubernetes.
-Also included are expanded investigation guides for Linux, Windows and macOS rules.
-
-|<<prebuilt-rule-8-3-1-prebuilt-rules-8-3-1-summary, 8.3.1>> | 26 Aug 2022 | 0 | 113 |
-This release includes new rules for Linux, Windows, Google Workspace and Kubernetes.
-Also included are expanded investigation and setup guides for Linux, Windows and macOS rules.
-Rule compatability for required event fields and related Fleet integrations has also been included.
-
-|<<prebuilt-rule-8-2-1-prebuilt-rules-8-2-1-summary, 8.2.1>> | 24 Aug 2022 | 442 | 96 |
-This release includes new rules for Windows, MacOS, Linux, Kubernetes, and considerable tuning efforts.
-Also included are expanded investion guides for Windows, Azure and AWS rules.
-
-|<<prebuilt-rule-8-1-1-prebuilt-rules-8-1-1-summary, 8.1.1>> | 24 Jun 2022 | 14 | 159 |
-This release includes new rules for Windows, MacOS, Linux and Kubernetes.
-Also included are expanded investigation guides for Windows rules.
-Additionally, this update includes new rules to help detect emerging threat https://www.elastic.co/blog/a-peek-behind-the-bpfdoor[BPFDoor].
-Updates to existing Windows rules were made to help detect exploitation attempts against https://www.elastic.co/blog/vulnerability-summary-follina[CVE-2022-30190].
-
-|<<prebuilt-rule-1-0-2-prebuilt-rules-1-0-2-summary, 1.0.2>> | 03 May 2022 | 42 | 341 |
-This release includes new rules for MacOS regarding initial access and persistence coverage.
-New rules to detect shell evasion in Linux have also been added.
-Also included are expanded investigation guides for Windows rules as well as new rules for credential theft and Active Directory (AD).
-Additionally, this update includes new rules to help detect the emerging threat https://www.elastic.co/blog/detecting-and-responding-to-dirty-pipe-with-elastic[CVE-2022-0847 (Dirty Pipe)]
-
-|<<prebuilt-rule-0-14-3-prebuilt-rules-0-14-3-summary, 0.14.3>> | 13 Dec 2021 | 35 | 45 |
-This release includes an update to an existing rule and adds a new rule to help detect https://www.elastic.co/blog/detecting-log4j2-with-elastic-security[CVE-2021-44228 (log4j2)].
-Also included are updates and new rules for cloud integrations, windows, PowerShell, and others.
-
-|<<prebuilt-rule-0-14-2-prebuilt-rules-0-14-2-summary, 0.14.2>> | 15 Oct 2021 | 18 | 89 |
-This release includes rules covering Windows endpoints, as well as several third-party integrations — including rules contributed by the community.
-
-|<<prebuilt-rule-0-14-1-prebuilt-rules-0-14-1-summary, 0.14.1>> | 08 Sep 2021 | 3 | 71 |
-Included in this release is a rule to detect web shells, including
-https://discuss.elastic.co/t/detection-and-response-for-proxyshell-activity/282407[ProxyShell] activity.
-
-|<<prebuilt-rule-0-13-3-prebuilt-rules-0-13-3-summary, 0.13.3>> | 22 Jul 2021 | 4 | 36 |
-Included in this release is a rule for Windows Defender Exclusions, which has been used in recent campaigns, as well as
-a rule to resiliently detect parent PID spoofing.
-
-|<<prebuilt-rule-0-13-2-prebuilt-rules-0-13-2-summary, 0.13.2>> | 07 Jul 2021 | 15 | 6 |
-Included in this release are 3 new rules for the recently observed
-https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples[REvil]
-activity as well as 4 new rules covering the recent
-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527[PrintNightmare] vulnerability.
-
-|<<prebuilt-rule-0-13-1-prebuilt-rules-0-13-1-summary, 0.13.1>> | 21 Jun 2021 | 4 | 41 |
-
 |==============================================
 
 

From ad43f9d7e9ba23039a2d49ace468df316f7b8d1b Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 13:40:50 -0500
Subject: [PATCH 04/14] update deprecated rules

---
 .../prebuilt-rules-changelog.asciidoc         |   4 +-
 .../prebuilt-rules/rule-desc-index.asciidoc   |   1 +
 ...-access-secret-in-secrets-manager.asciidoc | 162 ------------
 ...ting-domain-trusts-via-nltest.exe.asciidoc | 102 --------
 ...tron-child-process-node.js-module.asciidoc |  88 -------
 ...ssql-xp_cmdshell-stored-procedure.asciidoc | 164 ------------
 ...modified-to-allow-external-access.asciidoc |  99 -------
 ...-shell-breakout-via-linux-binarys.asciidoc | 245 ------------------
 .../rule-details/my-first-alert.asciidoc      |  80 ------
 ...al-linux-ssh-brute-force-detected.asciidoc | 103 --------
 .../potential-shell-via-web-server.asciidoc   | 195 --------------
 ...ce-detected-on-privileged-account.asciidoc | 102 --------
 ...erse-shell-created-via-named-pipe.asciidoc |  76 ------
 ...-in-logon-events-from-a-source-ip.asciidoc |  72 -----
 .../suspicious-.net-code-compilation.asciidoc | 119 ---------
 ...us-.net-reflection-via-powershell.asciidoc | 181 -------------
 ...ious-execution-short-program-name.asciidoc | 104 --------
 ...-load-taskschd.dll-from-ms-office.asciidoc | 114 --------
 ...rvice-was-installed-in-the-system.asciidoc | 127 ---------
 ...at-detected-by-okta-threatinsight.asciidoc |  98 -------
 ...ebeat-module-v8.x-indicator-match.asciidoc | 126 ---------
 .../threat-intel-indicator-match.asciidoc     | 126 ---------
 .../unusual-child-process-of-dns.exe.asciidoc | 165 ------------
 ...sual-file-modification-by-dns.exe.asciidoc | 121 ---------
 ...m-network-configuration-discovery.asciidoc |  68 -----
 ...-owner-or-user-discovery-activity.asciidoc |  68 -----
 ...nusual-parent-process-for-cmd.exe.asciidoc | 142 ----------
 27 files changed, 3 insertions(+), 3049 deletions(-)
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/aws-access-secret-in-secrets-manager.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node.js-module.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp_cmdshell-stored-procedure.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/google-workspace-user-group-access-modified-to-allow-external-access.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binarys.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/my-first-alert.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-brute-force-detected.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/potential-shell-via-web-server.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/potential-ssh-brute-force-detected-on-privileged-account.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/reverse-shell-created-via-named-pipe.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/spike-in-logon-events-from-a-source-ip.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-.net-code-compilation.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-.net-reflection-via-powershell.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-execution-short-program-name.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd.dll-from-ms-office.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/threat-detected-by-okta-threatinsight.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-filebeat-module-v8.x-indicator-match.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-indicator-match.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns.exe.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns.exe.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-linux-system-network-configuration-discovery.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-linux-system-owner-or-user-discovery-activity.asciidoc
 delete mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd.exe.asciidoc

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index 33c08952a4..1732cdb338 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -377,7 +377,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<unusual-network-connection-via-rundll32>>
 
-<<unusual-parent-process-for-cmd.exe>>
+<<unusual-parent-process-for-cmd-exe>>
 
 <<unusual-parent-child-relationship>>
 
@@ -1322,7 +1322,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<unusual-network-connection-via-rundll32>>
 
-<<unusual-parent-process-for-cmd.exe>>
+<<unusual-parent-process-for-cmd-exe>>
 
 <<unusual-persistence-via-services-registry>>
 
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 32bc83a6b9..e45bfdef13 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -855,4 +855,5 @@ include::rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.ascii
 include::rule-details/windows-system-information-discovery.asciidoc[]
 include::rule-details/windows-user-account-creation.asciidoc[]
 include::rule-details/wireless-credential-dumping-using-netsh-command.asciidoc[]
+include::rule-details/workspace-user-group-access-modified-to-allow-external-access.asciidoc[]
 include::rule-details/zoom-meeting-with-no-passcode.asciidoc[]
\ No newline at end of file
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-access-secret-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-access-secret-in-secrets-manager.asciidoc
deleted file mode 100644
index 177b19aef2..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/aws-access-secret-in-secrets-manager.asciidoc
+++ /dev/null
@@ -1,162 +0,0 @@
-[[aws-access-secret-in-secrets-manager]]
-=== AWS Access Secret in Secrets Manager
-
-An adversary may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material
-
-*Rule type*: query
-
-*Rule indices*:
-
-* filebeat-*
-* logs-aws*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 10 minutes
-
-*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
-* http://detectioninthe.cloud/credential_access/access_secret_in_secrets_manager/
-
-*Tags*:
-
-* Elastic
-* Cloud
-* AWS
-* Continuous Monitoring
-* SecOps
-* Data Protection
-* Credential Access
-* Investigation Guide
-
-*Version*: 103 (<<aws-access-secret-in-secrets-manager-history, version history>>)
-
-*Added ({stack} release)*: 7.9.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Nick Jones, Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Verify whether the user identity, user agent, and/or hostname should be using GetSecretString API for the specified SecretId. If known behavior is causing false positives, it can be exempted from the rule.
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating AWS Access Secret in Secrets Manager
-
-AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with
-an API call to Secrets Manager to retrieve the secret programmatically.
-
-This rule looks for the retrieval of credentials using the API `GetSecretValue` action.
-
-#### Possible investigation steps
-
-- Identify the account and its role in the environment, and inspect the related policy.
-- Identify the applications that should use this account.
-- Investigate other alerts associated with the user account during the past 48 hours.
-- Investigate abnormal values in the `user_agent.original` field by comparing them with the intended and authorized usage
-and historical data. Suspicious user agent values include non-SDK, AWS CLI, custom user agents, etc.
-- Assess whether this behavior is prevalent in the environment by looking for similar occurrences involving other users.
-- Contact the account owner and confirm whether they are aware of this activity.
-- Considering the source IP address and geolocation of the user who issued the command:
-    - Do they look normal for the calling user?
-    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source
-    IP from an EC2 instance that's not under your control?
-    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles?
-    Are there any other alerts or signs of suspicious activity involving this instance?
-- Review IAM permission policies for the user identity and specific secrets accessed.
-- Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
-- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services,
-and data accessed by the account in the last 24 hours.
-
-### False positive analysis
-
-- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher
-confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions.
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Disable or limit the account during the investigation and response.
-- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
-    - Identify the account role in the cloud environment.
-    - Assess the criticality of affected services and servers.
-    - Work with your IT team to identify and minimize the impact on users.
-    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
-    - Identify any regulatory or legal ramifications related to this activity.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Rotate secrets or delete API keys as needed to revoke the attacker's access to the environment. Work with
-your IT teams to minimize the impact on business operations during these actions.
-- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
-- Consider enabling multi-factor authentication for users.
-- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
-- Take the actions needed to return affected systems, data, or services to their normal operational levels.
-- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.dataset:aws.cloudtrail and
-event.provider:secretsmanager.amazonaws.com and
-event.action:GetSecretValue
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Credential Access
-** ID: TA0006
-** Reference URL: https://attack.mitre.org/tactics/TA0006/
-* Technique:
-** Name: Steal Application Access Token
-** ID: T1528
-** Reference URL: https://attack.mitre.org/techniques/T1528/
-
-[[aws-access-secret-in-secrets-manager-history]]
-==== Rule version history
-
-Version 103 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc
deleted file mode 100644
index 860062825c..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest.exe.asciidoc
+++ /dev/null
@@ -1,102 +0,0 @@
-[[enumerating-domain-trusts-via-nltest-exe]]
-=== Enumerating Domain Trusts via NLTEST.EXE
-
-Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-* endgame-*
-
-*Severity*: low
-
-*Risk score*: 21
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
-* https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Discovery
-* Elastic Endgame
-
-*Version*: 102 (<<enumerating-domain-trusts-via-nltest-exe-history, version history>>)
-
-*Added ({stack} release)*: 8.4.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Domain administrators may use this command-line utility for legitimate information gathering purposes, but it is not common for environments with Windows Server 2012 and newer.
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name :
-"nltest.exe" and process.args : ( "/DCLIST:*", "/DCNAME:*",
-"/DSGET*", "/LSAQUERYFTI:*", "/PARENTDOMAIN",
-"/DOMAIN_TRUSTS", "/BDC_QUERY:*")
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Discovery
-** ID: TA0007
-** Reference URL: https://attack.mitre.org/tactics/TA0007/
-* Technique:
-** Name: Domain Trust Discovery
-** ID: T1482
-** Reference URL: https://attack.mitre.org/techniques/T1482/
-
-[[enumerating-domain-trusts-via-nltest-exe-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "nltest.exe" and process.args : ( "/DCLIST:*",
-"/DCNAME:*", "/DSGET*", "/LSAQUERYFTI:*", "/PARENTDOMAIN",
-"/DOMAIN_TRUSTS", "/BDC_QUERY:*")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node.js-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node.js-module.asciidoc
deleted file mode 100644
index bdfa80b0bb..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node.js-module.asciidoc
+++ /dev/null
@@ -1,88 +0,0 @@
-[[execution-via-electron-child-process-node.js-module]]
-=== Execution via Electron Child Process Node.js Module
-
-Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.
-
-*Rule type*: query
-
-*Rule indices*:
-
-* auditbeat-*
-* logs-endpoint.events.*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://www.matthewslipper.com/2019/09/22/everything-you-wanted-electron-child-process.html
-* https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks/
-* https://nodejs.org/api/child_process.html
-
-*Tags*:
-
-* Elastic
-* Host
-* macOS
-* Threat Detection
-* Defense Evasion
-* Execution
-
-*Version*: 100 (<<execution-via-electron-child-process-node.js-module-history, version history>>)
-
-*Added ({stack} release)*: 7.12.0
-
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.args:("-e" and const*require*child_process*)
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
-* Technique:
-** Name: Command and Scripting Interpreter
-** ID: T1059
-** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Abuse Elevation Control Mechanism
-** ID: T1548
-** Reference URL: https://attack.mitre.org/techniques/T1548/
-
-[[execution-via-electron-child-process-node.js-module-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 2 (8.4.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp_cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp_cmdshell-stored-procedure.asciidoc
deleted file mode 100644
index 9286f3f0a0..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp_cmdshell-stored-procedure.asciidoc
+++ /dev/null
@@ -1,164 +0,0 @@
-[[execution-via-mssql-xp_cmdshell-stored-procedure]]
-=== Execution via MSSQL xp_cmdshell Stored Procedure
-
-Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-* endgame-*
-
-*Severity*: high
-
-*Risk score*: 73
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Investigation Guide
-* Elastic Endgame
-
-*Version*: 102 (<<execution-via-mssql-xp_cmdshell-stored-procedure-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Execution via MSSQL xp_cmdshell Stored Procedure
-
-Microsoft SQL Server (MSSQL) has procedures meant to extend its functionality, the Extended Stored Procedures. These
-procedures are external functions written in C/C++; some provide interfaces for external programs. This is the case for
-xp_cmdshell, which spawns a Windows command shell and passes in a string for execution. Attackers can use this to
-execute commands on the system running the SQL server, commonly to escalate their privileges and establish persistence.
-
-The xp_cmdshell procedure is disabled by default, but when used, it has the same security context as the MSSQL Server
-service account, which is often privileged.
-
-#### Possible investigation steps
-
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
-for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Investigate other alerts associated with the user/host during the past 48 hours.
-- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
-connections.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Examine the command line to determine if the command executed is potentially harmful or malicious.
-- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
-
-### False positive analysis
-
-- This mechanism can be used legitimately, but it brings inherent risk. The security team must monitor any activity of
-it. If recurrent tasks are being executed using this mechanism, consider adding exceptions — preferably with a full
-command line.
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Ensure that SQL servers are not directly exposed to the internet. If there is a business justification for such, use
-an allowlist to allow only connections from known legitimate sources.
-- Disable the xp_cmdshell stored procedure.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "cmd.exe" and
-process.parent.name : "sqlservr.exe" and not process.args :
-("\\\\*", "diskfree", "rmdir", "mkdir", "dir", "del", "rename", "bcp",
-"*XMLNAMESPACES*",
-"?:\\MSSQL\\Backup\\Jobs\\sql_agent_backup_job.ps1",
-"K:\\MSSQL\\Backup\\msdb", "K:\\MSSQL\\Backup\\Logins")
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
-* Technique:
-** Name: Command and Scripting Interpreter
-** ID: T1059
-** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[execution-via-mssql-xp_cmdshell-stored-procedure-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "cmd.exe" and process.parent.name : "sqlservr.exe"
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:cmd.exe and process.parent.name:sqlservr.exe
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-user-group-access-modified-to-allow-external-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-user-group-access-modified-to-allow-external-access.asciidoc
deleted file mode 100644
index 31c9725c94..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-user-group-access-modified-to-allow-external-access.asciidoc
+++ /dev/null
@@ -1,99 +0,0 @@
-[[google-workspace-user-group-access-modified-to-allow-external-access]]
-=== Google Workspace User Group Access Modified to Allow External Access
-
-User groups in Google Workspace are created to help manage users permissions and access to various resources and applications. The security label is only applied to a group when users within that group are expected to access sensitive data and/or resources so administrators add this label to easily manage security groups better. Adversaries with administrator access may modify a security group to allow external access from members outside the organization. This detection does not capture all modifications to security groups, but only those that could increase the risk associated with them.
-
-*Rule type*: query
-
-*Rule indices*:
-
-* filebeat-*
-* logs-google_workspace*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 10 minutes
-
-*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://support.google.com/a/answer/9468710?hl=en
-
-*Tags*:
-
-* Elastic
-* Cloud
-* Google Workspace
-* Continuous Monitoring
-* SecOps
-* Identity and Access
-* Persistence
-
-*Version*: 2 (<<google-workspace-user-group-access-modified-to-allow-external-access-history, version history>>)
-
-*Added ({stack} release)*: 8.5.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-User group access may be modified by an administrator to allow external access for community purposes. Doing so for a user group whom has access to sensitive information or operational resources should be monitored closely.
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-### Important Information Regarding Google Workspace Event Lag Times
-- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
-- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
-- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
-- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
-- See the following references for further information:
-  - https://support.google.com/a/answer/7061566
-  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.dataset:"google_workspace.admin" and
-event.action:"CHANGE_GROUP_SETTING" and event.category:"iam" and
-((google_workspace.admin.setting.name:"ALLOW_EXTERNAL_MEMBERS" and
-google_workspace.admin.new_value:"true") or
-(google_workspace.admin.setting.name:"WHO_CAN_JOIN" and not
-(google_workspace.admin.new_value:"INVITED_CAN_JOIN" or
-google_workspace.admin.new_value:"CAN_REQUEST_TO_JOIN")))
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Persistence
-** ID: TA0003
-** Reference URL: https://attack.mitre.org/tactics/TA0003/
-* Technique:
-** Name: Account Manipulation
-** ID: T1098
-** Reference URL: https://attack.mitre.org/techniques/T1098/
-
-[[google-workspace-user-group-access-modified-to-allow-external-access-history]]
-==== Rule version history
-
-Version 2 (8.6.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binarys.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binarys.asciidoc
deleted file mode 100644
index 5febda6c8c..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binarys.asciidoc
+++ /dev/null
@@ -1,245 +0,0 @@
-[[linux-restricted-shell-breakout-via-linux-binarys]]
-=== Linux Restricted Shell Breakout via  Linux Binary(s)
-
-Identifies Linux binary(s) abuse to breakout of restricted shells or environments by spawning an interactive system shell. The linux utility(s) activity of spawning shell is not a standard use of the binary for a user or system administrator. It may indicates an attempt to improve the capabilities or stability of an adversary access.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* logs-endpoint.events.*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://gtfobins.github.io/gtfobins/apt/
-* https://gtfobins.github.io/gtfobins/apt-get/
-* https://gtfobins.github.io/gtfobins/nawk/
-* https://gtfobins.github.io/gtfobins/mawk/
-* https://gtfobins.github.io/gtfobins/awk/
-* https://gtfobins.github.io/gtfobins/gawk/
-* https://gtfobins.github.io/gtfobins/busybox/
-* https://gtfobins.github.io/gtfobins/c89/
-* https://gtfobins.github.io/gtfobins/c99/
-* https://gtfobins.github.io/gtfobins/cpulimit/
-* https://gtfobins.github.io/gtfobins/crash/
-* https://gtfobins.github.io/gtfobins/env/
-* https://gtfobins.github.io/gtfobins/expect/
-* https://gtfobins.github.io/gtfobins/find/
-* https://gtfobins.github.io/gtfobins/flock/
-* https://gtfobins.github.io/gtfobins/gcc/
-* https://gtfobins.github.io/gtfobins/mysql/
-* https://gtfobins.github.io/gtfobins/nice/
-* https://gtfobins.github.io/gtfobins/ssh/
-* https://gtfobins.github.io/gtfobins/vi/
-* https://gtfobins.github.io/gtfobins/vim/
-* https://gtfobins.github.io/gtfobins/capsh/
-* https://gtfobins.github.io/gtfobins/byebug/
-* https://gtfobins.github.io/gtfobins/git/
-* https://gtfobins.github.io/gtfobins/ftp/
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* GTFOBins
-
-*Version*: 100 (<<linux-restricted-shell-breakout-via-linux-binarys-history, version history>>)
-
-*Added ({stack} release)*: 8.3.0
-
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Shell Evasion via Linux Utilities
-Detection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or
-environments by spawning an interactive system shell.
-Here are some possible avenues of investigation:
-- Examine the entry point to the host and user in action via the Analyse View.
-  - Identify the session entry leader and session user
-- Examine the contents of session leading to the abuse via the Session View.
-  - Examine the command execution pattern in the session, which may lead to suspricous activities
-- Examine the execution of commands in the spawned shell.
-  - Identify imment threat to the system from the executed commands
-  - Take necessary incident response actions to contain any malicious behviour caused via this execution.
-
-### Related rules
-
-- A malicious spawned shell can execute any of the possible MITTRE ATT&CK vectors mainly to impair defences.
-- Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment
-
-### Response and remediation
-
-Initiate the incident response process based on the outcome of the triage.
-
-- If the triage releaved suspicious netwrok activity from the malicious spawned shell,
-  - Isolate the involved host to prevent further post-compromise behavior.
-- If the triage identified malware execution via the maliciously spawned shell,
-  - Search the environment for additional compromised hosts.
-  - Implement temporary network rules, procedures, and segmentation to contain the malware.
-  - Stop suspicious processes.
-  - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
-- If the triage revelaed defence evasion for imparing defenses
-  - Isolate the involved host to prevent further post-compromise behavior.
-  - Identified the disabled security guard components on the host and take necessary steps in renebaling the same.
-  - If any tools have been disbaled / uninstalled or config tampered work towards reenabling the same.
-- If the triage revelaed addition of persistence mechanism exploit like auto start scripts
-  - Isolate further login to the systems that can initae auto start scripts.
-  - Identify the auto start scripts and disable and remove the same from the systems
-- If the triage revealed data crawling or data export via remote copy
-  - Investigate credential exposure on systems compromised / used / decoded by the attacker during the data crawling
-  - Intiate compromised credential deactivation and credential rotation process for all exposed crednetials.
-  - Investiagte if any IPR data was accessed during the data crawling and take appropriate actions.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and /* launch shells from
-unusual process */ (process.name == "capsh" and process.args ==
-"--") or /* launching shells from unusual parents or parent+arg
-combos */ (process.name in ("bash", "sh", "dash","ash") and
-(process.parent.name in ("byebug","git","ftp","strace")) or
-/* shells specified in parent args */ /* nice rule is broken
-in 8.2 */ (process.parent.args in ("/bin/sh", "/bin/bash",
-"/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") and
-( (process.parent.name == "nice") or
-(process.parent.name == "cpulimit" and process.parent.args == "-f") or
-(process.parent.name == "find" and process.parent.args == "-exec" and
-process.parent.args == ";") or (process.parent.name ==
-"flock" and process.parent.args == "-u" and process.parent.args ==
-"/") ) ) or /* shells specified in args
-*/ (process.args in ("/bin/sh", "/bin/bash", "/bin/dash",
-"/bin/ash", "sh", "bash", "dash", "ash") and
-(process.parent.name == "crash" and process.parent.args == "-h") or
-(process.name == "sensible-pager" and process.parent.name in ("apt",
-"apt-get") and process.parent.args == "changelog") /*
-scope to include more sensible-pager invoked shells with different
-parent process to reduce noise and remove false positives */
-) ) or (process.name == "busybox" and process.args_count == 2
-and process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash",
-"sh", "bash", "dash", "ash") )or (process.name == "env" and
-process.args_count == 2 and process.args in ("/bin/sh", "/bin/bash",
-"/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash")) or
-(process.parent.name in ("vi", "vim") and process.parent.args == "-c"
-and process.parent.args in (":!/bin/bash", ":!/bin/sh", ":!bash",
-":!sh")) or (process.parent.name in ("c89","c99", "gcc") and
-process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "ash,-s",
-"/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s", "/bin/ash,-s") and
-process.parent.args == "-wrapper") or (process.parent.name ==
-"expect" and process.parent.args == "-c" and process.parent.args in
-("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn
-/bin/dash;interact", "spawn sh;interact", "spawn bash;interact",
-"spawn dash;interact")) or (process.parent.name == "mysql" and
-process.parent.args == "-e" and process.parent.args in ("\\!*sh",
-"\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash",
-"\\!*/bin/dash")) or (process.parent.name == "ssh" and
-process.parent.args == "-o" and process.parent.args in
-("ProxyCommand=;sh 0<&2 1>&2", "ProxyCommand=;bash 0<&2 1>&2",
-"ProxyCommand=;dash 0<&2 1>&2", "ProxyCommand=;/bin/sh 0<&2 1>&2",
-"ProxyCommand=;/bin/bash 0<&2 1>&2", "ProxyCommand=;/bin/dash 0<&2
-1>&2")) or (process.parent.name in ("nawk", "mawk", "awk", "gawk")
-and process.parent.args : "BEGIN {system(*)}")
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
-* Technique:
-** Name: Command and Scripting Interpreter
-** ID: T1059
-** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[linux-restricted-shell-breakout-via-linux-binarys-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type == "start" and /* launch shells from
-unusual process */ (process.name == "capsh" and process.args ==
-"--") or /* launching shells from unusual parents or parent+arg
-combos */ (process.name in ("bash", "sh", "dash","ash") and
-(process.parent.name in ("byebug","git","ftp")) or /* shells
-specified in parent args */ /* nice rule is broken in 8.2 */
-(process.parent.args in ("/bin/sh", "/bin/bash", "/bin/dash",
-"/bin/ash", "sh", "bash", "dash", "ash") and
-(process.parent.name == "nice") or (process.parent.name ==
-"cpulimit" and process.parent.args == "-f") or
-(process.parent.name == "find" and process.parent.args == "-exec" and
-process.parent.args == ";") or (process.parent.name == "flock"
-and process.parent.args == "-u" and process.parent.args == "/") )
-or /* shells specified in args */ (process.args in
-("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash",
-"dash", "ash") and (process.parent.name == "crash" and
-process.parent.args == "-h") or (process.name == "sensible-
-pager" and process.parent.name in ("apt", "apt-get") and
-process.parent.args == "changelog") /* scope to include more
-sensible-pager invoked shells with different parent process to reduce
-noise and remove false positives */ ) ) or (process.name ==
-"busybox" and process.args_count == 2 and process.args in ("/bin/sh",
-"/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") )or
-(process.name == "env" and process.args_count == 2 and process.args in
-("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash",
-"dash", "ash")) or (process.parent.name in ("vi", "vim") and
-process.parent.args == "-c" and process.parent.args in (":!/bin/bash",
-":!/bin/sh", ":!bash", ":!sh")) or (process.parent.name in
-("c89","c99", "gcc") and process.parent.args in ("sh,-s", "bash,-s",
-"dash,-s", "ash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s",
-"/bin/ash,-s") and process.parent.args == "-wrapper") or
-(process.parent.name == "expect" and process.parent.args == "-c" and
-process.parent.args in ("spawn /bin/sh;interact", "spawn
-/bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact",
-"spawn bash;interact", "spawn dash;interact")) or
-(process.parent.name == "mysql" and process.parent.args == "-e" and
-process.parent.args in ("\\!*sh", "\\!*bash", "\\!*dash",
-"\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")) or
-(process.parent.name == "ssh" and process.parent.args == "-o" and
-process.parent.args in ("ProxyCommand=;sh 0<&2 1>&2",
-"ProxyCommand=;bash 0<&2 1>&2", "ProxyCommand=;dash 0<&2 1>&2",
-"ProxyCommand=;/bin/sh 0<&2 1>&2", "ProxyCommand=;/bin/bash 0<&2
-1>&2", "ProxyCommand=;/bin/dash 0<&2 1>&2")) or (process.parent.name
-in ("nawk", "mawk", "awk", "gawk") and process.parent.args : "BEGIN
-{system(*)}")
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/my-first-alert.asciidoc b/docs/detections/prebuilt-rules/rule-details/my-first-alert.asciidoc
deleted file mode 100644
index 84487a50c0..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/my-first-alert.asciidoc
+++ /dev/null
@@ -1,80 +0,0 @@
-[[my-first-alert]]
-=== My First Alert
-
-This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity.
-
-*Rule type*: threshold
-
-*Rule indices*:
-
-* apm-*-transaction*
-* auditbeat-*
-* endgame-*
-* filebeat-*
-* logs-*
-* packetbeat-*
-* traces-apm*
-* winlogbeat-*
-* -*elastic-cloud-logs-*
-
-*Severity*: low
-
-*Risk score*: 21
-
-*Runs every*: 24 hours
-
-*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 1
-
-*References*:
-
-* https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
-
-*Tags*:
-
-* Elastic
-* Example
-* Guided Onboarding
-* Network
-* APM
-* Windows
-* Elastic Endgame
-
-*Version*: 1
-
-*Added ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-This rule is not looking for threat activity. Disable the rule if you're already familiar with alerts.
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
- 
-This is a test alert.
-
-This alert does not show threat activity. Elastic created this alert to help you understand how alerts work.
-
-For normal rules, the Investigation Guide will help analysts investigate alerts.
-
-This alert will show once every 24 hours for each host. It is safe to disable this rule.
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.kind:"event"
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-brute-force-detected.asciidoc
deleted file mode 100644
index 0598b74b64..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-brute-force-detected.asciidoc
+++ /dev/null
@@ -1,103 +0,0 @@
-[[potential-linux-ssh-brute-force-detected]]
-=== Potential Linux SSH Brute Force Detected
-
-Identifies multiple consecutive login failures targeting an user account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* auditbeat-*
-* logs-system.auth-*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Credential Access
-
-*Version*: 1
-
-*Added ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Potential SSH Brute Force Attack
-
-The rule identifies consecutive SSH login failures targeting a user account from the same source IP address to the
-same target host indicating brute force login attempts.
-
-#### Possible investigation steps
-
-- Investigate the login failure user name(s).
-- Investigate the source IP address of the failed ssh login attempt(s).
-- Investigate other alerts associated with the user/host during the past 48 hours.
-- Identify the source and the target computer and their roles in the IT environment.
-
-### False positive analysis
-
-- Authentication misconfiguration or obsolete credentials.
-- Service account password expired.
-- Infrastructure or availability issue.
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified.
-- Reset passwords for these accounts and other potentially compromised credentials.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-sequence by host.id, source.ip, user.name with maxspan=10s
-[authentication where event.action in ("ssh_login", "user_login") and
-event.outcome == "failure" and source.ip != null and source.ip !=
-"0.0.0.0" and source.ip != "::" ] with runs=10
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Credential Access
-** ID: TA0006
-** Reference URL: https://attack.mitre.org/tactics/TA0006/
-* Technique:
-** Name: Brute Force
-** ID: T1110
-** Reference URL: https://attack.mitre.org/techniques/T1110/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-shell-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-shell-via-web-server.asciidoc
deleted file mode 100644
index 4bbee25eae..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/potential-shell-via-web-server.asciidoc
+++ /dev/null
@@ -1,195 +0,0 @@
-[[potential-shell-via-web-server]]
-=== Potential Shell via Web Server
-
-Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
-
-*Rule type*: query
-
-*Rule indices*:
-
-* auditbeat-*
-* logs-endpoint.events.*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://pentestlab.blog/tag/web-shell/
-* https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Persistence
-* Investigation Guide
-
-*Version*: 102 (<<potential-shell-via-web-server-history, version history>>)
-
-*Added ({stack} release)*: 7.6.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior.
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Potential Shell via Web Server
-
-Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web
-script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a
-network. A web shell may provide a set of functions to execute or a command line interface on the system that hosts the
-web server.
-
-This rule detects a web server process spawning script and command line interface programs, potentially indicating
-attackers executing commands using the web shell.
-
-#### Possible investigation steps
-
-- Investigate abnormal behaviors observed by the subject process such as network connections, file modifications, and
-any other spawned child processes.
-- Examine the command line to determine which commands or scripts were executed.
-- Investigate other alerts associated with the user/host during the past 48 hours.
-- If scripts or executables were dropped, retrieve the files and determine if they are malicious:
-  - Use a private sandboxed malware analysis system to perform analysis.
-    - Observe and collect information about the following activities:
-      - Attempts to contact external domains and addresses.
-        - Check if the domain is newly registered or unexpected.
-        - Check the reputation of the domain or IP address.
-      - File access, modification, and creation activities.
-      - Cron jobs, services and other persistence mechanisms.
-
-### False positive analysis
-
-- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently
-malicious must be monitored by the security team.
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved host to prevent further post-compromise behavior.
-- If the triage identified malware, search the environment for additional compromised hosts.
-  - Implement temporary network rules, procedures, and segmentation to contain the malware.
-  - Stop suspicious processes.
-  - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
-- Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(bash or dash or ash or zsh or "python*" or "perl*" or
-"php*") and process.parent.name:("apache" or "nginx" or "www" or
-"apache2" or "httpd" or "www-data")
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Persistence
-** ID: TA0003
-** Reference URL: https://attack.mitre.org/tactics/TA0003/
-* Technique:
-** Name: Server Software Component
-** ID: T1505
-** Reference URL: https://attack.mitre.org/techniques/T1505/
-
-[[potential-shell-via-web-server-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 11 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(bash or dash) and user.name:(apache or nginx or www or
-"www-data")
-----------------------------------
-
-Version 9 (7.12.0 release)::
-* Formatting only
-
-Version 8 (7.11.2 release)::
-* Formatting only
-
-Version 7 (7.11.0 release)::
-* Formatting only
-
-Version 6 (7.10.0 release)::
-* Formatting only
-
-Version 5 (7.9.1 release)::
-* Formatting only
-
-Version 4 (7.9.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:(bash or dash) and user.name:(apache or nginx or www or
-"www-data") and event.action:executed
-----------------------------------
-
-Version 3 (7.8.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name:bash and user.name:(apache or www or www-data) and
-event.action:executed
-----------------------------------
-
-Version 2 (7.6.1 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process.name: bash and user.name: (apache or www or "wwww-data") and
-event.action:executed
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-ssh-brute-force-detected-on-privileged-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-ssh-brute-force-detected-on-privileged-account.asciidoc
deleted file mode 100644
index 241eb80198..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/potential-ssh-brute-force-detected-on-privileged-account.asciidoc
+++ /dev/null
@@ -1,102 +0,0 @@
-[[potential-ssh-brute-force-detected-on-privileged-account]]
-=== Potential SSH Brute Force Detected on Privileged Account
-
-Identifies multiple consecutive login failures targeting a root user account from the same source address and within a short time interval. Adversaries will often brute force login attempts on privileged accounts with a common or known password, in an attempt to gain privileged access to systems.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* auditbeat-*
-* logs-system.auth-*
-
-*Severity*: high
-
-*Risk score*: 73
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Credential Access
-
-*Version*: 1
-
-*Added ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Potential SSH Brute Force Attack on Privileged Account
-
-The rule identifies consecutive SSH login failures targeting a privileged (root) account from the same source IP
-address to the same target host indicating brute force login attempts.
-
-#### Possible investigation steps
-
-- Investigate the login failure on privileged account(s).
-- Investigate the source IP address of the failed ssh login attempt(s).
-- Investigate other alerts associated with the user/host during the past 48 hours.
-- Identify the source and the target computer and their roles in the IT environment.
-
-### False positive analysis
-- Authentication misconfiguration or obsolete credentials.
-- Service account password expired.
-- Infrastructure or availability issue.
-
-### Response and remediation
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified.
-- Reset passwords for these accounts and other potentially compromised credentials.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-sequence by host.id, source.ip with maxspan=10s [authentication
-where event.action in ("ssh_login", "user_login") and
-event.outcome == "failure" and source.ip != null and source.ip !=
-"0.0.0.0" and source.ip != "::" and user.name in ("*root*" ,
-"*admin*")] with runs=3
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Credential Access
-** ID: TA0006
-** Reference URL: https://attack.mitre.org/tactics/TA0006/
-* Technique:
-** Name: Brute Force
-** ID: T1110
-** Reference URL: https://attack.mitre.org/techniques/T1110/
diff --git a/docs/detections/prebuilt-rules/rule-details/reverse-shell-created-via-named-pipe.asciidoc b/docs/detections/prebuilt-rules/rule-details/reverse-shell-created-via-named-pipe.asciidoc
deleted file mode 100644
index f0ab0d00bd..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/reverse-shell-created-via-named-pipe.asciidoc
+++ /dev/null
@@ -1,76 +0,0 @@
-[[reverse-shell-created-via-named-pipe]]
-=== Reverse Shell Created via Named Pipe
-
-Identifies a reverse shell via the abuse of named pipes on Linux with the help of OpenSSL or Netcat. First in, first out (FIFO) files are special files for reading and writing to by Linux processes. For this to work, a named pipe is created and passed to a Linux shell where the use of a network connection tool such as Netcat or OpenSSL has been established. The stdout and stderr are captured in the named pipe from the network connection and passed back to the shell for execution.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* auditbeat-*
-* logs-endpoint.events.*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://int0x33.medium.com/day-43-reverse-shell-with-openssl-1ee2574aa998
-* https://blog.gregscharf.com/2021/03/22/tar-in-cronjob-to-privilege-escalation/
-* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#openssl
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* Execution
-* Investigation Guide
-
-*Version*: 1
-
-*Added ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Netcat and OpenSSL are common tools used for establishing network connections and creating encryption keys. While they are popular, capturing the stdout and stderr in a named pipe pointed to a shell is anomalous.
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-sequence by host.id with maxspan = 5s [process where event.type ==
-"start" and process.executable : ("/usr/bin/mkfifo","/usr/bin/mknod")
-and process.args:("/tmp/*","$*")] [process where
-process.executable : ("/bin/sh","/bin/bash") and process.args:("-i")
-or (process.executable: ("/usr/bin/openssl") and process.args:
-("-connect"))] [process where (process.name:("nc","ncat","netcat",
-"netcat.openbsd","netcat.traditional") or
-(process.name: "openssl" and process.executable: "/usr/bin/openssl"))]
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
-* Technique:
-** Name: Command and Scripting Interpreter
-** ID: T1059
-** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events-from-a-source-ip.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events-from-a-source-ip.asciidoc
deleted file mode 100644
index 3670248577..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-logon-events-from-a-source-ip.asciidoc
+++ /dev/null
@@ -1,72 +0,0 @@
-[[spike-in-logon-events-from-a-source-ip]]
-=== Spike in Logon Events from a Source IP
-
-A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.
-
-*Rule type*: machine_learning
-
-*Machine learning job*: auth_high_count_logon_events_for_a_source_ip
-
-*Machine learning anomaly threshold*: 75
-
-
-*Severity*: low
-
-*Risk score*: 21
-
-*Runs every*: 15 minutes
-
-*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
-
-*Tags*:
-
-* Elastic
-* Authentication
-* Threat Detection
-* ML
-* Credential Access
-
-*Version*: 100 (<<spike-in-logon-events-from-a-source-ip-history, version history>>)
-
-*Added ({stack} release)*: 7.14.0
-
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Build servers and CI systems can sometimes trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert.
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Credential Access
-** ID: TA0006
-** Reference URL: https://attack.mitre.org/tactics/TA0006/
-* Technique:
-** Name: Brute Force
-** ID: T1110
-** Reference URL: https://attack.mitre.org/techniques/T1110/
-
-[[spike-in-logon-events-from-a-source-ip-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.4.0 release)::
-* Formatting only
-
-Version 2 (7.16.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-.net-code-compilation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-.net-code-compilation.asciidoc
deleted file mode 100644
index 25d904a825..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-.net-code-compilation.asciidoc
+++ /dev/null
@@ -1,119 +0,0 @@
-[[suspicious-.net-code-compilation]]
-=== Suspicious .NET Code Compilation
-
-Identifies suspicious .NET code execution. connections.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-* endgame-*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<suspicious-.net-code-compilation-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : ("csc.exe",
-"vbc.exe") and process.parent.name : ("wscript.exe", "mshta.exe",
-"cscript.exe", "wmic.exe", "svchost.exe", "rundll32.exe", "cmstp.exe",
-"regsvr32.exe")
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Obfuscated Files or Information
-** ID: T1027
-** Reference URL: https://attack.mitre.org/techniques/T1027/
-
-[[suspicious-.net-code-compilation-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : ("csc.exe", "vbc.exe") and process.parent.name :
-("wscript.exe", "mshta.exe", "cscript.exe", "wmic.exe", "svchost.exe",
-"rundll32.exe", "cmstp.exe", "regsvr32.exe")
-----------------------------------
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.16.0 release)::
-* Formatting only
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:(csc.exe or vbc.exe) and process.parent.name:(wscript.exe
-or mshta.exe or wscript.exe or wmic.exe or svchost.exe or rundll32.exe
-or cmstp.exe or regsvr32.exe)
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-.net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-.net-reflection-via-powershell.asciidoc
deleted file mode 100644
index f12ba4ebca..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-.net-reflection-via-powershell.asciidoc
+++ /dev/null
@@ -1,181 +0,0 @@
-[[suspicious-.net-reflection-via-powershell]]
-=== Suspicious .NET Reflection via PowerShell
-
-Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.
-
-*Rule type*: query
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-windows.*
-
-*Severity*: high
-
-*Risk score*: 73
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Investigation Guide
-
-*Version*: 102 (<<suspicious-.net-reflection-via-powershell-history, version history>>)
-
-*Added ({stack} release)*: 8.0.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Suspicious .NET Reflection via PowerShell
-
-PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
-makes it available for use in various environments, and creates an attractive way for attackers to execute code.
-
-Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script,
-which can circumvent file-based security protections.
-
-> **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic stack version 8.5.0. Older Elastic stacks versions will see unrendered markdown in this guide.
-
-#### Possible investigation steps
-
-- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
-capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
-- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
-prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Examine file or network events from the involved PowerShell process for suspicious behavior.
-- Investigate other alerts associated with the user/host during the past 48 hours.
-- Evaluate whether the user needs to use PowerShell to complete tasks.
-- Examine the host for derived artifacts that indicates suspicious activities:
-  - Analyze the script using a private sandboxed analysis system.
-  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
-    - Attempts to contact external domains and addresses.
-      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by
-      filtering by the process' `process.entity_id`.
-      - Examine the DNS cache for suspicious or anomalous entries.
-        - !{osquery{"query":"SELECT * FROM dns_cache", "label":"Osquery - Retrieve DNS Cache"}}
-    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related
-    processes in the process tree.
-    - Examine the host services for suspicious or anomalous entries.
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services","label":"Osquery - Retrieve All Services"}}
-      - !{osquery{"query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE "%LocalSystem" OR user_account LIKE "%LocalService" OR user_account LIKE "%NetworkService" OR user_account == null)","label":"Osquery - Retrieve Services Running on User Accounts"}}
-      - !{osquery{"query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != "trusted"","label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link"}}
-  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and
-  reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
-
-### False positive analysis
-
-- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did
-not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
-
-### Related rules
-
-- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
-- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
-- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- If the triage identified malware, search the environment for additional compromised hosts.
-  - Implement temporary network rules, procedures, and segmentation to contain the malware.
-  - Stop suspicious processes.
-  - Immediately block the identified indicators of compromise (IoCs).
-  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that
-  attackers could use to reinfect the system.
-- Remove and block malicious artifacts identified during triage.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
-malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-"[System.Reflection.Assembly]::Load" or
-"[Reflection.Assembly]::Load" )
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Process Injection
-** ID: T1055
-** Reference URL: https://attack.mitre.org/techniques/T1055/
-
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
-* Technique:
-** Name: Command and Scripting Interpreter
-** ID: T1059
-** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[suspicious-.net-reflection-via-powershell-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 5 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and powershell.file.script_block_text : (
-"[System.Reflection.Assembly]::Load" or
-"[Reflection.Assembly]::Load" )
-----------------------------------
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-short-program-name.asciidoc
deleted file mode 100644
index 209060796c..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-short-program-name.asciidoc
+++ /dev/null
@@ -1,104 +0,0 @@
-[[suspicious-execution-short-program-name]]
-=== Suspicious Execution - Short Program Name
-
-Identifies process execution with a single character process name. This is often done by adversaries while staging or executing temporary utilities.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-* endgame-*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Defense Evasion
-* Elastic Endgame
-
-*Version*: 102 (<<suspicious-execution-short-program-name-history, version history>>)
-
-*Added ({stack} release)*: 7.11.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and length(process.name) > 0 and
-length(process.name) == 5 and host.os.name == "Windows" and
-length(process.pe.original_file_name) > 5
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Defense Evasion
-** ID: TA0005
-** Reference URL: https://attack.mitre.org/tactics/TA0005/
-* Technique:
-** Name: Masquerading
-** ID: T1036
-** Reference URL: https://attack.mitre.org/techniques/T1036/
-
-[[suspicious-execution-short-program-name-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-length(process.name) > 0 and length(process.name) == 5 and
-host.os.name == "Windows" and length(process.pe.original_file_name) >
-5
-----------------------------------
-
-Version 6 (8.4.0 release)::
-* Formatting only
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd.dll-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd.dll-from-ms-office.asciidoc
deleted file mode 100644
index ee4913d01f..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd.dll-from-ms-office.asciidoc
+++ /dev/null
@@ -1,114 +0,0 @@
-[[suspicious-image-load-taskschd.dll-from-ms-office]]
-=== Suspicious Image Load (taskschd.dll) from MS Office
-
-Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-
-*Severity*: low
-
-*Risk score*: 21
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
-* https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Persistence
-
-*Version*: 100 (<<suspicious-image-load-taskschd.dll-from-ms-office-history, version history>>)
-
-*Added ({stack} release)*: 7.11.0
-
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-any where (event.category == "library" or (event.category ==
-"process" and event.action : "Image loaded*")) and process.name :
-("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE",
-"MSACCESS.EXE") and (dll.name : "taskschd.dll" or file.name :
-"taskschd.dll")
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Persistence
-** ID: TA0003
-** Reference URL: https://attack.mitre.org/tactics/TA0003/
-* Technique:
-** Name: Scheduled Task/Job
-** ID: T1053
-** Reference URL: https://attack.mitre.org/techniques/T1053/
-
-[[suspicious-image-load-taskschd.dll-from-ms-office-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 6 (8.4.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where process.name : ("WINWORD.EXE", "EXCEL.EXE",
-"POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and event.action :
-"load" and event.category : "library" and dll.name :
-"taskschd.dll"
-----------------------------------
-
-Version 4 (8.2.0 release)::
-* Formatting only
-
-Version 3 (7.12.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-library where process.name in ("WINWORD.EXE", "EXCEL.EXE",
-"POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and event.action ==
-"load" and event.category == "library" and file.name ==
-"taskschd.dll"
-----------------------------------
-
-Version 2 (7.11.2 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
deleted file mode 100644
index d645a88536..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ /dev/null
@@ -1,127 +0,0 @@
-[[suspicious-service-was-installed-in-the-system]]
-=== Suspicious Service was Installed in the System
-
-Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-system.*
-* logs-windows.*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5m
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*: None
-
-*Tags*:
-
-* Domain: Endpoint
-* OS: Windows
-* Use Case: Threat Detection
-* Tactic: Persistence
-* Resources: Investigation Guide
-
-*Version*: 7
-
-*Rule authors*:
-
-* Elastic
-
-*Rule license*: Elastic License v2
-
-
-==== Investigation guide
-
-
-[source, markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Suspicious Service was Installed in the System
-
-Attackers may create new services to execute system shells and other command execution utilities to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these utilities with persistence payloads.
-
-This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
-
-> **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-#### Possible investigation steps
-
-- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
-- Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).
-  - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.
-    - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
-    - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
-    - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
-    - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
-    - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
-  - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
-- Identify the user account that performed the action and whether it should perform this kind of action.
-- Contact the account owner and confirm whether they are aware of this activity.
-- Investigate other alerts associated with the user/host during the past 48 hours.
-- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-
-
-### False positive analysis
-
-- Certain services such as PSEXECSVC may happen legitimately. The security team should address any potential benign true positive (B-TP) by excluding the relevant FP by pattern.
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved host to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
-- Delete the service.
-- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-
-----------------------------------
-
-==== Rule query
-
-
-[source, js]
-----------------------------------
-any where
-  (event.code : "4697" and
-   (winlog.event_data.ServiceFileName :
-           ("*COMSPEC*", "*\\172.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
-            "*echo*", "*RemComSvc*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
-            "*\\Users\\*", "*\\Windows\\Temp\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
-            "*regsvr32*", "*msbuild*") or
-   winlog.event_data.ServiceFileName regex~ """%systemroot%\\[a-z0-9]+\.exe""")) or
-
-  (event.code : "7045" and
-   winlog.event_data.ImagePath : (
-       "*COMSPEC*", "*\\172.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
-       "*echo*", "*RemComSvc*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
-       "*\\Users\\*", "*\\Windows\\Temp\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
-       "*regsvr32*", "*msbuild*"))
-
-----------------------------------
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Persistence
-** ID: TA0003
-** Reference URL: https://attack.mitre.org/tactics/TA0003/
-* Technique:
-** Name: Create or Modify System Process
-** ID: T1543
-** Reference URL: https://attack.mitre.org/techniques/T1543/
-* Sub-technique:
-** Name: Windows Service
-** ID: T1543.003
-** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-detected-by-okta-threatinsight.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-detected-by-okta-threatinsight.asciidoc
deleted file mode 100644
index 57c181d04e..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/threat-detected-by-okta-threatinsight.asciidoc
+++ /dev/null
@@ -1,98 +0,0 @@
-[[threat-detected-by-okta-threatinsight]]
-=== Threat Detected by Okta ThreatInsight
-
-Detects when Okta ThreatInsight identifies a request from a malicious IP address. Investigating requests from IP addresses identified as malicious by Okta ThreatInsight can help security teams monitor for and respond to credential based attacks against their organization, such as brute force and password spraying attacks.
-
-*Rule type*: query
-
-*Rule indices*:
-
-* filebeat-*
-* logs-okta*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://developer.okta.com/docs/reference/api/system-log/
-* https://developer.okta.com/docs/reference/api/event-types/
-* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
-
-*Tags*:
-
-* Elastic
-* Identity
-* Okta
-* Continuous Monitoring
-* SecOps
-* Monitoring
-
-*Version*: 102 (<<threat-detected-by-okta-threatinsight-history, version history>>)
-
-*Added ({stack} release)*: 7.9.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-event.dataset:okta.system and event.action:security.threat.detected
-----------------------------------
-
-
-[[threat-detected-by-okta-threatinsight-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (7.13.0 release)::
-* Formatting only
-
-Version 5 (7.12.0 release)::
-* Formatting only
-
-Version 4 (7.11.2 release)::
-* Formatting only
-
-Version 3 (7.11.0 release)::
-* Formatting only
-
-Version 2 (7.10.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.module:okta and event.dataset:okta.system and
-event.action:security.threat.detected
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-filebeat-module-v8.x-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-filebeat-module-v8.x-indicator-match.asciidoc
deleted file mode 100644
index f00f51aef3..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-filebeat-module-v8.x-indicator-match.asciidoc
+++ /dev/null
@@ -1,126 +0,0 @@
-[[threat-intel-filebeat-module-v8.x-indicator-match]]
-=== Threat Intel Filebeat Module (v8.x) Indicator Match
-
-This rule is triggered when indicators from the Threat Intel Filebeat module (v8.x) has a match against local file or network observations.
-
-*Rule type*: threat_match
-
-*Rule indices*:
-
-* auditbeat-*
-* endgame-*
-* filebeat-*
-* logs-*
-* packetbeat-*
-* winlogbeat-*
-
-*Severity*: critical
-
-*Risk score*: 99
-
-*Runs every*: 1 hour
-
-*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
-
-*Tags*:
-
-* Elastic
-* Windows
-* Elastic Endgame
-* Network
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Investigation Guide
-
-*Version*: 102 (<<threat-intel-filebeat-module-v8.x-indicator-match-history, version history>>)
-
-*Added ({stack} release)*: 8.0.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and Analysis
-
-### Investigating Threat Intel Indicator Matches
-
-Threat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file
-hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on
-an IP address, registry path, URL, or imphash.
-
-The matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by
-investigating the associated activity to determine if it requires further investigation.
-
-If an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.
-
-- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation
-- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation
-- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation
-
-#### Possible investigation steps:
-- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched
-and by viewing the source of that activity.
-- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines?
-These kinds of questions can help understand if the activity is related to legitimate behavior.
-- Consider the user and their role within the company: is this something related to their job or work function?
-
-### False Positive Analysis
-- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can
-be a great tool for augmenting existing security processes, while at the same time it should be understood that threat
-intelligence can represent a specific set of activity observed at a point in time. For example, an IP address
-may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and
-no longer represents any threat.
-- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their
-way into indicator lists creating the potential for false positives.
-- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.
-
-### Response and Remediation
-- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further
-post-compromise behavior.
-- One example of a response if a machine matched a command and control IP address would be to add an entry to a network
-device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.
-- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined,
-reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:*
-or url.full:* or registry.path:*
-----------------------------------
-
-
-[[threat-intel-filebeat-module-v8.x-indicator-match-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-indicator-match.asciidoc
deleted file mode 100644
index 25e2afcc14..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-indicator-match.asciidoc
+++ /dev/null
@@ -1,126 +0,0 @@
-[[threat-intel-indicator-match]]
-=== Threat Intel Indicator Match
-
-This rule is triggered when indicators from the Threat Intel integrations have a match against local file or network observations.
-
-*Rule type*: threat_match
-
-*Rule indices*:
-
-* auditbeat-*
-* endgame-*
-* filebeat-*
-* logs-*
-* packetbeat-*
-* winlogbeat-*
-
-*Severity*: critical
-
-*Risk score*: 99
-
-*Runs every*: 1 hour
-
-*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
-
-*Tags*:
-
-* Elastic
-* Windows
-* Elastic Endgame
-* Network
-* Continuous Monitoring
-* SecOps
-* Monitoring
-* Investigation Guide
-
-*Version*: 102 (<<threat-intel-indicator-match-history, version history>>)
-
-*Added ({stack} release)*: 8.0.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and Analysis
-
-### Investigating Threat Intel Indicator Matches
-
-Threat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file
-hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on
-an IP address, registry path, URL, or imphash.
-
-The matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by
-investigating the associated activity to determine if it requires further investigation.
-
-If an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.
-
-- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation
-- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation
-- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation
-
-#### Possible investigation steps:
-- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched
-and by viewing the source of that activity.
-- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines?
-These kinds of questions can help understand if the activity is related to legitimate behavior.
-- Consider the user and their role within the company: is this something related to their job or work function?
-
-### False Positive Analysis
-- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can
-be a great tool for augmenting existing security processes, while at the same time it should be understood that threat
-intelligence can represent a specific set of activity observed at a point in time. For example, an IP address
-may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and
-no longer represents any threat.
-- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their
-way into indicator lists creating the potential for false positives.
-- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.
-
-### Response and Remediation
-- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further
-post-compromise behavior.
-- One example of a response if a machine matched a command and control IP address would be to add an entry to a network
-device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.
-- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined,
-reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:*
-or url.full:* or registry.path:*
-----------------------------------
-
-
-[[threat-intel-indicator-match-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 4 (8.4.0 release)::
-* Formatting only
-
-Version 3 (8.1.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns.exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns.exe.asciidoc
deleted file mode 100644
index 1493a364d1..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns.exe.asciidoc
+++ /dev/null
@@ -1,165 +0,0 @@
-[[unusual-child-process-of-dns.exe]]
-=== Unusual Child Process of dns.exe
-
-Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-
-*Severity*: high
-
-*Risk score*: 73
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
-* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
-* https://github.com/maxpl0it/CVE-2020-1350-DoS
-* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-* Investigation Guide
-
-*Version*: 102 (<<unusual-child-process-of-dns.exe-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Werfault.exe will legitimately spawn when dns.exe crashes, but the DNS service is very stable and so this is a low occurring event. Denial of Service (DoS) attempts by intentionally crashing the service will also cause werfault.exe to spawn.
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Unusual Child Process of dns.exe
-
-SIGRed (CVE-2020-1350) is a wormable, critical vulnerability in the Windows DNS server that affects Windows Server
-versions 2003 to 2019 and can be triggered by a malicious DNS response. Because the service is running in elevated
-privileges (SYSTEM), an attacker that successfully exploits it is granted Domain Administrator rights. This can
-effectively compromise the entire corporate infrastructure.
-
-This rule looks for unusual children of the `dns.exe` process, which can indicate the exploitation of the SIGRed or a
-similar remote code execution vulnerability in the DNS server.
-
-#### Possible investigation steps
-
-- Investigate the process execution chain (parent process tree) for unknown processes.
-  - Any suspicious or abnormal child process spawned from dns.exe should be carefully reviewed and investigated. It's
-  impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in
-  discovery/enumeration utilities should be top of mind (`whoami.exe`, `netstat.exe`, `systeminfo.exe`, `tasklist.exe`).
-  - Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be
-  considered. This is not an exhaustive list, but ideal candidates to start out would be: `mshta.exe`, `powershell.exe`,
-  `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `wmic.exe`.
-  - If a denial-of-service (DoS) exploit is successful and DNS Server service crashes, be mindful of potential child processes related to
-  `werfault.exe` occurring.
-- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications,
-and any spawned child processes.
-- Investigate other alerts associated with the host during the past 48 hours.
-- Check whether the server is vulnerable to CVE-2020-1350.
-- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
-
-### False positive analysis
-
-- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
-
-### Response and remediation
-
-- Initiate the incident response process based on the outcome of the triage.
-- Isolate the involved hosts to prevent further post-compromise behavior.
-- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
-identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
-systems, and web services.
-- Reimage the host operating system or restore the compromised server to a clean state.
-- Install the latest patches on systems that run Microsoft DNS Server.
-- Consider the implementation of a patch management system, such as the Windows Server Update Services (WSUS).
-- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system,
-persistence mechanisms, and malware components.
-- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
-- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
-- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
-mean time to respond (MTTR).
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and process.parent.name :
-"dns.exe" and not process.name : "conhost.exe"
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Initial Access
-** ID: TA0001
-** Reference URL: https://attack.mitre.org/tactics/TA0001/
-* Technique:
-** Name: External Remote Services
-** ID: T1133
-** Reference URL: https://attack.mitre.org/techniques/T1133/
-
-[[unusual-child-process-of-dns.exe-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:start and
-process.parent.name:dns.exe and not process.name:conhost.exe
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns.exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns.exe.asciidoc
deleted file mode 100644
index 06fa1ed7b4..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns.exe.asciidoc
+++ /dev/null
@@ -1,121 +0,0 @@
-[[unusual-file-modification-by-dns.exe]]
-=== Unusual File Modification by dns.exe
-
-Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-
-*Severity*: high
-
-*Risk score*: 73
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*References*:
-
-* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
-* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
-* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Initial Access
-
-*Version*: 101 (<<unusual-file-modification-by-dns.exe-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-## Triage and analysis
-
-### Investigating Unusual File Write
-Detection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:
-- Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.
-- Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-file where process.name : "dns.exe" and event.type in ("creation",
-"deletion", "change") and not file.name : "dns.log"
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Initial Access
-** ID: TA0001
-** Reference URL: https://attack.mitre.org/tactics/TA0001/
-* Technique:
-** Name: External Remote Services
-** ID: T1133
-** Reference URL: https://attack.mitre.org/techniques/T1133/
-
-[[unusual-file-modification-by-dns.exe-history]]
-==== Rule version history
-
-Version 101 (8.6.0 release)::
-* Formatting only
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 8 (8.4.0 release)::
-* Formatting only
-
-Version 6 (8.2.0 release)::
-* Formatting only
-
-Version 5 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and process.name:dns.exe and event.type:(creation
-or deletion or change) and not file.name:dns.log
-----------------------------------
-
-Version 4 (7.12.0 release)::
-* Formatting only
-
-Version 3 (7.11.2 release)::
-* Formatting only
-
-Version 2 (7.11.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:file and process.name:dns.exe and not file.name:dns.log
-----------------------------------
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-network-configuration-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-network-configuration-discovery.asciidoc
deleted file mode 100644
index bac061a26d..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-network-configuration-discovery.asciidoc
+++ /dev/null
@@ -1,68 +0,0 @@
-[[unusual-linux-system-network-configuration-discovery]]
-=== Unusual Linux System Network Configuration Discovery
-
-Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.
-
-*Rule type*: machine_learning
-
-*Machine learning job*: v3_linux_network_configuration_discovery
-
-*Machine learning anomaly threshold*: 25
-
-
-*Severity*: low
-
-*Risk score*: 21
-
-*Runs every*: 15 minutes
-
-*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-
-*Version*: 100 (<<unusual-linux-system-network-configuration-discovery-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Discovery
-** ID: TA0007
-** Reference URL: https://attack.mitre.org/tactics/TA0007/
-* Technique:
-** Name: System Network Configuration Discovery
-** ID: T1016
-** Reference URL: https://attack.mitre.org/techniques/T1016/
-
-[[unusual-linux-system-network-configuration-discovery-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-owner-or-user-discovery-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-owner-or-user-discovery-activity.asciidoc
deleted file mode 100644
index b661ccc969..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-system-owner-or-user-discovery-activity.asciidoc
+++ /dev/null
@@ -1,68 +0,0 @@
-[[unusual-linux-system-owner-or-user-discovery-activity]]
-=== Unusual Linux System Owner or User Discovery Activity
-
-Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery in order to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping or privilege elevation activity.
-
-*Rule type*: machine_learning
-
-*Machine learning job*: v3_linux_system_user_discovery
-
-*Machine learning anomaly threshold*: 75
-
-
-*Severity*: low
-
-*Risk score*: 21
-
-*Runs every*: 15 minutes
-
-*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Linux
-* Threat Detection
-* ML
-
-*Version*: 100 (<<unusual-linux-system-owner-or-user-discovery-activity-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.5.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Potential false positives
-
-Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Discovery
-** ID: TA0007
-** Reference URL: https://attack.mitre.org/tactics/TA0007/
-* Technique:
-** Name: System Owner/User Discovery
-** ID: T1033
-** Reference URL: https://attack.mitre.org/techniques/T1033/
-
-[[unusual-linux-system-owner-or-user-discovery-activity-history]]
-==== Rule version history
-
-Version 100 (8.5.0 release)::
-* Formatting only
-
-Version 3 (8.3.0 release)::
-* Formatting only
-
-Version 2 (7.12.0 release)::
-* Formatting only
-
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd.exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd.exe.asciidoc
deleted file mode 100644
index 9b59a2a06b..0000000000
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd.exe.asciidoc
+++ /dev/null
@@ -1,142 +0,0 @@
-[[unusual-parent-process-for-cmd.exe]]
-=== Unusual Parent Process for cmd.exe
-
-Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.
-
-*Rule type*: eql
-
-*Rule indices*:
-
-* winlogbeat-*
-* logs-endpoint.events.*
-* logs-windows.*
-* endgame-*
-
-*Severity*: medium
-
-*Risk score*: 47
-
-*Runs every*: 5 minutes
-
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
-
-*Maximum alerts per execution*: 100
-
-*Tags*:
-
-* Elastic
-* Host
-* Windows
-* Threat Detection
-* Execution
-* Elastic Endgame
-
-*Version*: 102 (<<unusual-parent-process-for-cmd.exe-history, version history>>)
-
-*Added ({stack} release)*: 7.10.0
-
-*Last modified ({stack} release)*: 8.6.0
-
-*Rule authors*: Elastic
-
-*Rule license*: Elastic License v2
-
-==== Investigation guide
-
-
-[source,markdown]
-----------------------------------
-
-----------------------------------
-
-
-==== Rule query
-
-
-[source,js]
-----------------------------------
-process where event.type == "start" and process.name : "cmd.exe" and
-process.parent.name : ("lsass.exe",
-"csrss.exe", "epad.exe",
-"regsvr32.exe", "dllhost.exe",
-"LogonUI.exe", "wermgr.exe",
-"spoolsv.exe", "jucheck.exe",
-"jusched.exe", "ctfmon.exe",
-"taskhostw.exe", "GoogleUpdate.exe",
-"sppsvc.exe", "sihost.exe",
-"slui.exe", "SIHClient.exe",
-"SearchIndexer.exe",
-"SearchProtocolHost.exe",
-"FlashPlayerUpdateService.exe",
-"WerFault.exe", "WUDFHost.exe",
-"unsecapp.exe", "wlanext.exe" )
-----------------------------------
-
-==== Threat mapping
-
-*Framework*: MITRE ATT&CK^TM^
-
-* Tactic:
-** Name: Execution
-** ID: TA0002
-** Reference URL: https://attack.mitre.org/tactics/TA0002/
-* Technique:
-** Name: Command and Scripting Interpreter
-** ID: T1059
-** Reference URL: https://attack.mitre.org/techniques/T1059/
-
-[[unusual-parent-process-for-cmd.exe-history]]
-==== Rule version history
-
-Version 102 (8.6.0 release)::
-* Formatting only
-
-Version 101 (8.5.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-process where event.type in ("start", "process_started") and
-process.name : "cmd.exe" and process.parent.name : ("lsass.exe",
-"csrss.exe", "epad.exe",
-"regsvr32.exe", "dllhost.exe",
-"LogonUI.exe", "wermgr.exe",
-"spoolsv.exe", "jucheck.exe",
-"jusched.exe", "ctfmon.exe",
-"taskhostw.exe", "GoogleUpdate.exe",
-"sppsvc.exe", "sihost.exe",
-"slui.exe", "SIHClient.exe",
-"SearchIndexer.exe",
-"SearchProtocolHost.exe",
-"FlashPlayerUpdateService.exe",
-"WerFault.exe", "WUDFHost.exe",
-"unsecapp.exe", "wlanext.exe" )
-----------------------------------
-
-Version 7 (8.4.0 release)::
-* Formatting only
-
-Version 5 (8.2.0 release)::
-* Formatting only
-
-Version 4 (7.13.0 release)::
-* Updated query, changed from:
-+
-[source, js]
-----------------------------------
-event.category:process and event.type:(start or process_started) and
-process.name:cmd.exe and process.parent.name:(lsass.exe or csrss.exe
-or notepad.exe or regsvr32.exe or dllhost.exe or LogonUI.exe or
-wermgr.exe or spoolsv.exe or jucheck.exe or jusched.exe or ctfmon.exe
-or taskhostw.exe or GoogleUpdate.exe or sppsvc.exe or sihost.exe or
-slui.exe or SIHClient.exe or SearchIndexer.exe or
-SearchProtocolHost.exe or FlashPlayerUpdateService.exe or WerFault.exe
-or WUDFHost.exe or unsecapp.exe or wlanext.exe)
-----------------------------------
-
-Version 3 (7.12.0 release)::
-* Formatting only
-
-Version 2 (7.11.2 release)::
-* Formatting only
-

From 3576de1408ebc34c3f444d7b6b8ab0f50bc8c15b Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 14:00:15 -0500
Subject: [PATCH 05/14] readd missing file

---
 .../prebuilt-rules/rule-desc-index.asciidoc   |   1 -
 ...rvice-was-installed-in-the-system.asciidoc | 105 ++++++++++++++++++
 2 files changed, 105 insertions(+), 1 deletion(-)
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc

diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index e45bfdef13..32bc83a6b9 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -855,5 +855,4 @@ include::rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.ascii
 include::rule-details/windows-system-information-discovery.asciidoc[]
 include::rule-details/windows-user-account-creation.asciidoc[]
 include::rule-details/wireless-credential-dumping-using-netsh-command.asciidoc[]
-include::rule-details/workspace-user-group-access-modified-to-allow-external-access.asciidoc[]
 include::rule-details/zoom-meeting-with-no-passcode.asciidoc[]
\ No newline at end of file
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
new file mode 100644
index 0000000000..32c723563c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -0,0 +1,105 @@
+[[suspicious-service-was-installed-in-the-system]]
+=== Suspicious service was installed in the system
+
+Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-system.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5 minutes
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*Tags*:
+
+* Elastic
+* Host
+* Windows
+* Threat Detection
+* Persistence
+
+*Version*: 1
+
+*Added ({stack} release)*: 8.6.0
+
+*Rule authors*: Elastic
+
+*Rule license*: Elastic License v2
+
+==== Investigation guide
+
+
+[source,markdown]
+----------------------------------
+## Triage and analysis
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
+for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify how the service was created or modified. Look for registry changes events or Windows events related to
+service activities (for example, 4697 and/or 7045).
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+### False positive analysis
+
+- Certain services such as PSEXECSVC may happen legitimately. The security team should address any potential benign true
+positive (B-TP) by excluding the relevant FP by pattern.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
+identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
+systems, and web services.
+- Delete the service or restore it to the original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
+malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
+mean time to respond (MTTR).
+----------------------------------
+
+
+==== Rule query
+
+
+[source,js]
+----------------------------------
+any where (event.code : "4697" and
+(winlog.event_data.ServiceFileName : ("*COMSPEC*", "*\\172.0.0.1*",
+"*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
+"*echo*", "*RemComSvc*") or winlog.event_data.ServiceFileName
+regex~ """%systemroot%\\[a-z0-9]+\.exe""")) or (event.code : "7045"
+and winlog.event_data.ImagePath : ("*COMSPEC*", "*\\172.0.0.1*",
+"*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*", "*PSEXESVC*",
+"*echo*", "*RemComSvc*"))
+----------------------------------
+
+==== Threat mapping
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/

From 2f47d3ebf66dddff01536133681bf719a4360d42 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 14:26:29 -0500
Subject: [PATCH 06/14] fix reference

---
 .../prebuilt-rules/prebuilt-rules-changelog.asciidoc          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index 1732cdb338..b30a45b851 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -169,7 +169,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<execution-of-persistent-suspicious-program>>
 
-<<execution-via-mssql-xp_cmdshell-stored-procedure>>
+<<execution-via-mssql-xp-cmdshell-stored-procedure>>
 
 <<execution-via-tsclient-mountpoint>>
 
@@ -1206,7 +1206,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<execution-from-unusual-directory-command-line>>
 
-<<execution-via-mssql-xp_cmdshell-stored-procedure>>
+<<execution-via-mssql-xp-cmdshell-stored-procedure>>
 
 <<external-ip-lookup-from-non-browser-process>>
 

From c8a2126dca44cd87ac4a11dbabe102322967fac3 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 14:48:34 -0500
Subject: [PATCH 07/14] update references

---
 .../prebuilt-rules-changelog.asciidoc            | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index b30a45b851..c75c1a53ed 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -307,7 +307,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<startup-or-run-key-registry-modification>>
 
-<<suspicious-.net-code-compilation>>
+<<suspicious-net-code-compilation>>
 
 <<suspicious-browser-child-process>>
 
@@ -558,7 +558,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<launchdaemon-creation-or-modification-and-immediate-loading>>
 
-<<linux-restricted-shell-breakout-via-linux-binarys>>
+<<linux-restricted-shell-breakout-via-linux-binary-s>>
 
 <<ms-office-macro-security-registry-modifications>>
 
@@ -680,7 +680,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<sublime-plugin-or-application-script-modification>>
 
-<<suspicious-.net-reflection-via-powershell>>
+<<suspicious-net-reflection-via-powershell>>
 
 <<suspicious-calendar-file-modification>>
 
@@ -692,7 +692,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<suspicious-execution-via-scheduled-task>>
 
-<<suspicious-image-load-taskschd.dll-from-ms-office>>
+<<suspicious-image-load-taskschd-dll-from-ms-office>>
 
 <<suspicious-ms-office-child-process>>
 
@@ -1314,11 +1314,11 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<unusual-child-process-from-a-system-virtual-process>>
 
-<<unusual-child-process-of-dns.exe>>
+<<unusual-child-process-of-dns-exe>>
 
 <<unusual-executable-file-creation-by-a-system-critical-process>>
 
-<<unusual-file-modification-by-dns.exe>>
+<<unusual-file-modification-by-dns-exe>>
 
 <<unusual-network-connection-via-rundll32>>
 
@@ -1418,7 +1418,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<suspicious-cmd-execution-via-wmi>>
 
-<<suspicious-image-load-taskschd.dll-from-ms-office>>
+<<suspicious-image-load-taskschd-dll-from-ms-office>>
 
 <<suspicious-powershell-engine-imageload>>
 
@@ -1578,7 +1578,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<smb-windows-file-sharing-activity-to-the-internet>>
 
-<<suspicious-.net-code-compilation>>
+<<suspicious-net-code-compilation>>
 
 <<suspicious-endpoint-security-parent-process>>
 

From c5cc495794f5e009ddf93bce88ee9e328ab7e6cd Mon Sep 17 00:00:00 2001
From: Mika Ayenson <mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 15:02:30 -0500
Subject: [PATCH 08/14] update reference

---
 .../detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index c75c1a53ed..63677e5aa6 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -1592,7 +1592,7 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<unusual-child-processes-of-rundll32>>
 
-<<unusual-file-modification-by-dns.exe>>
+<<unusual-file-modification-by-dns-exe>>
 
 <<unusual-network-connection-via-rundll32>>
 

From 12a60a68270021a8e847087ebfc6762b3fd4fa50 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <Mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 15:25:19 -0500
Subject: [PATCH 09/14] remove missing links

---
 .../prebuilt-rules/prebuilt-rules-changelog.asciidoc | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index 63677e5aa6..3b832f3deb 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -319,8 +319,6 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<suspicious-endpoint-security-parent-process>>
 
-<<suspicious-execution-short-program-name>>
-
 <<suspicious-execution-via-scheduled-task>>
 
 <<suspicious-explorer-child-process>>
@@ -632,8 +630,6 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<potential-reverse-shell-activity-via-terminal>>
 
-<<potential-shell-via-web-server>>
-
 <<powershell-kerberos-ticket-request>>
 
 <<powershell-keylogging-script>>
@@ -1691,8 +1687,6 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<suspicious-activity-reported-by-okta-user>>
 
-<<threat-detected-by-okta-threatinsight>>
-
 <<unusual-network-connection-via-rundll32>>
 
 <<unusual-parent-child-relationship>>
@@ -1786,8 +1780,6 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 
 <<potential-disabling-of-selinux>>
 
-<<potential-shell-via-web-server>>
-
 <<psexec-network-connection>>
 
 <<rdp-remote-desktop-protocol-from-the-internet>>
@@ -1841,8 +1833,6 @@ To see the updates for 8.7 and further releases, please visit the https://www.el
 [float]
 === 7.8.0
 
-<<potential-shell-via-web-server>>
-
 <<unusual-network-connection-via-rundll32>>
 
 [float]
@@ -1971,8 +1961,6 @@ These prebuilt rules have been updated:
 
 <<ipsec-nat-traversal-port-activity>>
 
-<<potential-shell-via-web-server>>
-
 <<rdp-remote-desktop-protocol-from-the-internet>>
 
 <<rpc-remote-procedure-call-from-the-internet>>

From e77c6bd9aa3585f58137d9113c24b2df16c88120 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <Mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 15:40:27 -0500
Subject: [PATCH 10/14] update link to prebuilt rules

---
 .../prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 710583e85c..0cf850e756 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -4,7 +4,7 @@
 
 This section lists all updates to prebuilt detection rules, made available with the *Prebuilt Security Detection Rules* integration in Fleet.
 
-To update your installed rules to the latest versions, follow the instructions in <<update-prebuilt-rules>>.
+To update your installed rules to the latest versions, follow the instructions in <<download-prebuilt-rules>>.
 
 For previous rule updates, please navigate to the https://www.elastic.co/guide/en/security/8.7/prebuilt-rules-downloadable-updates.html[last version].
 

From a424e479c166835c77cda4a4db0deb7e6178fd67 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <Mika.ayenson@elastic.co>
Date: Thu, 27 Jul 2023 16:05:31 -0500
Subject: [PATCH 11/14] update links

---
 .../rule-details/linux-group-creation.asciidoc   |  2 +-
 .../linux-user-account-creation.asciidoc         |  2 +-
 ...linux-user-added-to-privileged-group.asciidoc |  2 +-
 .../new-systemd-timer-created.asciidoc           |  2 +-
 ...linux-backdoor-user-account-creation.asciidoc |  2 +-
 ...-persistence-through-init-d-detected.asciidoc |  2 +-
 ...-through-motd-file-creation-detected.asciidoc |  2 +-
 ...istence-through-run-control-detected.asciidoc |  2 +-
 ...remote-code-execution-via-web-server.asciidoc |  2 +-
 ...s-process-spawned-from-motd-detected.asciidoc |  2 +-
 .../threat-intel-hash-indicator-match.asciidoc   |  4 ++--
 ...eat-intel-ip-address-indicator-match.asciidoc | 16 ++++++++--------
 .../threat-intel-url-indicator-match.asciidoc    | 16 ++++++++--------
 ...tel-windows-registry-indicator-match.asciidoc |  4 ++--
 14 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index 1aaa59dd0b..da19a2dae9 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -55,7 +55,7 @@ This rule identifies the usages of `groupadd` and `addgroup` to create new group
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index 84aaaa8be9..4b12f46b9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -55,7 +55,7 @@ This rule identifies the usage of `useradd` and `adduser` to create new accounts
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
index fac1c027cd..2c052c89a4 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -57,7 +57,7 @@ This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
index b250b4dfb6..70c46723d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -60,7 +60,7 @@ This rule monitors the creation of new systemd timer files, potentially indicati
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
index 989e61b853..362d9b3599 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -57,7 +57,7 @@ This rule identifies the usage of the `usermod` command to set a user's UID to 0
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 - Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
index acac554362..1c1cf318d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -61,7 +61,7 @@ This rule looks for the creation of new files within the `/etc/init.d/` director
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 #### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
index 8046166b2f..6734516919 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -59,7 +59,7 @@ This rule identifies the creation of new files within the `/etc/update-motd.d/`
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
index 0f5d3d9d2c..336d386b95 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -61,7 +61,7 @@ Detection alerts from this rule indicate the creation of a new `/etc/rc.local` f
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
index 776cab57ff..236f5b1d9d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -60,7 +60,7 @@ This rule detects a web server process spawning script and command line interfac
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
index 41c07a8b59..90d6bc8542 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -59,7 +59,7 @@ This rule identifies the execution of potentially malicious processes from a MOT
 
 > **Note**:
 > This investigation guide uses the [Osquery Markdown Plugin]({security-guide}/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses [placeholder fields]({security-guide}/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index 46adade018..b0c3910fa0 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -103,9 +103,9 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration]({security-guide}/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module]({security-guide}/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration]({security-guide}/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found [here]({security-guide}/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index 60710c811e..acd1356eb7 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -5,7 +5,7 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 
 *Rule type*: threat_match
 
-*Rule indices*: 
+*Rule indices*:
 
 * auditbeat-*
 * endgame-*
@@ -24,13 +24,13 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 
 *Maximum alerts per execution*: 100
 
-*References*: 
+*References*:
 
 * https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
 * https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html
 * https://www.elastic.co/security/tip
 
-*Tags*: 
+*Tags*:
 
 * OS: Windows
 * Data Source: Elastic Endgame
@@ -38,7 +38,7 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 
 *Version*: 2
 
-*Rule authors*: 
+*Rule authors*:
 
 * Elastic
 
@@ -54,7 +54,7 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 
 ### Investigating Threat Intel IP Address Indicator Match
 
-Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. 
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
 
 Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
 
@@ -64,7 +64,7 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 
 - Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.
 - Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:
-  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. 
+  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
   - Execute a reverse DNS lookup to retrieve hostnames associated with the given IP address.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 - Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -102,9 +102,9 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration]({security-guide}/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module]({security-guide}/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration]({security-guide}/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found [here]({security-guide}/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index ed7f7e17a5..bd58969416 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -5,7 +5,7 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 
 *Rule type*: threat_match
 
-*Rule indices*: 
+*Rule indices*:
 
 * auditbeat-*
 * endgame-*
@@ -24,13 +24,13 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 
 *Maximum alerts per execution*: 100
 
-*References*: 
+*References*:
 
 * https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
 * https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html
 * https://www.elastic.co/security/tip
 
-*Tags*: 
+*Tags*:
 
 * OS: Windows
 * Data Source: Elastic Endgame
@@ -38,7 +38,7 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 
 *Version*: 2
 
-*Rule authors*: 
+*Rule authors*:
 
 * Elastic
 
@@ -54,7 +54,7 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 
 ### Investigating Threat Intel URL Indicator Match
 
-Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. 
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
 
 Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
 
@@ -64,7 +64,7 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 
 - Investigate the URL, which can be found in the `threat.indicator.matched.atomic` field:
   - Identify the type of malicious activity related to the URL (phishing, malware, etc.).
-  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. 
+  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
   - Execute a WHOIS lookup to retrieve information about the domain registration and contacts to report abuse.
   - If dealing with a phishing incident:
     - Contact the user to gain more information around the delivery method, information sent, etc.
@@ -105,9 +105,9 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration]({security-guide}/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module]({security-guide}/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration]({security-guide}/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found [here]({security-guide}/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index 299699cc93..c6f855768a 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -98,9 +98,9 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration]({security-guide}/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module]({security-guide}/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration]({security-guide}/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found [here]({security-guide}/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query

From f046004725331555a2a2216549682d8de2526162 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Date: Thu, 27 Jul 2023 17:28:35 -0500
Subject: [PATCH 12/14] Apply suggestions from code review

---
 .../detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index 3b832f3deb..cf54a41dbe 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -5,7 +5,7 @@ The following lists prebuilt rule updates per release. Only rules with
 significant modifications to their query or scope are listed. For detailed
 information about a rule's changes, see the rule's description page.
 
-To see the updates for 8.7 and further releases, please visit the https://www.elastic.co/guide/en/security/8.7/prebuilt-rules-downloadable-updates.html[last version] for the updates.
+To see the updates for 8.8 and further releases, please visit the https://www.elastic.co/guide/en/security/8.8/prebuilt-rules-downloadable-updates.html[last version] for the updates.
 
 [float]
 === 8.6.0

From f98add3ea76ce95804887a1641b02877a46b1bb7 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Date: Thu, 27 Jul 2023 17:32:51 -0500
Subject: [PATCH 13/14] Update
 docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc

---
 .../detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index cf54a41dbe..d7a4fa6b93 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -5,7 +5,7 @@ The following lists prebuilt rule updates per release. Only rules with
 significant modifications to their query or scope are listed. For detailed
 information about a rule's changes, see the rule's description page.
 
-To see the updates for 8.8 and further releases, please visit the https://www.elastic.co/guide/en/security/8.8/prebuilt-rules-downloadable-updates.html[last version] for the updates.
+To see the updates for 8.9 and further releases, please visit the https://www.elastic.co/guide/en/security/8.9/prebuilt-rules-downloadable-updates.html[last version] for the updates.
 
 [float]
 === 8.6.0

From 6119efc3f4ae55fbbeaff0a4c77180f855d3d532 Mon Sep 17 00:00:00 2001
From: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Date: Thu, 27 Jul 2023 18:31:44 -0500
Subject: [PATCH 14/14] Update
 docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc

---
 .../detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
index d7a4fa6b93..cf54a41dbe 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
@@ -5,7 +5,7 @@ The following lists prebuilt rule updates per release. Only rules with
 significant modifications to their query or scope are listed. For detailed
 information about a rule's changes, see the rule's description page.
 
-To see the updates for 8.9 and further releases, please visit the https://www.elastic.co/guide/en/security/8.9/prebuilt-rules-downloadable-updates.html[last version] for the updates.
+To see the updates for 8.8 and further releases, please visit the https://www.elastic.co/guide/en/security/8.8/prebuilt-rules-downloadable-updates.html[last version] for the updates.
 
 [float]
 === 8.6.0