From 1dfb05ec1cd5604db32e7ac602fd28435c19eb65 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 4 Feb 2025 00:05:59 +0530
Subject: [PATCH] Lock versions for releases: 8.12,8.13,8.14,8.15,8.16,8.17
 (#4442)

---
 detection_rules/etc/version.lock.json | 6745 +++++++++++++------------
 pyproject.toml                        |    2 +-
 2 files changed, 3404 insertions(+), 3343 deletions(-)

diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json
index 0147e5f38..4fa6fc294 100644
--- a/detection_rules/etc/version.lock.json
+++ b/detection_rules/etc/version.lock.json
@@ -5,22 +5,22 @@
       "8.12": {
         "max_allowable_version": 309,
         "rule_name": "Attempt to Modify an Okta Policy Rule",
-        "sha256": "2b1d6cbdeadcd4ff4265d6af38ef3978c87c1ebde1bf2c84522ba5cbc8883d11",
+        "sha256": "61224002fe2acb034c68f8a1ce071b7b5373f3cce6e3134e155cd51017a68e99",
         "type": "query",
-        "version": 210
+        "version": 211
       },
       "8.14": {
         "max_allowable_version": 410,
         "rule_name": "Attempt to Modify an Okta Policy Rule",
-        "sha256": "2b1d6cbdeadcd4ff4265d6af38ef3978c87c1ebde1bf2c84522ba5cbc8883d11",
+        "sha256": "61224002fe2acb034c68f8a1ce071b7b5373f3cce6e3134e155cd51017a68e99",
         "type": "query",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Attempt to Modify an Okta Policy Rule",
-    "sha256": "561c0d51c4c4e4beb9bcd901a8b3f7be2ed94911ca0dca31faf86088f75aec7a",
+    "sha256": "983f1980633f2fdeefc4b7d50b5e5662382880e65a27b51351387386cf225207",
     "type": "query",
-    "version": 411
+    "version": 412
   },
   "00140285-b827-4aee-aa09-8113f58a08f3": {
     "min_stack_version": "8.14",
@@ -51,59 +51,59 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "System Shells via Services",
-        "sha256": "41fba361b5b99330766decbe9810fc33075a30aa9e8f0cbf55f2770a20914783",
+        "sha256": "234ca1d03d9490f694e58e4e930034af44bc5607d0b3d9b618220e2c43f63709",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 413,
         "rule_name": "System Shells via Services",
-        "sha256": "708a60d7b82bcae8d3c5d83d4e192c9b30bb0f4e8d73b7c6c3cb947d05f98199",
+        "sha256": "053a24a7c772b51aa6c4cacaaf2b60d644b999d648117254f85fb9550c02b7d1",
         "type": "eql",
-        "version": 314
+        "version": 315
       }
     },
     "rule_name": "System Shells via Services",
-    "sha256": "15ba51d5a9926689787c960642056ab3de981a47b061a42487b3d8425f22e435",
+    "sha256": "3c7e037d08a986cffce89446616f2c30c98c4f0c30ab9560f83af5f3f4ae76dc",
     "type": "eql",
-    "version": 415
+    "version": 416
   },
   "0049cf71-fe13-4d79-b767-f7519921ffb5": {
     "rule_name": "System Binary Path File Permission Modification",
-    "sha256": "f349feeacc158450a8c5f0668ae859afc19fd12c10c89d18b3f0f2ddd04215dd",
+    "sha256": "110f1d5ec2ca1f18a3743314973ced9654ea4260ae861e092afd16c9f929ecd4",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "00678712-b2df-11ed-afe9-f661ea17fbcc": {
     "rule_name": "Google Workspace Suspended User Account Renewed",
-    "sha256": "8283b518baac8842c7ce326891bda4e15bace4d280e83afbd132727190139aee",
+    "sha256": "084af080fe0d6182cf5ea6c48b232167996f3eead720253e885568afa89e5afa",
     "type": "query",
-    "version": 3
+    "version": 4
   },
   "0136b315-b566-482f-866c-1d8e2477ba16": {
     "rule_name": "Microsoft 365 User Restricted from Sending Email",
-    "sha256": "35df6afe89ac91c72e0499d991574f17f0b1d4567e874f7e65976b6828bfac4f",
+    "sha256": "3d31dd5d0a8353000b212c5ffe3b14f5abe88a3f98db97488625321608bd20f0",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "015cca13-8832-49ac-a01b-a396114809f6": {
     "rule_name": "AWS Redshift Cluster Creation",
-    "sha256": "4b8809bf7107aa3e8169d82047acb52c422c663b159574d29a8176d7a9fb6dca",
+    "sha256": "1341375c3cccb30e7ed441439c386122fec8eca43759b591f42c42d2bd11083f",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "0171f283-ade7-4f87-9521-ac346c68cc9b": {
     "rule_name": "Potential Network Scan Detected",
-    "sha256": "0b7bd18f56d2a7b5f3bc16613aeb6e2a09c6a9ccc54a0592c9835fff18811b79",
+    "sha256": "c1b9eadbd36d57badf096a96ee583481a92a6e1de6d1e40b428fb368591eff60",
     "type": "threshold",
-    "version": 7
+    "version": 8
   },
   "017de1e4-ea35-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Memory Threat - Detected - Elastic Defend",
-    "sha256": "9bd0f3d01ba4fa20cad1d9fbbc2e6ceb49cc0b07a3e1c1c6250c0f990af738e6",
+    "sha256": "a6477740d6012e55a9333f32ef516a7b656ca22dba1362371129cc6f75da54ab",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "01c49712-25bc-49d2-a27d-d7ce52f5dc49": {
     "min_stack_version": "8.13",
@@ -127,15 +127,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Potential Cookies Theft via Browser Debugging",
-        "sha256": "0ae709b171f47f1273c0e0cdc34fd30e5b64862da6d9840ff006ba59d85f9b10",
+        "sha256": "810907d90a27aee361c0e4bdf4d0bfe79e58e47c2b9f7a8df4b14ad750f1aa8a",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Potential Cookies Theft via Browser Debugging",
-    "sha256": "28cbeaec5f3660a4e3a04bc6a7cb9638f8a0875530b512ad5614994fe1c3f004",
+    "sha256": "dbcb6ee16e0332c0f9e3c35385be6f5264364abf46e4cfa8504e52f66afc3999",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "0294f105-d7af-4a02-ae90-35f56763ffa2": {
     "min_stack_version": "8.13",
@@ -155,9 +155,9 @@
   },
   "02a23ee7-c8f8-4701-b99d-e9038ce313cb": {
     "rule_name": "Process Created with an Elevated Token",
-    "sha256": "a08170ff704e6eee3ac998cc9775b0a089926b6ba906ba421faa17c0c11a47db",
+    "sha256": "1ac8ed3b1ca5fea1b2f1908042c00a316d4459af2220eb483569bcea820be9c1",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "02a4576a-7480-4284-9327-548a806b5e48": {
     "min_stack_version": "8.14",
@@ -165,15 +165,15 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Potential Credential Access via DuplicateHandle in LSASS",
-        "sha256": "08ccb0b77ba1240408e1418cf800f0677b541367930b3cb9a986a4adfcbe2dac",
+        "sha256": "376189f0989a9c834ea9e807f1c31236301e528eec227aa389419a7e53aeabf0",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Potential Credential Access via DuplicateHandle in LSASS",
-    "sha256": "378f6d82a234a955375536d3a61db47a5093fe754b62078f81f9746f4e1a3ac7",
+    "sha256": "3e2498d141db920ce8fc17488acde7032ea81b42d39f7e26c4050febb32a3bec",
     "type": "eql",
-    "version": 308
+    "version": 309
   },
   "02bab13d-fb14-4d7c-b6fe-4a28874d37c5": {
     "rule_name": "Potential Ransomware Note File Dropped via SMB",
@@ -183,15 +183,15 @@
   },
   "02ea4563-ec10-4974-b7de-12e65aa4f9b3": {
     "rule_name": "Dumping Account Hashes via Built-In Commands",
-    "sha256": "450f7c6f060ecb022c4c2e14be6190a34524d0c07a56809370cfbd62e51f85bb",
+    "sha256": "a07d5178b0d63fe45832be7feae2eea146956b3b81baf2c247c23c39a4465af4",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "03024bd9-d23f-4ec1-8674-3cf1a21e130b": {
     "rule_name": "Microsoft 365 Exchange Safe Attachment Rule Disabled",
-    "sha256": "74d0cdf9039c5f529d26a7d3c4c076e387ed8e163e3ae7e021feb78bbd355573",
+    "sha256": "6914713f09336f9c3dd081ef53ac47488673b0d06d86d731eae0c68021783845",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "035889c4-2686-4583-a7df-67f89c292f2c": {
     "min_stack_version": "8.14",
@@ -221,39 +221,39 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Suspicious Dynamic Linker Discovery via od",
-        "sha256": "4ae40153ed65b4fdddee0a5528f9123c100ef8e2ba1710993374975e3b6320d8",
+        "sha256": "63da0c176cc07352e9a1cb9d92ededc8900ca1b1c6f6dfa5b1d8af6e158f55fa",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Suspicious Dynamic Linker Discovery via od",
-    "sha256": "5a89e9c9403463bc8cad9d70b104d352791bd9ba509e45e22ce425a5b8bdba4e",
+    "sha256": "7be24103e80b488ec59b95552a069f1c357d42f5fec529c19402f290b74e282c",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "03a514d9-500e-443e-b6a9-72718c548f6c": {
     "rule_name": "SSH Process Launched From Inside A Container",
-    "sha256": "f4b1b23b638e8ea812f6cf173daedccc2a82fb1df5feeca4e6723b6726052c4d",
+    "sha256": "f20d44b0d750d0c26fca0b620394312ba50e05209f19a2c8efe8a5779d97e899",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "03c23d45-d3cb-4ad4-ab5d-b361ffe8724a": {
     "rule_name": "Potential Network Scan Executed From Host",
-    "sha256": "d8d678cf5d5ac1994120d5171bc69702a7acd37f5bb9611dd14a19a952652ea4",
+    "sha256": "ae3ea0137d74ca472a7ba99931f0fb829c7b6419004e69b9a9a0ac88b87e0ebb",
     "type": "threshold",
-    "version": 3
+    "version": 4
   },
   "0415258b-a7b2-48a6-891a-3367cd9d4d31": {
     "rule_name": "First Time AWS Cloudformation Stack Creation by User",
-    "sha256": "94bf8efc1418d0c3dbcfad25b23fcfb931aaa7d34d5a718971956c00ce220f69",
+    "sha256": "52da905207d1e7c88fc6422717c8a5e4a92dc36ee070a06fc4bcdbc3d90476d3",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "0415f22a-2336-45fa-ba07-618a5942e22c": {
     "rule_name": "Modification of OpenSSH Binaries",
-    "sha256": "04af79fc085a46b7a9239dd4f9bfaf09118355ac4802004f3fdb734b00113972",
+    "sha256": "3b26f04620990f0636c48d69c7dddb1091ac744f61ef4244cf1bf27d38677ecc",
     "type": "query",
-    "version": 110
+    "version": 111
   },
   "041d4d41-9589-43e2-ba13-5680af75ebc2": {
     "rule_name": "Deprecated - Potential DNS Tunneling via Iodine",
@@ -267,34 +267,34 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Potential Escalation via Vulnerable MSI Repair",
-        "sha256": "c033b9b9cf89ada890efbe4f3d50749d62d412f4f4649252be0cde9f15bab174",
+        "sha256": "47373227a503f5fe1fde96d536e6a205fcac83b971b0dee087b3614cd96c814f",
         "type": "eql",
-        "version": 2
+        "version": 3
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Potential Escalation via Vulnerable MSI Repair",
-        "sha256": "ca6b6244eb33d751ab8afe90e9447bc34a5cd46b0e4604ee73d8c2e77612cb67",
+        "sha256": "8d179fe06605d1b9a62c3cda5f232e20d6e98172b8c62bc1ac5e3c362f0caf83",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "Potential Escalation via Vulnerable MSI Repair",
-    "sha256": "8a7f7f22aef8cdf2fa76b6194ccab0d26453470ba193c15aa82ef83fa9cf3102",
+    "sha256": "95d69d7ba9d1821cb7a31fc102eddbf4725f3512d45f8c1129cd08902c00b9da",
     "type": "eql",
-    "version": 202
+    "version": 203
   },
   "04c5a96f-19c5-44fd-9571-a0b033f9086f": {
     "rule_name": "Azure AD Global Administrator Role Assigned",
-    "sha256": "fd3270ab237a24dde97ddba5bd81bde19c086742e131a59117fa0e610f05bef9",
+    "sha256": "60c46c899a69ab28b32485227c01fb16cee84b26abd65893b8f900c888034338",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "04e65517-16e9-4fc4-b7f1-94dc21ecea0d": {
     "rule_name": "User Added to the Admin Group",
-    "sha256": "018ed4ea49d89558cfa618d30dec9b266a2926894b75e434ede0254443d6bab9",
+    "sha256": "605d63b5087ecb7c6b317b124502b5109f16a229ccb1a878d7f5c7f08940e119",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "053a0387-f3b5-4ba5-8245-8002cca2bd08": {
     "min_stack_version": "8.14",
@@ -302,21 +302,21 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable",
-        "sha256": "e4bf9920903785a4d419c63645c7e09513aac5d799ecd7dbebd52664884af5e0",
+        "sha256": "1ca8fdf09317fd36c70df03f3201b8274dda82e84f259811b7e392d1b5d8e6b4",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable",
-    "sha256": "ae7b800eac312f398df8ba82f12abc2529bb704c4185f69948be3617af2847fb",
+    "sha256": "a219cd9773dc1fa8aa69881e4de1fb3c8b9b635a1c380a4782cf15cec90f8904",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "054db96b-fd34-43b3-9af2-587b3bd33964": {
     "rule_name": "Systemd-udevd Rule File Creation",
-    "sha256": "12d9feafcc88441dac8a47687708fa8fb7bf194076d084b80efd2128b97a5570",
+    "sha256": "8d613ba421aebd8dcbce56302f1c2d6a19b749085004adc1050a81aed090dcc5",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "0564fb9d-90b9-4234-a411-82a546dc1343": {
     "min_stack_version": "8.14",
@@ -359,15 +359,15 @@
   },
   "05cad2fb-200c-407f-b472-02ea8c9e5e4a": {
     "rule_name": "Tainted Kernel Module Load",
-    "sha256": "ce113c2fec8fb1bd012edc6533530b5ebe0b8145fa062e4e77c0a909435c6bf4",
+    "sha256": "6e6fcbbf2ea3332a110e3c68ebc52cde1b789a0370ce24f76e00a25d8c349bf6",
     "type": "query",
-    "version": 4
+    "version": 5
   },
   "05e5a668-7b51-4a67-93ab-e9af405c9ef3": {
     "rule_name": "Interactive Terminal Spawned via Perl",
-    "sha256": "e7a0bce29457ba5f1e9159d5e17e7344da87a83b390be4e989e842573acca754",
+    "sha256": "c70d925a16e8a0ca54c52ed7ba79164ff5091150dc18e8f3096440d73fd87433",
     "type": "query",
-    "version": 108
+    "version": 109
   },
   "0635c542-1b96-4335-9b47-126582d2c19a": {
     "min_stack_version": "8.14",
@@ -403,9 +403,9 @@
   },
   "0678bc9c-b71a-433b-87e6-2f664b6b3131": {
     "rule_name": "Unusual Remote File Size",
-    "sha256": "86c63dfc5a14108858c1a668088b651845e888e1dfa6764e364d7193cda1e105",
+    "sha256": "1c0662f5b11e6019bfa3e32d36fedf5821114840e8aa8e424150ea7631c58079",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "06a7a03c-c735-47a6-a313-51c354aef6c3": {
     "min_stack_version": "8.14",
@@ -436,15 +436,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Dynamic Linker (ld.so) Creation",
-        "sha256": "d199c5e9dfd9aa2e6e54808f02b7c661ba51e4c78cc780b45d0e910dc09b0230",
+        "sha256": "798d7634945767913aeab178e7df25c3696ac6e993cbaaaefe8030ea91fe0f4c",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Dynamic Linker (ld.so) Creation",
-    "sha256": "25c134214022fe4919832996ce775387fbd9ee22fda14c49daaecb865d145206",
+    "sha256": "cf3d305ea89fd7b2c84f8ed412f55d0c5180e021f2d107a517d501e85c15e038",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "06dceabf-adca-48af-ac79-ffdf4c3b1e9a": {
     "min_stack_version": "8.14",
@@ -452,22 +452,22 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Potential Evasion via Filter Manager",
-        "sha256": "b4231cb6409668adc787176da9f432d5d9c835cff96c03363e9ce8745301edd1",
+        "sha256": "fe0b271cf1660d839ba9c04e3ae7c6a2ae6bfc5ba80b354d7aa2ebf8ba75db6b",
         "type": "eql",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Potential Evasion via Filter Manager",
-    "sha256": "3a61aa859d4dd430becb99b7310d8f43570207832557eedf3e2684c3180cd10c",
+    "sha256": "cb388e3a30c4e77292f3c6ffde5fabc2aa388f8affa6756cf70e1b8442d61a30",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "06f3a26c-ea35-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Memory Threat - Prevented- Elastic Defend",
-    "sha256": "542beb283553b21b373b87f1963fa845b95929b9664d3af97f7777e621206a0b",
+    "sha256": "96b6afa2ed123a001168eaaafe269a572393ee32c8248cd27a29182040b5dbcc",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "074464f9-f30d-4029-8c03-0ed237fffec7": {
     "min_stack_version": "8.14",
@@ -498,15 +498,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "GitHub Protected Branch Settings Changed",
-        "sha256": "21560cd77773e80fae169bfd655882afac47171cf7a2fc8057d3ffd28c537333",
+        "sha256": "380c523049b8404ce0d831d93a39d8d6e334c2a51c94e3454920aa9b947d0d60",
         "type": "eql",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "GitHub Protected Branch Settings Changed",
-    "sha256": "d8a91efd007be1ed16d117fe17458c7361f18450b73e73083ee88ec02bf6d049",
+    "sha256": "3d9549ea279015b77bc82b2e69b630d2013529cbc37e51d1316381f1c8f34d54",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "0787daa6-f8c5-453b-a4ec-048037f6c1cd": {
     "rule_name": "Suspicious Proc Pseudo File System Enumeration",
@@ -520,22 +520,22 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Local Account TokenFilter Policy Disabled",
-        "sha256": "1c3ab4d2b102c8ec800f2887356dbfc15b6aa901629c763e6a1a1642a1ded75d",
+        "sha256": "09c2f36752a76180ee5f6c3d999fca9b4a594baf1e68da518828098d4a918b29",
         "type": "eql",
-        "version": 9
+        "version": 10
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "Local Account TokenFilter Policy Disabled",
-        "sha256": "1d581fab9894150d93b9290184613601916238ed613aed8f033ba029c6d7f747",
+        "sha256": "7a1e221305122e11869857dfef01583fa3242e9353bbc3c58bd029ddc08ce349",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Local Account TokenFilter Policy Disabled",
-    "sha256": "cba44e5f0b785c8ff69b139d209a7e10ae87452830da92efee001b69f5a95d51",
+    "sha256": "a02807e2dbf00fd418c04b345cf9bb599e756134d50cfc7ceb239d0db3e3d270",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "07b5f85a-240f-11ed-b3d9-f661ea17fbce": {
     "rule_name": "Google Drive Ownership Transferred via Google Workspace",
@@ -545,21 +545,21 @@
   },
   "080bc66a-5d56-4d1f-8071-817671716db9": {
     "rule_name": "Suspicious Browser Child Process",
-    "sha256": "1678ce85ef34f778c0a71b6aec184f3f30550c0c641544c922f4ae9eee9dd5be",
+    "sha256": "a43d168f61e8163581d0687f0304f03e2ddae74d1116c478f933178625133b7d",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "082e3f8c-6f80-485c-91eb-5b112cb79b28": {
     "rule_name": "Launch Agent Creation or Modification and Immediate Loading",
-    "sha256": "e27de95651bbdd93ef96aab3c00d5d496a005ac796a8a277a28331ad9552a879",
+    "sha256": "c267399fea2ab4ee01b5424d01dc5ca68f6fbcb529f4f0c022cde54d6f87b25e",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "083fa162-e790-4d85-9aeb-4fea04188adb": {
     "rule_name": "Suspicious Hidden Child Process of Launchd",
-    "sha256": "997d8ce81fcbd8b47fa77b50434bd99ba1c4606f6d935a4af76098e5d9c28ece",
+    "sha256": "a01dd38408bbec2545a780590fb1551649acb6e25b7f9589b305b518dcfae70a",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "0859355c-0f08-4b43-8ff5-7d2a4789fc08": {
     "min_stack_version": "8.14",
@@ -567,22 +567,22 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "First Time Seen Removable Device",
-        "sha256": "aec36fbd3822bf9e12b866c619574507647dfdec52725d3f77d00b7be3d4aaef",
+        "sha256": "f1ac8cf1be60a96de758a01dfbfd0a5b594450e5a38ceae29fc315267402c892",
         "type": "new_terms",
-        "version": 9
+        "version": 10
       },
       "8.13": {
         "max_allowable_version": 208,
         "rule_name": "First Time Seen Removable Device",
-        "sha256": "629de40be19abc034ed2f876dd72df2fc72ce0397116eed55c08d790401d4da6",
+        "sha256": "c14fec5bc1b916855cac0929b535c0865ae08136bf417b3ef52374ed88a27cc5",
         "type": "new_terms",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "First Time Seen Removable Device",
-    "sha256": "20d5ab4b426cb84f65b990fde4a3011164e908b124f4c961646afae8d6e73a58",
+    "sha256": "70f7e9b02ae62752a1aa355c2bf0737861fcbe8f6d564b36f533e1c115925ed6",
     "type": "new_terms",
-    "version": 209
+    "version": 210
   },
   "089db1af-740d-4d84-9a5b-babd6de143b0": {
     "rule_name": "Windows Account or Group Discovery",
@@ -598,15 +598,15 @@
   },
   "092b068f-84ac-485d-8a55-7dd9e006715f": {
     "rule_name": "Creation of Hidden Launch Agent or Daemon",
-    "sha256": "bd61ec617f7cc0e401d2a89073a35ae316baab560f044fda528a0a38bbd2c993",
+    "sha256": "df3311bb176bf73432fcbf38549d153c5d42b0a2dc86764c6daa86fc9db5903f",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "09443c92-46b3-45a4-8f25-383b028b258d": {
     "rule_name": "Process Termination followed by Deletion",
-    "sha256": "07259ee65eed64efa83cd67f2944378c9f5eac6af8a0d950ddf46fd06505c613",
+    "sha256": "14b2c50279749311159d46204420c773d52555a562d83ce604a03fd9d9abaafb",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "095b6a58-8f88-4b59-827c-ab584ad4e759": {
     "min_stack_version": "8.13",
@@ -632,27 +632,27 @@
   },
   "09bc6c90-7501-494d-b015-5d988dc3f233": {
     "rule_name": "File Creation, Execution and Self-Deletion in Suspicious Directory",
-    "sha256": "ba5ece96c45f82ec3deddbb0311dc407ea0a8234e9dea257649d0cd4014c2eff",
+    "sha256": "c8115f0fe38df7a874ae8c9073dfe093a940fc49c4e0f9ae6c7e317213b43120",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "09d028a5-dcde-409f-8ae0-557cef1b7082": {
     "rule_name": "Azure Frontdoor Web Application Firewall (WAF) Policy Deleted",
-    "sha256": "08faf9e24053c3b8463889e3c47cec194c8acedaad33ce17bc7acd6ac50c3a53",
-    "type": "query",
-    "version": 102
-  },
-  "0a97b20f-4144-49ea-be32-b540ecc445de": {
-    "rule_name": "Malware - Detected - Elastic Endgame",
-    "sha256": "6e5837c5ce6d6866ed28e8c33e2bd9945580de7462f25874b585d7f96997daa2",
+    "sha256": "f6a45024261cb0b349f1b5e65afcbfd1cffe90e669fa3157bf60ea20538b5f44",
     "type": "query",
     "version": 103
   },
+  "0a97b20f-4144-49ea-be32-b540ecc445de": {
+    "rule_name": "Malware - Detected - Elastic Endgame",
+    "sha256": "7a47db16ef187e82ca162b4ddc7be98c559c56f60930c7f857b4998e456db762",
+    "type": "query",
+    "version": 104
+  },
   "0ab319ef-92b8-4c7f-989b-5de93c852e93": {
     "rule_name": "Statistical Model Detected C2 Beaconing Activity with High Confidence",
-    "sha256": "d6a0f724b514c85dbde5be35083810d0d6e18c2cd144eef691aa03bd23590370",
+    "sha256": "d0ca847022a16689d65f980293f4e0fd6f57daf55cdf34dcf2d377d146f0757a",
     "type": "query",
-    "version": 5
+    "version": 6
   },
   "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83": {
     "min_stack_version": "8.14",
@@ -672,9 +672,9 @@
   },
   "0b15bcad-aff1-4250-a5be-5d1b7eb56d07": {
     "rule_name": "Yum Package Manager Plugin File Creation",
-    "sha256": "b6b6b3ca5a1b00c1c9c2963e11de9416eb551dc1cae810218908a0530dee3559",
+    "sha256": "2246ca718f9e4c68f8015278f6c338d481215cf44d109266c689582b268cd4b6",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5": {
     "min_stack_version": "8.14",
@@ -682,15 +682,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Anomalous Windows Process Creation",
-        "sha256": "d0aad9677c998d37e6b01a3e4bf8956839879b80a0b4e4311197d30ab995b06c",
+        "sha256": "e58901307b82a6b703f7a5b2767769ca7cbec1c80db040954fe646835f35d714",
         "type": "machine_learning",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Anomalous Windows Process Creation",
-    "sha256": "acdcc7db7bd1b750efe71ad345cb5a5475fd227ac91ab85cc7c45383df0d9eb0",
+    "sha256": "c0f120a64ff245f24b22572875fa394dbdc77cb4f3718153eba555eb889feac8",
     "type": "machine_learning",
-    "version": 208
+    "version": 209
   },
   "0b2f3da5-b5ec-47d1-908b-6ebb74814289": {
     "min_stack_version": "8.14",
@@ -704,21 +704,21 @@
       }
     },
     "rule_name": "User account exposed to Kerberoasting",
-    "sha256": "4b5cbd7460298bb5d01a57eea52921d5400e6071d98b2cb6ec940f3fdcc3d2af",
+    "sha256": "ebe574808b30bc1075a58cef2f874bdd05f42e8a24777f0a63b52a2120faa70c",
     "type": "query",
-    "version": 213
+    "version": 214
   },
   "0b76ad27-c3f3-4769-9e7e-3237137fdf06": {
     "rule_name": "Systemd Shell Execution During Boot",
-    "sha256": "22a959fc1ae4b5c978a6bb8e8fa8d2acd527c45d6f559981da7a7b185d3ce099",
+    "sha256": "f38d9a3cb527fed3ad70ba4055716a8490606cb347a6813497bae630dd296758",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "0b79f5c0-2c31-4fea-86cd-e62644278205": {
     "rule_name": "AWS IAM CompromisedKeyQuarantine Policy Attached to User",
-    "sha256": "ba7852357719e494be81332b6d01118f5355863b002a850e69704188995ec8c6",
+    "sha256": "4a8f1df0c1c99b704e5485fd658ff9569854ebb1e729a16996a835862cfe8f24",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "0b803267-74c5-444d-ae29-32b5db2d562a": {
     "min_stack_version": "8.13",
@@ -726,15 +726,15 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Potential Shell via Wildcard Injection Detected",
-        "sha256": "9379617540e2ec131f85bb616170f340ca96c8e809e9754dfd7cba46a7f361e9",
+        "sha256": "91457268048c8d92e741bfd1d7bb5d54fe0d743c61407f7a0715f70c10dfa674",
         "type": "eql",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "Potential Shell via Wildcard Injection Detected",
-    "sha256": "81734f1eb98d81af0ca26082b03fceb94a4883a4f849ace026fd8c1adbc3bd35",
+    "sha256": "9e2c7511c3657f8026a9d0e6444662c80eb57012a8d38efa6e23d9c3814ef567",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "0b96dfd8-5b8c-4485-9a1c-69ff7839786a": {
     "min_stack_version": "8.14",
@@ -742,15 +742,15 @@
       "8.13": {
         "max_allowable_version": 101,
         "rule_name": "Attempt to Establish VScode Remote Tunnel",
-        "sha256": "d6fa3f4e6eefb62df2be718d0947e519176fb25f046497c15158ef5116ca4088",
+        "sha256": "7ffa76bdd42de95fc9de0514beb379f3022d2480038fc89512a38dc061cf24e9",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Attempt to Establish VScode Remote Tunnel",
-    "sha256": "a41786ebd2dfbb03c42ea6bf3fdc405509199a39d2c76596d2106580b4e85706",
+    "sha256": "e00123eeed5a9592b8d966a72a4ad924189880c7010e544d25d5026d9accd309",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "0c093569-dff9-42b6-87b1-0242d9f7d9b4": {
     "rule_name": "Processes with Trailing Spaces",
@@ -764,28 +764,28 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Potential Hex Payload Execution",
-        "sha256": "b50ace78d817688a156f23beb890b4697291938d084ca42129f8ecf1dcb8b0b0",
+        "sha256": "74f721a4c27361f235243b389dfdd0770212ed79d7fe1c2959e73c93b9edb754",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Potential Hex Payload Execution",
-    "sha256": "2d0fa73ed28a53fba32e51085db7721c3da52a4443b249024ba095506e2997d7",
+    "sha256": "60df1c7136646558bb4c4713cbfb9a5a4b107a9416be8a60fbf7700cbcb94ce3",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "0c41e478-5263-4c69-8f9e-7dfd2c22da64": {
     "rule_name": "Threat Intel IP Address Indicator Match",
-    "sha256": "73f1d7ac5e48ae941a948cf4fd8934aa63350e31aa9b81f06de2f8543783dd7d",
+    "sha256": "9507b5aae7440ff10ceb3f3e75dcc178e809320a084d56e616de90e14713d0d6",
     "type": "threat_match",
-    "version": 7
+    "version": 8
   },
   "0c74cd7e-ea35-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Ransomware - Detected - Elastic Defend",
-    "sha256": "d762ceed58b4360fed6a1ddbf89869a6d4548ddaaff3398092e868f20864f049",
+    "sha256": "bdb55dbd118fb03d8e90db6727cb7c17fdf199dc7aab3fad8d6a9c783bd05f4e",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4": {
     "min_stack_version": "8.14",
@@ -819,21 +819,21 @@
   "0cd2f3e6-41da-40e6-b28b-466f688f00a6": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a Session",
-    "sha256": "dbe1ee653e8649143a8b2aa6c43f5f5661b1bbccfd106614feb092ddd050d25b",
+    "sha256": "0d0084d44982bd3c5392b363044b94d1c083b4ff85c4da034a82be08872812d5",
     "type": "esql",
-    "version": 4
+    "version": 5
   },
   "0ce6487d-8069-4888-9ddd-61b52490cebc": {
     "rule_name": "O365 Exchange Suspicious Mailbox Right Delegation",
-    "sha256": "68fc02b03cbb322ff078a6a531807bf5fe21ae93726dad1ea16c11ed71d4c746",
+    "sha256": "c5b5703eecd7632b4ddb4091627b0ff3ab51fe21941d1f5b53297f00d72c4f4d",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "0d160033-fab7-4e72-85a3-3a9d80c8bff7": {
     "rule_name": "Multiple Alerts Involving a User",
-    "sha256": "43984fe31af84306a2a8266b867a70c8b185159a7419988e7211ff4a74fde252",
+    "sha256": "15e804addadde83664812796f8f9823a5c7ebff99e0beb27678162bd9c31e24b",
     "type": "threshold",
-    "version": 3
+    "version": 4
   },
   "0d69150b-96f8-467c-a86d-a67a3378ce77": {
     "min_stack_version": "8.13",
@@ -841,15 +841,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Nping Process Activity",
-        "sha256": "b3f71d6cd3a2c3a2f492e825c65e78db5b3faa4eefed530678b5c504496230ec",
+        "sha256": "b83427252d66ff411238da7c5005c49740b023436dbc3bf58ba27c1ee3922248",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Nping Process Activity",
-    "sha256": "9e6ad0d56964a23df0d9728adfe7374b9829eb6b744d07e2139d35a8836e8ff3",
+    "sha256": "9e4865a109815afb06442ed8b43a911844889487f3b85f1621ef70b5400b71c7",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5": {
     "rule_name": "Execution of File Written or Modified by Microsoft Office",
@@ -860,9 +860,9 @@
   "0e1af929-42ed-4262-a846-55a7c54e7c84": {
     "min_stack_version": "8.13",
     "rule_name": "Unusual High Denied Sensitive Information Policy Blocks Detected",
-    "sha256": "b33e65a3ee076e720b9bdf2aa373dea700cfccd237404dd9f93cc4807700b15e",
+    "sha256": "06cd8ab4b8922f24d2b6151406f8680b95c67b7d415ccdab4ef61cfc5c80fda7",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "0e4367a0-a483-439d-ad2e-d90500b925fd": {
     "min_stack_version": "8.13",
@@ -882,15 +882,15 @@
   },
   "0e52157a-8e96-4a95-a6e3-5faae5081a74": {
     "rule_name": "SharePoint Malware File Upload",
-    "sha256": "815889da8ead699edd9b19124c697cd9038a641d065cf2dbfef062e81dfb5393",
+    "sha256": "74965d932cbd9a720a97b2ceab342bba465997b95f0c655b95003fbbe6387365",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "0e5acaae-6a64-4bbc-adb8-27649c03f7e1": {
     "rule_name": "GCP Service Account Key Creation",
-    "sha256": "ffe1bc8de6ff95c0fd9bb67fb93eace9b0ba96055cbf863fe0286dd7b033061b",
+    "sha256": "59e29ccc3ac8165891a2e84b728fb276eaf024e4adc86f129eed888139ef37bc",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "0e79980b-4250-4a50-a509-69294c14e84b": {
     "min_stack_version": "8.14",
@@ -898,34 +898,44 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "MsBuild Making Network Connections",
-        "sha256": "dde434b8d763db265a284e83d3a6b88cf8b88da05acec8a4ef9f325b9c2ec960",
+        "sha256": "7c639b668c0b9207254749cb4e45c08ed861a61d1b5e8b27147b3b664d0ae255",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "MsBuild Making Network Connections",
-    "sha256": "bf7179d1b47194100baad37ed0a523ce816c9844de775a252e0c6a98cd5d3ebf",
+    "sha256": "dcb595ba973117d787c324d67e3c1089fbb00fd94c18e02e68348da2cbca9297",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "0ef5d3eb-67ef-43ab-93b7-305cfa5a21f6": {
     "min_stack_version": "8.14",
     "rule_name": "Sensitive Audit Policy Sub-Category Disabled",
-    "sha256": "1bf144627669639eeaddc1fd3dacb1721c5a22b5bbd5c657d21a9ea80a9e7a98",
+    "sha256": "2ccd6e44765c01f2922e5dbfec21d3112b12ea481499e274cc65faed4937a76a",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "0f4d35e4-925e-4959-ab24-911be207ee6f": {
     "rule_name": "rc.local/rc.common File Creation",
-    "sha256": "28070d788626c94266ca156adfce5e6d58d48df08e6103e0cfc4c1b1e7bb8ab5",
+    "sha256": "a58f936fd70ead1323075c2db07bdc08ae6fcf158dc76d3e3f8ee000206c8907",
     "type": "eql",
-    "version": 114
+    "version": 115
   },
   "0f54e947-9ab3-4dff-9e8d-fb42493eaa2f": {
+    "min_stack_version": "8.13",
+    "previous": {
+      "8.12": {
+        "max_allowable_version": 102,
+        "rule_name": "Polkit Policy Creation",
+        "sha256": "44b43d02b93465a284ad02a34ec8aac120647331d3e94740777d0814d5113600",
+        "type": "eql",
+        "version": 3
+      }
+    },
     "rule_name": "Polkit Policy Creation",
-    "sha256": "c5b96e974b3fcfcec0a0363729ff3eaaa75d3eef6433dcfa417afba10d813e2a",
+    "sha256": "0afcc930436684dfdd61e2ef01cbc1adfa72ab7f84b9fd58280c94953ffdaae0",
     "type": "eql",
-    "version": 2
+    "version": 103
   },
   "0f56369f-eb3d-459c-a00b-87c2bf7bdfc5": {
     "min_stack_version": "8.13",
@@ -933,22 +943,22 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Netcat Listener Established via rlwrap",
-        "sha256": "1f0f4f689d14c5e8a3b4843b2eeaad564fbc252458ad52473fa7fdcee3d19147",
+        "sha256": "79a36ec04c23d206b4a169e76b5d28d8f804a425556086fca9789d4fc8b188da",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Netcat Listener Established via rlwrap",
-    "sha256": "0925718d6acd18e0a768b91cd047c58843ab49c9db753e14eabcec5fed876a96",
+    "sha256": "43a81f7c9afb83eccece14a9be3e1ea2f6a731c8417ac2503e6ccae6a6db44af",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "0f615fe4-eaa2-11ee-ae33-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Behavior - Detected - Elastic Defend",
-    "sha256": "744407645eb6ef1ce3977b8496e04d8f01d92fb09e755c6b86c46789bcc96172",
+    "sha256": "1b61e930271caf4b24683fcdcd5d779d2a0f082e6b215464af1895be281398c9",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "0f616aee-8161-4120-857e-742366f5eeb3": {
     "rule_name": "PowerShell spawning Cmd",
@@ -962,21 +972,21 @@
       "8.12": {
         "max_allowable_version": 309,
         "rule_name": "Potential LSASS Memory Dump via PssCaptureSnapShot",
-        "sha256": "47d7607c096aab4bd73fbeb257e8746ed0ebb08d3f0e1cf65c62bc978d545735",
+        "sha256": "47eb039775808da28b11790e0cc065e4a50d78e27c509b0d3658b680d0e8afa5",
         "type": "threshold",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Potential LSASS Memory Dump via PssCaptureSnapShot",
-    "sha256": "b6fe17ae61cabf399f3502a59bd831e6a43b9d29f19787c3623981dc44eec698",
+    "sha256": "bbaf49b522cd5d40af2d47cba7e4b4171ca4727ca8719122a6cdbee63432dc73",
     "type": "threshold",
-    "version": 310
+    "version": 311
   },
   "0ff84c42-873d-41a2-a4ed-08d74d352d01": {
     "rule_name": "Privilege Escalation via Root Crontab File Modification",
-    "sha256": "77aa00047d7d61f2d5e30b916036032f69c56b68731a43c72c0c8f18adf55895",
+    "sha256": "76940df70c1484a0067d03c9147c59cb9cb88ff381bc232e981395b072fbcad0",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "10445cf0-0748-11ef-ba75-f661ea17fbcc": {
     "rule_name": "AWS IAM Login Profile Added to User",
@@ -992,16 +1002,16 @@
   },
   "10a500bb-a28f-418e-ba29-ca4c8d1a9f2f": {
     "rule_name": "WebProxy Settings Modification",
-    "sha256": "aea77c71f5a15f5ba810f2f316aef50e4fa6948ad6b4e6b1c77449fd584157af",
+    "sha256": "43d8180f7e5ee5ede17e49e4b51dde1ec237e4fd3684df5ed85afbbde690f390",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "10f3d520-ea35-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Ransomware - Prevented - Elastic Defend",
-    "sha256": "66448c143965f6318351f4adfaf855518fd60f58e0fceab482a7e31720a276b9",
+    "sha256": "f5b721e962c74dd5fefb7ed7ed924c02a88684947c35f6d8dc29286c755143f9",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "11013227-0301-4a8c-b150-4db924484475": {
     "rule_name": "Abnormally Large DNS Response",
@@ -1015,15 +1025,15 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Potential DLL Side-Loading via Trusted Microsoft Programs",
-        "sha256": "d2e9275f49d79f985078f90b204c71c5cc8da39f4545ee151878e99517456602",
+        "sha256": "46d8b330ba652e23adf896e687f3e5366a624a5331876fc279966cc8b152cf65",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Potential DLL Side-Loading via Trusted Microsoft Programs",
-    "sha256": "e8f11b08f41d0af660c26c82752b4d5344f91cdc0fc98514b43577e6477977d6",
+    "sha256": "a2bdb54600ed5810827ddcde587fdd19f4abe4ac4f268242ea2b360c433b20ae",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "1178ae09-5aff-460a-9f2f-455cd0ac4d8e": {
     "min_stack_version": "8.14",
@@ -1031,28 +1041,28 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "UAC Bypass via Windows Firewall Snap-In Hijack",
-        "sha256": "a2621f0e17b9625bfe787a3805bcca24cff11520ce44286c5c5c49488561f7fd",
+        "sha256": "a994d1f91f21add41bfa56ede5881e607b7400b4d3892076489853ee155f7fce",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "UAC Bypass via Windows Firewall Snap-In Hijack",
-        "sha256": "aa018af3ba1144c484d88c95f262455130c03245c19a0d48b1f9e314be08333b",
+        "sha256": "153cade6c2583d73aadcdb8e1f138fd04f15225a1d087281dfb8e0a38a94a08d",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "UAC Bypass via Windows Firewall Snap-In Hijack",
-    "sha256": "cd4ff3a06fa4ded3c35daf6785753a17cb5582a6ae1ad4a06a341c03c74b12a5",
+    "sha256": "89ff75015ccc7505d10b8e1dd68a6e00bc013390bb1d3c3261ebea0dee5a9cd8",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "119c8877-8613-416d-a98a-96b6664ee73a": {
     "rule_name": "AWS RDS Snapshot Export",
-    "sha256": "a00e77547551b6a8212c1d2b2c97be59f34bacf51a65366e59724bb0f5d3060c",
+    "sha256": "22b038a9d7ed9ae2bb66b4cb46bcfc5b0b5fd00d0c6512a3aa092001b5c12e80",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "119c8877-8613-416d-a98a-96b6664ee73a5": {
     "rule_name": "AWS RDS Snapshot Export",
@@ -1066,15 +1076,15 @@
       "8.12": {
         "max_allowable_version": 113,
         "rule_name": "PowerShell Script with Token Impersonation Capabilities",
-        "sha256": "6df7d5c060e8d61e90cfec0609cf1ff20b5d00a9a9710cad398debcbd37532d2",
+        "sha256": "a7ec142dcda7675c77e9b876a21fdbc81216e3a996b187d8b9ce5fb6ee881abc",
         "type": "query",
-        "version": 14
+        "version": 15
       }
     },
     "rule_name": "PowerShell Script with Token Impersonation Capabilities",
-    "sha256": "5da4a9373dd0e7d3e939dc5815ae14c28a0fedadefabad3b85e2e059b5cc1a24",
+    "sha256": "6b484742b765e528a93679109d41f88dab5fc43c020fe7354c920f488c850661",
     "type": "query",
-    "version": 114
+    "version": 115
   },
   "11ea6bec-ebde-4d71-a8e9-784948f8e3e9": {
     "min_stack_version": "8.13",
@@ -1094,9 +1104,9 @@
   },
   "12051077-0124-4394-9522-8f4f4db1d674": {
     "rule_name": "AWS Route 53 Domain Transfer Lock Disabled",
-    "sha256": "15feead7d77394bd6bf71dd30d81329b1fbca72fbffc872a6f07f0b3a696b0d7",
+    "sha256": "2e9c3df902a7e2af50b5f91cbc53f971eaac2d7c296180dc7140aa88c286406a",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "120559c6-5e24-49f4-9e30-8ffe697df6b9": {
     "rule_name": "User Discovery via Whoami",
@@ -1110,15 +1120,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Suspicious Windows Process Cluster Spawned by a User",
-        "sha256": "cb2a69fa201dd3ff5dce343a170be369ad36f706783f357da48c68a5642d8c0b",
+        "sha256": "36f3d53e0e615d93af889f1a29da008db557f004f34ab0b3a14b5210f0aeee2f",
         "type": "machine_learning",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Suspicious Windows Process Cluster Spawned by a User",
-    "sha256": "a979104cf9cc45e2deefe33c7763b2f7452f1cce582e84c1036d8659251e76e9",
+    "sha256": "5e43858136609068909a67bd2ffd833f974eeee7ae19cdb80a02ae08ad096d70",
     "type": "machine_learning",
-    "version": 107
+    "version": 108
   },
   "1251b98a-ff45-11ee-89a1-f661ea17fbce": {
     "rule_name": "AWS Lambda Function Created or Updated",
@@ -1138,27 +1148,27 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Suspicious Lsass Process Access",
-        "sha256": "5c2585fe5a2a7819a271da84ecd01be9aae6dd102b4b648aba3170d710547554",
+        "sha256": "b5585ef93c094d17af2ec93e821abae35166aff50db392c679bdfd4ad289691e",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Suspicious Lsass Process Access",
-    "sha256": "c7b2febcd7a93457f53f7d4c52aad131a4116e9f93d76437d261111f09423eca",
+    "sha256": "19af37acbf8a0f9774fb22c8fe43855471d07d04d9aa68dfaf95e90219bd65a0",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "12a2f15d-597e-4334-88ff-38a02cb1330b": {
     "rule_name": "Kubernetes Suspicious Self-Subject Review",
-    "sha256": "88110d27337692c0a9c75ea40f6f8f7a3d14cb6e22a5864992d0ca94879b45ec",
+    "sha256": "75734b3460dff650d8fb6adbbe456341d03756acefec419bdbe2f8dbb064b12b",
     "type": "query",
-    "version": 203
+    "version": 204
   },
   "12cbf709-69e8-4055-94f9-24314385c27e": {
     "rule_name": "Kubernetes Pod Created With HostNetwork",
-    "sha256": "6f467e2189a55fb44966834223c32fb6509c57dd21bcdff69b4f6e2ec920aeff",
+    "sha256": "7c44812095bd92d02344d24e68f59d1becb7a2912cb9f782309717e196302e80",
     "type": "query",
-    "version": 204
+    "version": 205
   },
   "12de29d4-bbb0-4eef-b687-857e8a163870": {
     "min_stack_version": "8.14",
@@ -1166,22 +1176,22 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential Exploitation of an Unquoted Service Path Vulnerability",
-        "sha256": "cfc3f15827b9bb563753aa681d0ca6558f43be24b76a68468ff0df98e1f80d7a",
+        "sha256": "272a96e698a6afe16c3181d064b9c894e77f51b3eaf866209b5dce7565d67d30",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Potential Exploitation of an Unquoted Service Path Vulnerability",
-        "sha256": "4bbc3bd2b9452e05e7e5829db2c77881e9bd34accc89ae0ee089e96ed991a0d0",
+        "sha256": "dee24546d469b37c7b76c8f8f173a6c83c366cb49c0b9576f370a0bd5511952c",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Potential Exploitation of an Unquoted Service Path Vulnerability",
-    "sha256": "20059209c3052442c7ed5c5a377f07f5900366dd533db5b237c40a4f03968c49",
+    "sha256": "1a23f04cf58db376fd7b4ec19d06758a03d9ff61f0e7e73111cd6bdebc85966f",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "12f07955-1674-44f7-86b5-c35da0a6f41a": {
     "min_stack_version": "8.14",
@@ -1189,22 +1199,22 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Suspicious Cmd Execution via WMI",
-        "sha256": "9615cede41c17c4dfa309ed0a2cede4a5fa23734c8f00ec7f88b4bafd96f0177",
+        "sha256": "98f99aa122e1e624b3e09c6ba6ef60f17fad0fb85c2a0312908fa83888d30adf",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Suspicious Cmd Execution via WMI",
-        "sha256": "fe4ba438fce303e2daf224812c4bd214f595f651161a5e587cc2d2e50dda76ee",
+        "sha256": "655e84527e938f302b438d0661911d1fc0c26eb040707b8dadc870b71b09621e",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Suspicious Cmd Execution via WMI",
-    "sha256": "2948ee0b531e8ccedd058b6ffb287bbd8285049d41818d9af4a814c1705e8765",
+    "sha256": "e64945c3198ab598f7b7fbb252d2af8e1130443ca01fb4b04ab121f6bdea367e",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "1327384f-00f3-44d5-9a8c-2373ba071e92": {
     "min_stack_version": "8.14",
@@ -1212,22 +1222,22 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Persistence via Scheduled Job Creation",
-        "sha256": "f4ae219c917a8d1a55097816b0472399ed12b807ff8accd18fe53a7b1cccfb29",
+        "sha256": "17d08d5a22a343108d957c179ce6094d0257d0d8b2579a4951119dda819508f6",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 410,
         "rule_name": "Persistence via Scheduled Job Creation",
-        "sha256": "88943865100dbcb63138fc9fc3e1c81fcd227f586956038e529e688b71384ceb",
+        "sha256": "9e89e81b01768e4420d38600625f002d5442c3b66d427dc5892345446d213aa6",
         "type": "eql",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Persistence via Scheduled Job Creation",
-    "sha256": "9ffa543a06d0f2ad3662845e6fa645986ce32abf6fdd1a341eb3cb92a2c2e4c2",
+    "sha256": "b0ccfcb313b2d42d0235a2596412d1178773cf4161732fd7ad768553a89a446b",
     "type": "eql",
-    "version": 411
+    "version": 412
   },
   "135abb91-dcf4-48aa-b81a-5ad036b67c68": {
     "min_stack_version": "8.13",
@@ -1235,15 +1245,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Pluggable Authentication Module (PAM) Version Discovery",
-        "sha256": "b6c89e8c3a97272346f423ebb217dd3b570a754d8cf3cc976707c2b412198fdc",
+        "sha256": "7a40d647d43e173b746b298d0619a6058cb05a2eb33d6e0a4e546788fa16634a",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Pluggable Authentication Module (PAM) Version Discovery",
-    "sha256": "c0225ffbf6f1c5644805b6540d4044e24bcb9f08e6af9d221853d008f463c7e5",
+    "sha256": "bdade28ec6aad91e8926504e30173907dc1309924ed35deef6fcedb8d5fd3f91",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "138c5dd5-838b-446e-b1ac-c995c7f8108a": {
     "rule_name": "Rare User Logon",
@@ -1282,21 +1292,21 @@
   },
   "13e908b9-7bf0-4235-abc9-b5deb500d0ad": {
     "rule_name": "Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score",
-    "sha256": "6f94ca87d3b3519fd810a9fdc1a9a04afdea58ca913b4b4dc9e9be63ed77cec0",
+    "sha256": "3ec2e506931ecd0b5ba1e027207e34901c5ac024f575d19242d7a03f5ee033f6",
     "type": "eql",
-    "version": 8
+    "version": 9
   },
   "141e9b3a-ff37-4756-989d-05d7cbf35b0e": {
     "rule_name": "Azure External Guest User Invitation",
-    "sha256": "c606c9477a2fa88e6a1b70468ffa95df50528629745068026ef6c9758caadaf1",
+    "sha256": "6fbce9547774cb786e35438648ca5a236089ce43936066235b21a006520def25",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "143cb236-0956-4f42-a706-814bcaa0cf5a": {
     "rule_name": "RPC (Remote Procedure Call) from the Internet",
-    "sha256": "6f7487c7e356c40aec2caceb15dce0977070fac0869a8f73757b0d4986b15113",
+    "sha256": "05723d7fde940cd2cc2663a56ee79b455405ca9d1e1270db75b986c5ef72717c",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "14dab405-5dd9-450c-8106-72951af2391f": {
     "min_stack_version": "8.13",
@@ -1304,21 +1314,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Office Test Registry Persistence",
-        "sha256": "b2c192b0f4c41a2de5c1f96b495002c57338a58a1e385275e8ea17208673bda2",
+        "sha256": "3e44efbf96a359a35159414069ff36e12436779f48247e1ebb07a941605b448f",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Office Test Registry Persistence",
-    "sha256": "e0673b4aff07f3de4b7256ce50a44e6147759d3281b639adae677dff72feecbc",
+    "sha256": "ef730832a93503b501376aacb96760534cb31876eed560a014670d79b2d03b74",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "14de811c-d60f-11ec-9fd7-f661ea17fbce": {
     "rule_name": "Kubernetes User Exec into Pod",
-    "sha256": "2e20c515d2b1304091833efa5d5f19b38c4f1eaa4f2a5b3cdee64f89ed7bf4a9",
+    "sha256": "fc2b301f6bbaa53417113b60b7a3c366d6f6c509954e72e27e9386b8b8585c28",
     "type": "query",
-    "version": 203
+    "version": 204
   },
   "14ed1aa9-ebfd-4cf9-a463-0ac59ec55204": {
     "min_stack_version": "8.14",
@@ -1326,22 +1336,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Potential Persistence via Time Provider Modification",
-        "sha256": "2536e138a13316b962ee6f5eb296c024e757f735e0e882e0c547eb4364066937",
+        "sha256": "c1c4d209cde3b94cd2f8c548ecdb34cb3fa679dd0b53e7fdede58f9d1556ead5",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Potential Persistence via Time Provider Modification",
-        "sha256": "6349c839b9198d37d576fd976eaa2f85e6034f8ba89204b451ff0d11467cde5b",
+        "sha256": "c8f114645f7f362fd704081bd1e07a79689640b1eff476ca39c731460729be8c",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Potential Persistence via Time Provider Modification",
-    "sha256": "cd5c53102463d73641cecf06ff0109725f62f522ecbaba20de251787a79cb33f",
+    "sha256": "9b84185dd52ac21aec4f2a8db1583492782012ec7a3cf59ce9987512ffb52e0f",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "1502a836-84b2-11ef-b026-f661ea17fbcc": {
     "min_stack_version": "8.15",
@@ -1349,34 +1359,34 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Successful Application SSO from Rare Unknown Client Device",
-        "sha256": "0e96c8cce04c0740655bdfdfb2ceafe48d7c5566b2841541dc102b046984bf7e",
+        "sha256": "56af4b22ba4a30c2b5b78e2dcfb7357c29381c5d442a322e59257043cb4e98b2",
         "type": "new_terms",
-        "version": 3
+        "version": 4
       },
       "8.14": {
         "max_allowable_version": 203,
         "rule_name": "Successful Application SSO from Rare Unknown Client Device",
-        "sha256": "0e96c8cce04c0740655bdfdfb2ceafe48d7c5566b2841541dc102b046984bf7e",
+        "sha256": "56af4b22ba4a30c2b5b78e2dcfb7357c29381c5d442a322e59257043cb4e98b2",
         "type": "new_terms",
-        "version": 104
+        "version": 105
       }
     },
     "rule_name": "Successful Application SSO from Rare Unknown Client Device",
-    "sha256": "799665e748ad6c9758a0a4af1965fdd3bc188747f09e28e7ec1118da317d6a2b",
+    "sha256": "b2723b3de15eaf38f608b269cd27119a720895d4cd72b126071f5f0dd90555ee",
     "type": "new_terms",
-    "version": 204
+    "version": 205
   },
   "151d8f72-0747-11ef-a0c2-f661ea17fbcc": {
     "rule_name": "AWS Lambda Function Policy Updated to Allow Public Invocation",
-    "sha256": "8f37f83d14e5f650d694453e7a219434d6fcac27bc91c9692f220f1502948740",
+    "sha256": "f1e6f5c52e4c18b16f84c216103655718a11c24159fd88c9d53d7810f03b9fca",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "1542fa53-955e-4330-8e4d-b2d812adeb5f": {
     "rule_name": "Execution from a Removable Media with Network Connection",
-    "sha256": "08e49b310aebe20ea4da9f40fb9ce90e74aecdd6f957b972419ec258f95a26b4",
+    "sha256": "c942ba35d01b9cb9eebfce159f6c2ef894b5f93d7501c1f04fbfe4f029914e25",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "15a8ba77-1c13-4274-88fe-6bd14133861e": {
     "min_stack_version": "8.14",
@@ -1400,40 +1410,40 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Remote File Download via Desktopimgdownldr Utility",
-        "sha256": "82b0a8a50a3ffeea555a5a4f4e12a8c825c7289a6d7e27a59e68bffc4c6d1863",
+        "sha256": "0cc6051b059f0a4c23d62a16a546d261c5bbbf67a3446bf0fb2712619334c81f",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Remote File Download via Desktopimgdownldr Utility",
-        "sha256": "afb44f5ed406ccfb9c40513c5e774867e961f22a9ac007320d0a4c1c31fb8cc0",
+        "sha256": "47c62d0707a97119096476193b3bbf9c24f7265594587011d87a5248a4d6a588",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Remote File Download via Desktopimgdownldr Utility",
-    "sha256": "43674c0e7d244957e0cecaf069f23652cb12fe5bee0b6d2dfb54c4bf6bd9160f",
+    "sha256": "affead342a3622a946986ec040beb993b0e5c27fe2442af4d4cdd70cce50f419",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "15dacaa0-5b90-466b-acab-63435a59701a": {
     "rule_name": "Virtual Private Network Connection Attempt",
-    "sha256": "52e3e7aa2ff5aaa21a773c0bc30319fdc45efdaaba99697504cbe1d2d2fd12a0",
+    "sha256": "b852f838beb12b31ac0857a95bfdd281593b4bbcb010dc1e2a32c159d2349b09",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "160896de-b66f-42cb-8fef-20f53a9006ea": {
     "rule_name": "Potential Container Escape via Modified release_agent File",
-    "sha256": "198ac6af38569c23460312f45acfeb0bb1489a5761ed5536c026e9b6f8154ac3",
+    "sha256": "6227f5574f6e391b1d85763a35113b7299b3d0a278820a3c90fe8d5758de412d",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "16280f1e-57e6-4242-aa21-bb4d16f13b2f": {
     "rule_name": "Azure Automation Runbook Created or Modified",
-    "sha256": "d63660127e37638852d3943a3f02745a9d7ecf28ffba3fd3d314558d66fa3633",
+    "sha256": "ba45931cd861307121631371d3ceada4c31f8c0df2f03e06f91fc43499cafeab",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "166727ab-6768-4e26-b80c-948b228ffc06": {
     "min_stack_version": "8.14",
@@ -1441,27 +1451,27 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "File Creation Time Changed",
-        "sha256": "97689ef71b5c442a2f7ab44c32a163607b4189beb06ee6d37b4563b34ddedd0c",
+        "sha256": "4b13b87a19503b754f0e1168a58053e72b7ab57ed3f6b4fa1e85ca983050228f",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "File Creation Time Changed",
-    "sha256": "b50d36dbfeb9c4de02bafa12ca2bfce4a438b1ba628cf3c02d4f726079e3e1b8",
+    "sha256": "a4b5224b6210e6ae22a3b2aae8187bd48cbb3c7b41926bda9a2a48c0528de974",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "16904215-2c95-4ac8-bf5c-12354e047192": {
     "rule_name": "Potential Kerberos Attack via Bifrost",
-    "sha256": "a410bedff2a62e53036e60647e7db0a18a0cc64c1bb6e0f0e225395665a9be6d",
+    "sha256": "23b10e667366dd92f41808c9b01db2f62209ebea86cc67add8a43532a3341b74",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "169f3a93-efc7-4df2-94d6-0d9438c310d1": {
     "rule_name": "AWS IAM Group Creation",
-    "sha256": "4620f71e7445e4762398530b8020b93c31a36073051ab2f0820f982f55d43df1",
+    "sha256": "ee11c9442b8e8b3ba41f33c3a39715ed346f2d770c4dc8cee36662b2214222d0",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "16a52c14-7883-47af-8745-9357803f0d4c": {
     "rule_name": "Component Object Model Hijacking",
@@ -1487,16 +1497,16 @@
   },
   "1719ee47-89b8-4407-9d55-6dff2629dd4c": {
     "rule_name": "Persistence via a Windows Installer",
-    "sha256": "20685cfaedd2fe2b3471f27dca9cdbd6794180b2a0fe8045a0e6eef35ebd9c56",
+    "sha256": "8ac49e7c12e9e26728ce584fffb95e858c0145cd1ff89099123834f39022652e",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "17261da3-a6d0-463c-aac8-ea1718afcd20": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User",
-    "sha256": "03de244ffc1915c80ee82688449c357f1f23252b911b441563cb5f95106f963e",
+    "sha256": "6862e5d1dee36ec1dcdcd165a67f6c373cd83aaa5f0db1b63ac526b78d346e02",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "1781d055-5c66-4adf-9c59-fc0fa58336a5": {
     "min_stack_version": "8.14",
@@ -1504,15 +1514,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Unusual Windows Username",
-        "sha256": "58b73b91dd06522f8cc8e453e0989fef4d37edf64196b91cdf2fea11b8dcb600",
+        "sha256": "e9ed01e74760cd8f6b5436fa2bf1017b75f7981365876ee0443e0bab995a0f27",
         "type": "machine_learning",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Unusual Windows Username",
-    "sha256": "2aa54fb200fbc2dc2a08134e4047e7d738718526afc740d255f2d4122be23a8a",
+    "sha256": "1e10d9ab500e362602268cac7c057d8f4200d268485ee4c70b1e1381d74f32a7",
     "type": "machine_learning",
-    "version": 207
+    "version": 208
   },
   "1781d055-5c66-4adf-9c71-fc0fa58338c7": {
     "min_stack_version": "8.14",
@@ -1520,15 +1530,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Unusual Windows Service",
-        "sha256": "899e5d7b4c44f03a8e5a152123795f54ba6f92214b25b05afb99357172793f55",
+        "sha256": "a1c9cbff26b71eb5194648a9907fd39e1504c7662a8f217cd2e9c099f9e24767",
         "type": "machine_learning",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Unusual Windows Service",
-    "sha256": "aeb4741bd8e4ad54e3207d4a0c8f74feb21e04a61c42cca74da415224a2af13c",
+    "sha256": "63fc4e38fc33fd24ef301efc7a52d2781085a9dd8465d14910b075c4ca6b5023",
     "type": "machine_learning",
-    "version": 206
+    "version": 207
   },
   "1781d055-5c66-4adf-9d60-fc0fa58337b6": {
     "min_stack_version": "8.14",
@@ -1536,15 +1546,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Suspicious Powershell Script",
-        "sha256": "914a41f4dc5e8da74932f4f6908d90c631ea34cd726868f28881ac211db41192",
+        "sha256": "fc63208d7b1218e72d90948342343c545aab84431421c2d3b6d81b1a925181a1",
         "type": "machine_learning",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Suspicious Powershell Script",
-    "sha256": "14d8f45b942a560b3b14732c25e7974f73d292f45a4e7918d19e53176371a601",
+    "sha256": "3bfa0053ceaa3a5923c2aeac1cbb923a448d65b83dda46cfc701cbcf37772899",
     "type": "machine_learning",
-    "version": 207
+    "version": 208
   },
   "1781d055-5c66-4adf-9d82-fc0fa58449c8": {
     "min_stack_version": "8.14",
@@ -1552,15 +1562,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Unusual Windows User Privilege Elevation Activity",
-        "sha256": "7dfa9272ac79e2ccb11e032297cffca58e295634d51a93a9eece00365696b251",
+        "sha256": "219fa2a191fb555ae903516b407568cc9bbc7be95ca6f3fb302311ce94382f0f",
         "type": "machine_learning",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Unusual Windows User Privilege Elevation Activity",
-    "sha256": "e1c5e226e528ca5b94b5043313893ac737e6f289a6c7021011cbccbac374b8a0",
+    "sha256": "b13eb00c757b1251104bf4c37b3a291ee5acc963ba34c008a8b6d8731a102b47",
     "type": "machine_learning",
-    "version": 206
+    "version": 207
   },
   "1781d055-5c66-4adf-9e93-fc0fa69550c9": {
     "min_stack_version": "8.14",
@@ -1568,28 +1578,28 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Unusual Windows Remote User",
-        "sha256": "aace3833cd0a4b65fde946008ccdda35d0cdfbd6c6febb57afc96965594545ad",
+        "sha256": "c2ce8aa3cd6b41359d2374f00b781728b1d6990960574e1d27d013e9a33cda80",
         "type": "machine_learning",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Unusual Windows Remote User",
-    "sha256": "1c6ce3b862feb23ee131c82cda24b91a71c155b8cfbc57d8deadf6782dc324eb",
+    "sha256": "6e49cc6ec8fa0f149019eeb0d99bc587779e02711c05c54762667fb21676de08",
     "type": "machine_learning",
-    "version": 206
+    "version": 207
   },
   "17b0a495-4d9f-414c-8ad0-92f018b8e001": {
     "rule_name": "Systemd Service Created",
-    "sha256": "b60b8f6f9625053ab6af246ddc30eb490e456bda7f66464b769de74b3309378a",
+    "sha256": "64deb3a7d35566d558e890c281946d23e332598949d863e7f3fbefa14896a901",
     "type": "eql",
-    "version": 15
+    "version": 16
   },
   "17b3fcd1-90fb-4f5d-858c-dc1d998fa368": {
     "min_stack_version": "8.13",
     "rule_name": "Initramfs Extraction via CPIO",
-    "sha256": "88f6c3605792e48f97143dae8fefedd34a2b14b68960474ed089ba2db106e09f",
+    "sha256": "e91def04da5452836c00e38e6652e095e4124c1820f2650c10e07cd01e3fc61b",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "17c7f6a5-5bc9-4e1f-92bf-13632d24384d": {
     "min_stack_version": "8.14",
@@ -1597,21 +1607,21 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Renamed Utility Executed with Short Program Name",
-        "sha256": "a898efb0f299871b59ba7adba9ad0da35c45be4f24097e4675a62d23663a67e7",
+        "sha256": "3b12641768e2a47b26428daf4f845ab28c7dd839b86550febd738e1e8586d6ff",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Renamed Utility Executed with Short Program Name",
-    "sha256": "ace9eeca0b1a6ebcd4b65d9e2ae4bd2f36b8947c516f5d108e7f2e714efc8ddf",
+    "sha256": "897127ce66b9d6ef35af246c068852d99e7af8df437c3e4d98baa466d779a8cf",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "17e68559-b274-4948-ad0b-f8415bb31126": {
     "rule_name": "Unusual Network Destination Domain Name",
-    "sha256": "0bcbe426712010462b5b8c7b7e268f1c7edb9b662ab4b0db3cdb41c9ded8b7fa",
+    "sha256": "f20d9f97b235081744c25d793925b812e945e1e5e01719ce39cfcc0defb5b253",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "181f6b23-3799-445e-9589-0018328a9e46": {
     "min_stack_version": "8.14",
@@ -1619,34 +1629,34 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Script Execution via Microsoft HTML Application",
-        "sha256": "8dcccb5d5071b3afa1eb7c8745394d66ab6fb8c1e33298891aea992e882930a5",
+        "sha256": "f368ae24273f75a97331eb4294db2df1c387c497dada5ace32520098feaef4f0",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Script Execution via Microsoft HTML Application",
-        "sha256": "2c618a1e42c7a15f0b94f84bedbef7c477dfa17b3cac3d42205bf6cde5202f00",
+        "sha256": "e90219da2c60953e27bc20e62830dafd75772d2db35bbd32f51b8d0a4c6dc954",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Script Execution via Microsoft HTML Application",
-    "sha256": "684159701e9e3176c8ca83b06107285ec6e1aab78f1d1794866e3aa38cfaa963",
+    "sha256": "2e6ff66e9a80e9b1753f07eb7bd19334a9803978510c2c2154280ebcb66cb4c8",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "183f3cd2-4cc6-44c0-917c-c5d29ecdcf74": {
     "rule_name": "Simple HTTP Web Server Connection",
-    "sha256": "575964f96d787c02c6888d33c9161a93837fb176e8e240198586bbbd307789db",
+    "sha256": "300e205d2f05314cabd3ea5c9dc9fdc35ce1ee5211afd8f65d74a15e3ef0d8e2",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "184dfe52-2999-42d9-b9d1-d1ca54495a61": {
     "rule_name": "GCP Logging Sink Modification",
-    "sha256": "f831f5412e30676ce24c068dcaf3521ab6be818cb202bca3625fb0f61ea6c3b2",
+    "sha256": "61f062813d6ebdebc0cc6698c7dcc7a975d9f3cacf7713f599fefb3a363a15bf",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "1859ce38-6a50-422b-a5e8-636e231ea0cd": {
     "rule_name": "Linux Restricted Shell Breakout via c89/c99 Shell evasion",
@@ -1656,39 +1666,39 @@
   },
   "185c782e-f86a-11ee-9d9f-f661ea17fbce": {
     "rule_name": "Rapid Secret Retrieval Attempts from AWS SecretsManager",
-    "sha256": "c4dbede7ecb8a7d4cb801fda64b573c95bb9410728f7c9f08aa32550ce093b7d",
+    "sha256": "1f41f4ccb333df0f6e2e8c35cf140f6c0d2a9bcd69f6bcbe995c987bbe00a668",
     "type": "threshold",
-    "version": 2
+    "version": 3
   },
   "18a5dd9a-e3fa-4996-99b1-ae533b8f27fc": {
     "rule_name": "Spike in Number of Connections Made to a Destination IP",
-    "sha256": "c06e03682393f75d7f4e7c47efac0a2a3bdc53865089656f9628b0e2129f33de",
+    "sha256": "3624c2a233bea0d357eca3960733b5cd7bc6de43ac52d3c824553397d583e773",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "192657ba-ab0e-4901-89a2-911d611eee98": {
     "rule_name": "Potential Persistence via File Modification",
-    "sha256": "f5cbfcaf9e6dd8e01c55fb2ed8afe33ef0b81e5007dc3743f0941ad9b58b7103",
+    "sha256": "3e0bbc97f6625f0f5294307064489d5cde380528cf838db84c6d84498961b0bd",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "193549e8-bb9e-466a-a7f9-7e783f5cb5a6": {
     "rule_name": "Potential Privilege Escalation via Recently Compiled Executable",
-    "sha256": "1fd050c07f8fd38281dde31dc1bba3256181b411f576fcaa07b6ff077393de1f",
+    "sha256": "50d50eff9038dd625531b68413c95b8a5ff3357a9369c17508d6769ab15e953f",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "1965eab8-d17f-4b21-8c48-ad5ff133695d": {
     "rule_name": "Kernel Object File Creation",
-    "sha256": "2eb986eae007c47e943a3657d2458133f365a7cbb5f997b2bd18de59abedf5c6",
+    "sha256": "eb75ed2a02885be89ba411760bb066cdb4f58f77f25e138ab75b9eb72226030c",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "19be0164-63d2-11ef-8e38-f661ea17fbce": {
     "rule_name": "AWS Service Quotas Multi-Region `GetServiceQuota` Requests",
-    "sha256": "80afc7e88ead296e54b8f63975fb596c9442153984a4652479ae2d868e1e14e7",
+    "sha256": "33f648f8fa253d9d09a1f3594faf4499982de1fc6d268944164a5d4b08313bbf",
     "type": "esql",
-    "version": 2
+    "version": 3
   },
   "19de8096-e2b0-4bd8-80c9-34a820813fff": {
     "rule_name": "Rare AWS Error Code",
@@ -1698,21 +1708,21 @@
   },
   "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03": {
     "rule_name": "Spike in Number of Processes in an RDP Session",
-    "sha256": "c02ce126b5e2476c4b0957b0c3ef37a9b2dba70091c0f7164a46bc10a7ebdcd4",
+    "sha256": "2a4b88bcda39f3627856cc76ad43b699768b3d1cabd2d7ed7335c991b0466857",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "1a289854-5b78-49fe-9440-8a8096b1ab50": {
     "rule_name": "Suspicious Network Tool Launched Inside A Container",
-    "sha256": "e456a59a32e02e71884dee04e925140b321a34650d49651cf7216610213066fc",
+    "sha256": "68a2c9ed8a46b384ecb2a355df2a4634cbf081463794ed6e93931901277da031",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "1a36cace-11a7-43a8-9a10-b497c5a02cd3": {
     "rule_name": "Azure Application Credential Modification",
-    "sha256": "e08f14b9002ce52664d169dc98fd7a2d3fd3dd0e24933ce44ec2f0cc93f14b7a",
+    "sha256": "f7362735f6b890396d8a39feb56c68597b92b95b75576e198efa44353fb980a4",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "1a6075b0-7479-450e-8fe7-b8b8438ac570": {
     "min_stack_version": "8.14",
@@ -1720,22 +1730,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Execution of COM object via Xwizard",
-        "sha256": "d5330b96f928f7e7a7a2cc531152af5ce8c6a2e9ed52235ce07ca406f8dda1be",
+        "sha256": "62babd726ae5a985d3dd9add1aabacf93bb5c8787ad3486f8ca9d1ae675d7ec4",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Execution of COM object via Xwizard",
-        "sha256": "378075d3770551eeae56e8ea53ab1cd46b454659bb893501cf1d289db20b6fb4",
+        "sha256": "9826caa22a613e9fdde9bae7324fb6f400cce7a89819041bbb709563fe470c21",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Execution of COM object via Xwizard",
-    "sha256": "45e3cf83135b3ec25c35cb029422968d7a5094dea02895e0490145fa04586340",
+    "sha256": "414ae5d1c777554706e77fcf698fa405ce9159905c53e47449683ff8b606b8d6",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "1aa8fa52-44a7-4dae-b058-f3333b91c8d7": {
     "rule_name": "AWS CloudTrail Log Suspended",
@@ -1768,9 +1778,9 @@
   },
   "1b0b4818-5655-409b-9c73-341cac4bb73f": {
     "rule_name": "Process Created with a Duplicated Token",
-    "sha256": "8a3f85e624e03fc489be5ae5c3c3392fc053e5e5eed530158a04ccdf5754e802",
+    "sha256": "34b078db5943919e82a752fb623100ecf49de4400eb5b5af0beb5dde7933f97f",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "1b21abcc-4d9f-4b08-a7f5-316f5f94b973": {
     "min_stack_version": "8.13",
@@ -1778,27 +1788,27 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Connection to Internal Network via Telnet",
-        "sha256": "803c07bf24bc75956c52cc55234f63d9d5a1f1212b218d05190d23eb47d81f2e",
+        "sha256": "1bc65565de45f1eff32df65b75aff663321aa0ebe9f25ab4bf86a1069147f03e",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Connection to Internal Network via Telnet",
-    "sha256": "e19d71cafe597bc4b326785b8e8e725a53ba901c3bb0333928c1cb54799beb8c",
+    "sha256": "be9f9df9dab4218b1aee0e1a6cb799712ac359f1a3282a5bed0d5872ac0928f2",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "1ba5160d-f5a2-4624-b0ff-6a1dc55d2516": {
     "rule_name": "AWS ElastiCache Security Group Modified or Deleted",
-    "sha256": "4ec77baf3f125b101b58f9cdec2c125de10cdb0a80f5c9112906dc0be6b3480d",
+    "sha256": "91601e89cb6509b662c58081c0bc8819adcf3c883bdc11c2819cd87ed1ce2996",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "1c27fa22-7727-4dd3-81c0-de6da5555feb": {
     "rule_name": "Potential Internal Linux SSH Brute Force Detected",
-    "sha256": "346faa48fc37e53ed0faaaa6a2bee5597d92a0306565cfad61329c29b22f7516",
+    "sha256": "7356e96ea1f088a2fd1b9412babba3ca73d9331aedf84b27f6fc8efe96edfc04",
     "type": "eql",
-    "version": 11
+    "version": 12
   },
   "1c5a04ae-d034-41bf-b0d8-96439b5cc774": {
     "rule_name": "Potential Process Injection from Malicious Document",
@@ -1813,16 +1823,16 @@
     "version": 213
   },
   "1c84dd64-7e6c-4bad-ac73-a5014ee37042": {
-    "rule_name": "Suspicious File Creation in /etc for Persistence",
-    "sha256": "ae500dfb91fef53e60123090127f7daaf307a63a988ad01fc07d30ed8c8fc368",
+    "rule_name": "Deprecated - Suspicious File Creation in /etc for Persistence",
+    "sha256": "9abe49370597003f6dc75e766e6b82486a26d1616b162ec5d2057028895d5ea9",
     "type": "eql",
-    "version": 116
+    "version": 117
   },
   "1c966416-60c1-436b-bfd0-e002fddbfd89": {
     "rule_name": "Azure Kubernetes Rolebindings Created",
-    "sha256": "d86625ab5e731436d6846810c232431aafe71ea4ce7684c0f5ad7b03709bb6ce",
+    "sha256": "250fb7d71a7e245ddced159b3f88b246c5ab4e89708f3130c7b27c55c998a33a",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "1ca62f14-4787-4913-b7af-df11745a49da": {
     "min_stack_version": "8.13",
@@ -1830,15 +1840,15 @@
       "8.12": {
         "max_allowable_version": 203,
         "rule_name": "New GitHub App Installed",
-        "sha256": "02e98cecd6d72a19ba1f1961d35d14774632ecb42f89c7fc7f1e162b60bc89fe",
+        "sha256": "5409f401ac786bdadc45606d8d7f4b4c537367d93cf5555278d620c26f984168",
         "type": "eql",
-        "version": 104
+        "version": 105
       }
     },
     "rule_name": "New GitHub App Installed",
-    "sha256": "897ec14e1bc894e259a83272e939ee09fe5fa4d799ddec75b08a89e185b6bcec",
+    "sha256": "e00feec6890b2361d7a10a06e2e91c713d0f28c866005e9e1f72610f0dbea4eb",
     "type": "eql",
-    "version": 204
+    "version": 205
   },
   "1cd01db9-be24-4bef-8e7c-e923f0ff78ab": {
     "min_stack_version": "8.14",
@@ -1846,15 +1856,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Incoming Execution via WinRM Remote Shell",
-        "sha256": "c2dcf9dc41b1c7835b791709f6bae17ad8765e7d39f7ab93d95f5368f5330f3a",
+        "sha256": "ce97e8b346f6e7bba7e209a95c49253e1561ae4cc80a170c9ae2e23ae6f36dbb",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Incoming Execution via WinRM Remote Shell",
-    "sha256": "413e3eff92ab72f06e4cef563d06cb6fee44cc7c59fd54e342da4d6097e914b6",
+    "sha256": "26cde5fd51100b2103cc8ebd9ffa4347f2529e861975e6d4b22770ff4e8f244a",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "1ceb05c4-7d25-11ee-9562-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -1862,22 +1872,22 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Okta Sign-In Events via Third-Party IdP",
-        "sha256": "6825b3b6f59f3739140778e442c12ae1438e63c45a99fd1d4ff94bda28de1b2e",
+        "sha256": "a6cd972bd4e61e4b5162bada4abcd0d49ddb1c1219971cdbffbb8efd8589444d",
         "type": "query",
-        "version": 5
+        "version": 6
       },
       "8.14": {
         "max_allowable_version": 205,
         "rule_name": "Okta Sign-In Events via Third-Party IdP",
-        "sha256": "6825b3b6f59f3739140778e442c12ae1438e63c45a99fd1d4ff94bda28de1b2e",
+        "sha256": "a6cd972bd4e61e4b5162bada4abcd0d49ddb1c1219971cdbffbb8efd8589444d",
         "type": "query",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Okta Sign-In Events via Third-Party IdP",
-    "sha256": "b6e0d858fa2ce9ed087727cbe4fdca6b72491a94f2b9d7d418aff036ded365e3",
+    "sha256": "7709f499f3a03dd5ce65351e23a1a9959dc5139e8f50d72015df6ce2b0a3233b",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "1d276579-3380-4095-ad38-e596a01bc64f": {
     "min_stack_version": "8.14",
@@ -1885,21 +1895,21 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Remote File Download via Script Interpreter",
-        "sha256": "3afe36281fd5b755b076bbb9801c4924e40bd5ea64954a50fc5bc408c7ddabed",
+        "sha256": "832c238b226f2b7fbbc201338e1d0dfe12a9a7ebf4a6263a1f038ab6019e0e6f",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Remote File Download via Script Interpreter",
-    "sha256": "6f27265db635c4e5a27af29fa64198dfa96b707802e5ccc7cba6609498d3543e",
+    "sha256": "ada7bae223693811f424b80ca156f7135da309f54f39186bed4f022974dda573",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "1d4ca9c0-ff1e-11ee-91cc-f661ea17fbce": {
     "rule_name": "AWS IAM Roles Anywhere Profile Creation",
-    "sha256": "becc05324f5f605086badfd23a1e969801e19931eb7ae06312657e19eac4175d",
+    "sha256": "16b6264718403929b906f7b79bfd533c83024fbc7acec96ca185dd3cf5d3eaa3",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "1d72d014-e2ab-4707-b056-9b96abe7b511": {
     "rule_name": "External IP Lookup from Non-Browser Process",
@@ -1929,28 +1939,28 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "UAC Bypass via DiskCleanup Scheduled Task Hijack",
-        "sha256": "7dd8220ed8a7e8190861088dcf735ec663fdc118c9226fe5a0cbd711ba56e81f",
+        "sha256": "94f7d66b79180d0ba45c617e24e4cb3a00c1489fb51b504d7aeffe8001d10959",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "UAC Bypass via DiskCleanup Scheduled Task Hijack",
-        "sha256": "ab6031b77ee7e33386e09b6709ad7d1ab82280dbfda90557b8d4b617f07ee4a2",
+        "sha256": "c994e0389ac555c93a42a57df8ea2b97d510399c33eb3f11de809c2018c44686",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "UAC Bypass via DiskCleanup Scheduled Task Hijack",
-    "sha256": "efc56fdcfe6bda16119359923755ab32f6703b8de3c44f536d1335dabbd59c93",
+    "sha256": "675020877e0f237ac091e0142a7db019267d1f73af9366cc520a9f7d27bac85e",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1": {
     "rule_name": "Suspicious Inter-Process Communication via Outlook",
-    "sha256": "181668624cb2b4bcc36606deec8dd31b109407ea7b1591438578d01cdce15dce",
+    "sha256": "c0dac1892d3e83d5514d879ef3a350f6156b44bf4e67c8e1055de7ef2c6d1a8b",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "1defdd62-cd8d-426e-a246-81a37751bb2b": {
     "min_stack_version": "8.14",
@@ -1974,15 +1984,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential Linux Hack Tool Launched",
-        "sha256": "c45877265f7039d3e1d666f7844b61798b2b176867b0b221c503ffb8e52ce0ae",
+        "sha256": "aa02b181f4f9a4df3460586733ba1ae7481ed321e4ef4e2ed3b418030ef65bc9",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential Linux Hack Tool Launched",
-    "sha256": "49f49d62f770f10f10fdae98e3f6c03211715e12f5a072a26c1d0b22d1c275cc",
+    "sha256": "9fb2dbcc6cef8cc07dbeebd0d80481cd0482fb7b26c7ea593610b44081afb982",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be": {
     "min_stack_version": "8.14",
@@ -2002,9 +2012,9 @@
   },
   "1e0b832e-957e-43ae-b319-db82d228c908": {
     "rule_name": "Azure Storage Account Key Regenerated",
-    "sha256": "49bb6b71d6e597de0157a424d93fdb4690ae7ad2586b8d725a627878c02edc1e",
+    "sha256": "cacd567d5376f99af90e85da629e9cff9118851b3e35ce7448c89ba66e5c1407",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "1e1b2e7e-b8f5-45e5-addc-66cc1224ffbc": {
     "min_stack_version": "8.14",
@@ -2012,15 +2022,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Creation of a DNS-Named Record",
-        "sha256": "1b392cf50fd5083faedc5e84700d71550e9da1adcd4b2de26a285e88c8bf84e3",
+        "sha256": "24a5cc160724e80ee85572da35813e258fcb55ef5b077894b4a649d8fbd6f1e9",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Creation of a DNS-Named Record",
-    "sha256": "5accab0498d68d3aea14b3f15cb0cfde813706bc712ed95d37e68281a4e3750c",
+    "sha256": "bd366149e20faa5b5e9ad60b298c1ad8f63002ee1451b7ee55e6c101547e6979",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "1e6363a6-3af5-41d4-b7ea-d475389c0ceb": {
     "min_stack_version": "8.14",
@@ -2056,9 +2066,9 @@
   },
   "1e9fc667-9ff1-4b33-9f40-fefca8537eb0": {
     "rule_name": "Unusual Sudo Activity",
-    "sha256": "1b4afd134fbb5d5c1cb57e6672f3fbcc22b63ae075701aa614af5619f80cff4e",
+    "sha256": "72276af57d19261776e819edd8d905bd7c5374108d27e9728922200bc839ea34",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "1f0a69c0-3392-4adf-b7d5-6012fd292da8": {
     "min_stack_version": "8.14",
@@ -2066,22 +2076,22 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Potential Antimalware Scan Interface Bypass via PowerShell",
-        "sha256": "dac35e0c6992ca7c37e472c37d77eaf0c2e9f17c74efd5f6531194cc4a769762",
+        "sha256": "021df20053fabc64b24430c7e4bdb3fa187c6f00b27139bffc24759c4e97b817",
         "type": "query",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Potential Antimalware Scan Interface Bypass via PowerShell",
-    "sha256": "d57fd991da3d4f7b2a68dfa3e37deec177fe3b4f4977637a564c09c68949629c",
+    "sha256": "89dad03842e0833b63ac6d38d5cf8f2712f22e296b4390309b10f471ab78fc07",
     "type": "query",
-    "version": 111
+    "version": 112
   },
   "1f45720e-5ea8-11ef-90d2-f661ea17fbce": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Signin Single Factor Console Login with Federated User",
-    "sha256": "5615d41bfc71884b3d207932c4421f434757b249aa207250e50b97b10d25315f",
+    "sha256": "67652ae55e23dcc67c6e395bd4b6354b74840c3c0ef81b0abe48e5f0fda50dc7",
     "type": "esql",
-    "version": 2
+    "version": 3
   },
   "1f460f12-a3cf-4105-9ebb-f788cc63f365": {
     "min_stack_version": "8.14",
@@ -2101,9 +2111,9 @@
   },
   "1faec04b-d902-4f89-8aff-92cd9043c16f": {
     "rule_name": "Unusual Linux User Calling the Metadata Service",
-    "sha256": "1020c70dcaf191d3b48430a916809caba50985d924ebc5a379d1de8c0dc3fca9",
+    "sha256": "7e9aeb7a0920e68d445b655d2a0b447b01aa117624ddd9e02a8ad4840701900a",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "1fe3b299-fbb5-4657-a937-1d746f2c711a": {
     "min_stack_version": "8.14",
@@ -2111,21 +2121,21 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Unusual Network Activity from a Windows System Binary",
-        "sha256": "065d31dda5018a121026016d00d6c7245d1656c3ef25f36665984764f64a2e74",
+        "sha256": "4fefe2cc790c9b5fd8afbd08cfd7bd28ee6f50dffd877ec1400d81c1659bcc36",
         "type": "eql",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Unusual Network Activity from a Windows System Binary",
-    "sha256": "edb91b7c64bd8e744fac58ccc66f711fb22f4daf41dde169c4e8be954d4d2b81",
+    "sha256": "b8941a4bd23e47360ee8b1a98140c573efad95250ad8e4ff1315da0b83ee3d8f",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "2003cdc8-8d83-4aa5-b132-1f9a8eb48514": {
     "rule_name": "Exploit - Detected - Elastic Endgame",
-    "sha256": "fc5bc7344b50468b39f14fc82c958267c265618e2278cadaecafa7a7f1dab9a2",
+    "sha256": "e43231e171e4e726c838f080bb14bcde8a580af0997b0177b568ebdfd462e290",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "201200f1-a99b-43fb-88ed-f65a45c4972c": {
     "min_stack_version": "8.14",
@@ -2133,22 +2143,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Suspicious .NET Code Compilation",
-        "sha256": "db2f8575c9e60cf49f9d13b3a8fba24af09922368ddad48fe7a80d1dda9519f0",
+        "sha256": "6f9e237253c1d533e1dceaf4f673182fa86dcb4f04539ecb15a9f0dadb01047a",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Suspicious .NET Code Compilation",
-        "sha256": "c69929f38a28448280307676118534bb0928728d16c0269577d27e957d21011e",
+        "sha256": "87f7a5cdc22d29da0c8cd7bc438e5e735e064c81584577cd34b46d510dccbe08",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Suspicious .NET Code Compilation",
-    "sha256": "1a866e733aa7ce66be8425aa24bf02efd91c98b7dce86a22fab32584ef096ac1",
+    "sha256": "b697c5f18da0dedf8adabf369e59016a5fd9e362cb43d0434c14e7f8b63d93b8",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "202829f6-0271-4e88-b882-11a655c590d4": {
     "min_stack_version": "8.13",
@@ -2156,15 +2166,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Executable Masquerading as Kernel Process",
-        "sha256": "6ad1b642bad962d9940a85ca08a1032187176ae60ef68d10052b7a025ecdea46",
+        "sha256": "c647d352170795fda0533a278e5c93824030a0e2391afb7d858ddf8fcef50ea3",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Executable Masquerading as Kernel Process",
-    "sha256": "dcccdcb3bc1e5b240f35cb216dd6c016c822cf4c7adb33f410aeb8a5f7c01f78",
+    "sha256": "e6a93a82d6ff821825f36acf2e6b37d99c68712acf3ab5f2a522d288de604dc7",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "203ab79b-239b-4aa5-8e54-fc50623ee8e4": {
     "min_stack_version": "8.14",
@@ -2191,15 +2201,15 @@
   },
   "2045567e-b0af-444a-8c0b-0b6e2dae9e13": {
     "rule_name": "AWS Route 53 Domain Transferred to Another Account",
-    "sha256": "140169be7f1e330d6e6068d329d4de47c02db8df773930e4ae57f7e5f36c9297",
+    "sha256": "25cdfe21fb209fb7941dd020fbcfbadef29f04aadf5eb0e226efda9c35351231",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "20457e4f-d1de-4b92-ae69-142e27a4342a": {
     "rule_name": "Suspicious Web Browser Sensitive File Access",
-    "sha256": "f285de9c9bf8851c505323409cd2daf9c3f4f430c5bae5b68541220f7acf0fbd",
+    "sha256": "f2563e3a26b24e637c8ac73d1f8b2c0a4f7fde0d81cde5ee33392c65892d9ccb",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "205b52c4-9c28-4af4-8979-935f3278d61a": {
     "min_stack_version": "8.14",
@@ -2207,22 +2217,22 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Werfault ReflectDebugger Persistence",
-        "sha256": "b892d4534c1a5905601ccc529ccaedbf3f944ac4e46b8475f4ac04d2752af982",
+        "sha256": "69246453362e5ca8115d5ebc4d54e31708b17fca42e8f1c3289e2f21e27e0982",
         "type": "eql",
-        "version": 2
+        "version": 3
       },
       "8.13": {
         "max_allowable_version": 201,
         "rule_name": "Werfault ReflectDebugger Persistence",
-        "sha256": "606f8fb96e10d28c3f078e71f4be2fa3c1806eac4331c217010c3e5404457407",
+        "sha256": "b3cf96a675e8bce7a335b93a6cceb02c5a7c736ced121dac5662c305c9855738",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "Werfault ReflectDebugger Persistence",
-    "sha256": "dedd11f2f7e4c43edba25c00b1deddb8fcd93f7c17a384a0ff0e086781d74caa",
+    "sha256": "99ed70fd9f47a95ed1240f5cc52f747dee59633a0c745c4efa9ab0127865b48c",
     "type": "eql",
-    "version": 202
+    "version": 203
   },
   "208dbe77-01ed-4954-8d44-1e5751cb20de": {
     "min_stack_version": "8.14",
@@ -2230,15 +2240,15 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "LSASS Memory Dump Handle Access",
-        "sha256": "13217b6a2a8a60bd16c88f972c5a154d41523241776c401344cd37421eaf13ef",
+        "sha256": "633c67422491d16a2f3773ed98d16e1beb6d9369dcdf7edf264b8350e008ae33",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "LSASS Memory Dump Handle Access",
-    "sha256": "8f0e6c0741fc802300e26ea71da63f8ece28e9b054d35e452de4e7d78bc634a5",
+    "sha256": "12383abd03ed18e19cc6e38a242cfe6ef50687fab36db30ce2d216216b538b16",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "20dc4620-3b68-4269-8124-ca5091e00ea8": {
     "rule_name": "Auditd Max Login Sessions",
@@ -2248,9 +2258,9 @@
   },
   "210d4430-b371-470e-b879-80b7182aa75e": {
     "rule_name": "Mofcomp Activity",
-    "sha256": "c154de44212ce97be6bf2064228454a7baeb68ef036313f325ecbef08dfb1184",
+    "sha256": "43f37baa64cc4804bd89840d33aefed80888653d43e7e46330bfb4849e0880e3",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "2112ecce-cd34-11ef-873f-f661ea17fbcd": {
     "rule_name": "SNS Topic Message Publish by Rare User",
@@ -2260,15 +2270,15 @@
   },
   "2138bb70-5a5e-42fd-be5e-b38edf6a6777": {
     "rule_name": "Potential Reverse Shell via Child",
-    "sha256": "52be9ea43b199f813b9c25ab2637afd7569a16c06703b7dc7f5151925b0b2853",
+    "sha256": "60b1fc8e258630c37d46106e04ddc92ee630843e73a695ff7697480d76438d79",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "21bafdf0-cf17-11ed-bd57-f661ea17fbcc": {
     "rule_name": "First Time Seen Google Workspace OAuth Login from Third-Party Application",
-    "sha256": "5123093932b6f544cf28a9f7f30a22658848fa12289e7f1c21584d21a79e2354",
+    "sha256": "ae4d37f61191761fb59911def2d9d39ebedf6f1dd02bd3d22bca816328750af3",
     "type": "new_terms",
-    "version": 5
+    "version": 6
   },
   "220be143-5c67-4fdb-b6ce-dd6826d024fd": {
     "min_stack_version": "8.14",
@@ -2276,33 +2286,33 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Full User-Mode Dumps Enabled System-Wide",
-        "sha256": "1cc91703e211a89bc8b1f0519649e4e3958193ad7f77cdd75d2aed5b9c6e1a1b",
+        "sha256": "39e75f704730200ba6057b7687a63159e2080003d55f8b8e6217740e487ab59e",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "Full User-Mode Dumps Enabled System-Wide",
-    "sha256": "30c368664c1bd007c6f25e8f4815c47ba84d8626a03680a17f4d9e672cd6b61d",
+    "sha256": "7d93d723489d1f6a59e139b58489ea66daaaa5a601a1f03527f4e18f249bd3ac",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f": {
     "rule_name": "SSH Authorized Keys File Modification",
-    "sha256": "5950490a263aef327d0d6b9b4f9c83dd9eeb655207043afab349082a0d04e0e9",
+    "sha256": "3305c5a0f15096a7bb8b0818b40de617448029c1e701c89f35a611f31ddd9f0d",
     "type": "new_terms",
-    "version": 206
+    "version": 207
   },
   "22599847-5d13-48cb-8872-5796fee8692b": {
     "rule_name": "SUNBURST Command and Control Activity",
-    "sha256": "28c3a8e43a93472d905579b46b496842487fb7c462bf01bdbde7cdc16361b2e7",
+    "sha256": "8f0663314dfece6334c90619e9b9e2f5cee01e01b4768df72c1577b166910b24",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "227dc608-e558-43d9-b521-150772250bae": {
     "rule_name": "AWS S3 Bucket Configuration Deletion",
-    "sha256": "c893799e9c59f2c1403b0350b301a705c63a0d1c86f201f9b1effafd647a7629",
+    "sha256": "739bcd7a637855f9186eb263bcd8107c93d83f7790c1ea4fab07b69046503e46",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "231876e7-4d1f-4d63-a47c-47dd1acdc1cb": {
     "rule_name": "Potential Shell via Web Server",
@@ -2312,9 +2322,9 @@
   },
   "2326d1b2-9acf-4dee-bd21-867ea7378b4d": {
     "rule_name": "GCP Storage Bucket Permissions Modification",
-    "sha256": "278f8d56c3932a208c4873795aa99690d1d05550d1e099c6fcdb6f6fca729604",
+    "sha256": "496ed866c8272f94c11bfa2277bde15dbfa2efe47873a8ddbcbbe832eb805693",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "2339f03c-f53f-40fa-834b-40c5983fc41f": {
     "min_stack_version": "8.13",
@@ -2322,15 +2332,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Kernel Module Load via insmod",
-        "sha256": "f93a7445bd58a5432583f328a212f267f6b995da0635115c18ac935a208acd5d",
+        "sha256": "6d909c9373be54b6dc83f2c1d0b5416582fe6dbf4206daf4e496410ac5913aec",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Kernel Module Load via insmod",
-    "sha256": "9abb3eb385fa47087a7d19e819147ba24a8b793841f61aa0b3d6901aa880f106",
+    "sha256": "34839afc89c7b63c7e306377524879c547688d939a3f78e14a6ab5cf5b7ac210",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "2377946d-0f01-4957-8812-6878985f515d": {
     "rule_name": "Deprecated - Remote File Creation on a Sensitive Directory",
@@ -2340,9 +2350,9 @@
   },
   "23bcd283-2bc0-4db2-81d4-273fc051e5c0": {
     "rule_name": "Unknown Execution of Binary with RWX Memory Region",
-    "sha256": "3f418fe503710182cb6ee9cfde5fad9281638f086f4441f882e8c13dbfdaccaa",
+    "sha256": "6206107d6e66665a64ef46d0bcd7102570f88e6977651000f2609ad3cc6e8b4d",
     "type": "new_terms",
-    "version": 3
+    "version": 4
   },
   "23f18264-2d6d-11ef-9413-f661ea17fbce": {
     "min_stack_version": "8.15",
@@ -2350,22 +2360,22 @@
       "8.13": {
         "max_allowable_version": 102,
         "rule_name": "High Number of Okta Device Token Cookies Generated for Authentication",
-        "sha256": "8d389b42a08d52081e9578cc3b0867436b3a199a86d907384f5a6bbd857965a1",
+        "sha256": "5878c82e5f3d8f2d217199e6f32a1448352e8c4ce303fe0ba02fb32c73a3df47",
         "type": "esql",
-        "version": 3
+        "version": 4
       },
       "8.14": {
         "max_allowable_version": 202,
         "rule_name": "High Number of Okta Device Token Cookies Generated for Authentication",
-        "sha256": "8d389b42a08d52081e9578cc3b0867436b3a199a86d907384f5a6bbd857965a1",
+        "sha256": "5878c82e5f3d8f2d217199e6f32a1448352e8c4ce303fe0ba02fb32c73a3df47",
         "type": "esql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "High Number of Okta Device Token Cookies Generated for Authentication",
-    "sha256": "8d389b42a08d52081e9578cc3b0867436b3a199a86d907384f5a6bbd857965a1",
+    "sha256": "5878c82e5f3d8f2d217199e6f32a1448352e8c4ce303fe0ba02fb32c73a3df47",
     "type": "esql",
-    "version": 203
+    "version": 204
   },
   "24401eca-ad0b-4ff9-9431-487a8e183af9": {
     "min_stack_version": "8.13",
@@ -2373,15 +2383,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "New GitHub Owner Added",
-        "sha256": "30fc492bcc0364696d21c281124ec1d963222a387430bd66f8db31b80df23764",
+        "sha256": "002be9292a0806831cffe8f7c1ae8704f2aba19ded7a11964225cde1c263c851",
         "type": "eql",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "New GitHub Owner Added",
-    "sha256": "115ea41b985ec203d083a037d276871783e3c8917b61ec08f272363ccfdf91d6",
+    "sha256": "a2e44a9352982f9a7fab91d7a6c0ed56fa52f09663f20c41c246407f643bb81a",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "25224a80-5a4a-4b8a-991e-6ab390465c4f": {
     "min_stack_version": "8.14",
@@ -2389,22 +2399,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Lateral Movement via Startup Folder",
-        "sha256": "b8f39d602ba7bf7b7f9c6c542137ef20c80ade3c7f0d9b301172e371a1458381",
+        "sha256": "9a03061d1c7d42331e54fa8c990602900d110a67d95d1245e44eae86e42cdc90",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Lateral Movement via Startup Folder",
-        "sha256": "2fa971d8349cceea534e945ac39e6dc74a0af458533c1ccbca9f544f5f4b2a7c",
+        "sha256": "9e4c99a01ff339552587a57d476760b6cdeec2634d2f26b6d801a2f3baeb0bd5",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Lateral Movement via Startup Folder",
-    "sha256": "274df472a867247fc2de690c81bfcb03b32b4ed67e0cc46c3a64d40fd0231c44",
+    "sha256": "77d41e72a8e9b4a7bbb7fab3c40167833d4e87d06b28d8e465774750ef5104b5",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "2553a9af-52a4-4a05-bb03-85b2a479a0a0": {
     "min_stack_version": "8.14",
@@ -2412,15 +2422,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential PowerShell HackTool Script by Author",
-        "sha256": "73577478f9ddc1f86f6e593172107b94cb54d7aa9ae3d818dd6196eaf5dd05f4",
+        "sha256": "099be59655d3f1d35382b882049816c2c0570633f5d119e1ae6285bf5d5a901c",
         "type": "query",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential PowerShell HackTool Script by Author",
-    "sha256": "01735177fce51c42923f16c612bbf247992c18fbc96e57a1b72c571807c334eb",
+    "sha256": "75e4844865ebef904a98f31b4021a2423b98a9e56a10e931089cea0ea3821cc7",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39": {
     "min_stack_version": "8.13",
@@ -2428,27 +2438,27 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential Reverse Shell via Background Process",
-        "sha256": "0ffb76c84bbd4407b32cb3cde060faa39ff1aca7f3f59d031d45d7e449cb74d5",
+        "sha256": "0fee3ba7e3d8302fa7bf7fe483672987cabfa3cd38c2e532907b1b788f7c8260",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential Reverse Shell via Background Process",
-    "sha256": "219e824eb630f41ee3e7b32a4960f77e8fbe50e1014a05e29acf3a988cf0fbc1",
+    "sha256": "6ae28a9f2bb3480636a6b4ed317a06aa8278b5aeffa859e7279b2d41a85a12af",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "25d917c4-aa3c-4111-974c-286c0312ff95": {
     "rule_name": "Network Activity Detected via Kworker",
-    "sha256": "6c823634705c69de0120c2254520b0a79b53891b3f5af608fab3f07a2f04ec3b",
+    "sha256": "74fc51f05798d86c079a4db56ebd754908e541d5391fb639a014358bf4da50f8",
     "type": "new_terms",
-    "version": 6
+    "version": 7
   },
   "25e7fee6-fc25-11ee-ba0f-f661ea17fbce": {
     "rule_name": "Insecure AWS EC2 VPC Security Group Ingress Rule Added",
-    "sha256": "e07c5774ac9be077fa7a454528f609d611bd70ce18b1d4ae04954c19fd243eec",
+    "sha256": "299b97cbda715b5eeabc7800ef5fbdd230b83acfb8b38ff4d6c1f1e231fe8185",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "260486ee-7d98-11ee-9599-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -2456,28 +2466,28 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "New Okta Authentication Behavior Detected",
-        "sha256": "7a3d426a1ac2b37234e68f5e0a483090a417880f2918593a15ecb6dd691ffc5a",
+        "sha256": "70f1f9059df5bd8fccefb340c09ead9f96478027b8a573ef31fed90b89e5e935",
         "type": "query",
-        "version": 5
+        "version": 6
       },
       "8.14": {
         "max_allowable_version": 205,
         "rule_name": "New Okta Authentication Behavior Detected",
-        "sha256": "7a3d426a1ac2b37234e68f5e0a483090a417880f2918593a15ecb6dd691ffc5a",
+        "sha256": "70f1f9059df5bd8fccefb340c09ead9f96478027b8a573ef31fed90b89e5e935",
         "type": "query",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "New Okta Authentication Behavior Detected",
-    "sha256": "33842fbf7fc226966855416ba8a5ac52112cf62c408fa0b5fa3420f4941cbb76",
+    "sha256": "3686340ff7f23094109815bb3ff499c3c9d5feb46b8ca8bf9dcc9059d295a28e",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "2605aa59-29ac-4662-afad-8d86257c7c91": {
     "rule_name": "Potential Suspicious DebugFS Root Device Access",
-    "sha256": "c48d98b19af215d3015bf2ae376ddaf8e9cf52396b7d8c7ecc202a8dd07e6ca7",
+    "sha256": "cd4778bc5d33895772be26bc4a6ecf28ef907e39c922c263758d2eed3f7c94a9",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "263481c8-1e9b-492e-912d-d1760707f810": {
     "min_stack_version": "8.14",
@@ -2485,27 +2495,27 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Potential Relay Attack against a Domain Controller",
-        "sha256": "a6d31b2e82a80eb8609b1bb25461fd5d2588fdfba77a75c4df407666b1f6dce2",
+        "sha256": "a91ee3996b61c4f76e5010d94738862b0c66cc3ab4c1ab802cc609b442a00947",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Potential Relay Attack against a Domain Controller",
-    "sha256": "42c3946d99b19b6c84dd284fe024b606c61cd8cbf26ccf17a957a92f9ac8f441",
+    "sha256": "0ed2079dc7c35c55a5dd08388ae09965a545b30ce73ae9974ab0d607832b6fac",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "2636aa6c-88b5-4337-9c31-8d0192a8ef45": {
     "rule_name": "Azure Blob Container Access Level Modification",
-    "sha256": "b8c9984ea50176ed7e98738246a92b5729623ecdef068b256bd5deae26c26534",
+    "sha256": "9c1500534b794aa60add9daf3da3805ce5f70b117a900faf565c911764fdc73d",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "264c641e-c202-11ef-993e-f661ea17fbce": {
     "rule_name": "AWS EC2 Deprecated AMI Discovery",
-    "sha256": "984211ed55f8898b7321729d0d86c68d2e9df858d8707db16a873776a96bf7f8",
+    "sha256": "8b8ce9fd3c322d65ab9459337f4a67256c7d08be0426c6825699f4fcc4ca4659",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "265db8f5-fc73-4d0d-b434-6483b56372e2": {
     "min_stack_version": "8.14",
@@ -2513,29 +2523,29 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Persistence via Update Orchestrator Service Hijack",
-        "sha256": "b97eb034c01d5415f2b4529e1b4aeacb6d1b5858e035d9f7b16071f08a107800",
+        "sha256": "4cb0180da3ef6e0e18bd152032578629a162d39c81b679998254e1e96d7a7a1e",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Persistence via Update Orchestrator Service Hijack",
-        "sha256": "535792c8a18d108f65af67d434bd5befcc35f6422b87accce90f5cf7fcda3f7e",
+        "sha256": "4daca120672fa56fe87a520d2babba093bc294cc504bef5119b188d48173faa7",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Persistence via Update Orchestrator Service Hijack",
-    "sha256": "63d4edaeb49856654125035d9376493bf4182f432dffc0f6dd69eef84bf81441",
+    "sha256": "62371061d0455aa0c946f5512e06573f49e1e88b64995595af69a37cfc14651b",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "266bbea8-fcf9-4b0e-ba7b-fc00f6b1dc73": {
     "min_stack_version": "8.13",
     "rule_name": "Unusual High Denied Topic Blocks Detected",
-    "sha256": "745f9961079e7134e24a8241e8b0dd9241739cd420c1904e1d1b3d479e86172d",
+    "sha256": "fe10ea745cf3203f237c4b8a40c63e9cb9d364c796bf52a2377425c3bd013171",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "26a726d7-126e-4267-b43d-e9a70bfdee1e": {
     "min_stack_version": "8.13",
@@ -2543,21 +2553,21 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Potential Defense Evasion via Doas",
-        "sha256": "50cf0764ce053db1d0cb8bf2401a9d3fd54a9e4169552a7f5f6f0299476c5c27",
+        "sha256": "5a94f36cb64d23ad01b8c1ffe0cbe7229007da049faf46d3b1076badcc0a3714",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Potential Defense Evasion via Doas",
-    "sha256": "1c3da01c4b351cf0ade023da9ee0f8c71f5d33cd9ec57d70d403045f8ee952eb",
+    "sha256": "aeeb4b372fbfd18ee0dfa78606413a606d6bc8e7bee480b01504cbe103fe8006",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "26b01043-4f04-4d2f-882a-5a1d2e95751b": {
     "rule_name": "Privileges Elevation via Parent Process PID Spoofing",
-    "sha256": "fe01406a8aba7ef1783b900ebd444367f6c97053baf29469fd03f5fe099c7517",
+    "sha256": "bfaf73bd5525893100c9a0593503ec5113aa3f61db2953a685aebf429b142390",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "26edba02-6979-4bce-920a-70b080a7be81": {
     "rule_name": "Azure Active Directory High Risk User Sign-in Heuristic",
@@ -2571,15 +2581,15 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempts to Brute Force a Microsoft 365 User Account",
-        "sha256": "d99f8d2a53313d1324ea4635f6235c36145f3ce8bb4f95324fa5e25e09a6d5a4",
+        "sha256": "d41060acde6ba44c9fd538c2c2169114bcdd473a35332389b5cd82e9ebef2af9",
         "type": "esql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Attempts to Brute Force a Microsoft 365 User Account",
-    "sha256": "defedded1b250e59f79608e335fc198ae97d2dcae4a0ac4386e61630388a1c70",
+    "sha256": "d25046282b20d2a93b29f3016f1dfa97b68488629031ddb7157c032045f36b59",
     "type": "esql",
-    "version": 311
+    "version": 312
   },
   "27071ea3-e806-4697-8abc-e22c92aa4293": {
     "min_stack_version": "8.14",
@@ -2603,21 +2613,21 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Attempt to Clear Kernel Ring Buffer",
-        "sha256": "25e2ab660e4188ceba62e4820957228cb86abad97ae790a7202ba5b2531e345f",
+        "sha256": "63d9ec6b0b8f754c3d04d1b8509f7978545110c21c7cd36b95629e33e8327e06",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Attempt to Clear Kernel Ring Buffer",
-    "sha256": "450d468c26a54a6c70c3b7980ebdd8b9885277c51b1b7847b6a9c6cad45d1de1",
+    "sha256": "ac8b44ec148a457414e9ec3e058a6bc9ca8419eeb1df29a3108f4470cf55f9b7",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "272a6484-2663-46db-a532-ef734bf9a796": {
     "rule_name": "Microsoft 365 Exchange Transport Rule Modification",
-    "sha256": "4901f8288ffd58d58227242aedd0caaab898038617870ffef05e9c235a9a082e",
+    "sha256": "45a1f7ed44be930e88471db5a5342a95b57a72bc185ba59c55fe89e7400fc69f",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "2772264c-6fb9-4d9d-9014-b416eed21254": {
     "min_stack_version": "8.14",
@@ -2625,27 +2635,27 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Incoming Execution via PowerShell Remoting",
-        "sha256": "115702bf56a63d8b0495b440b3bc5f48f161657df80ecb5dd778177cad8cf99b",
+        "sha256": "21c8229d021bc8b4ae787107ff45217ab56d52e249857ff17e0a4f51ef3c7f85",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Incoming Execution via PowerShell Remoting",
-    "sha256": "30c7423c5023c7e2a06f2b998a346e1a90ca192c24819613312d92d5f7e37117",
+    "sha256": "5a0f9b9a7ffefc4f2658c7b3637872e4beedb55b3e26d5cc76e3bf45f89cba0c",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "2783d84f-5091-4d7d-9319-9fceda8fa71b": {
     "rule_name": "GCP Firewall Rule Modification",
-    "sha256": "7f903b4ec5008e277d2c4f30f030c9063155c7624b7938ba5d57635458cfbbdf",
+    "sha256": "56e2aa8538cb1bfc6628887e820d427e37754644260ff65a94d8b2cd6ea08aa2",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "27f7c15a-91f8-4c3d-8b9e-1f99cc030a51": {
     "rule_name": "Microsoft 365 Teams External Access Enabled",
-    "sha256": "0cb5f4c7faf103570f876bb43508577a2927c58a22ed1b35c609f2d195630f56",
+    "sha256": "72cefcbe9406dd477e621a600dab722c48420a443a88f1fe2afb43a0cf62af8e",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "2820c9c2-bcd7-4d6e-9eba-faf3891ba450": {
     "min_stack_version": "8.14",
@@ -2653,22 +2663,22 @@
       "8.12": {
         "max_allowable_version": 215,
         "rule_name": "Account Password Reset Remotely",
-        "sha256": "dbf803fd05859ae76bda5f4e085129d4a5f840731285774dfae887a28a0e6799",
+        "sha256": "4c5bf771c55b8c874282ea178599a0885a460a0a2f93008e1ce3b37eeca9ae40",
         "type": "eql",
-        "version": 116
+        "version": 117
       }
     },
     "rule_name": "Account Password Reset Remotely",
-    "sha256": "8adb8b82a3d53207484f625914ee09d91378639f23dfaf99e0c5e4e504e7323b",
+    "sha256": "56605872558fe05e912719802d071ff5ecbb63e38f64a87c8e829ced69d9b961",
     "type": "eql",
-    "version": 216
+    "version": 217
   },
   "28371aa1-14ed-46cf-ab5b-2fc7d1942278": {
     "min_stack_version": "8.13",
     "rule_name": "Potential Widespread Malware Infection Across Multiple Hosts",
-    "sha256": "f869eb5fd1ce73193d75b85ad5bee9347325c5b60329c8274b00d1807a867977",
+    "sha256": "138552f6df8aee3e8ab2164631ef74888c7d0297c012bbd6ac9ea1c1a37ecc46",
     "type": "esql",
-    "version": 2
+    "version": 3
   },
   "2856446a-34e6-435b-9fb5-f8f040bfa7ed": {
     "min_stack_version": "8.14",
@@ -2688,9 +2698,9 @@
   },
   "2863ffeb-bf77-44dd-b7a5-93ef94b72036": {
     "rule_name": "Exploit - Prevented - Elastic Endgame",
-    "sha256": "72767580ec9592b48af7b23c8f44b94bf3c619c87d45496757413417e9238c4d",
+    "sha256": "c5975ef9ab2cb8b6055ad6bcc0d785f845ed553b7efe8c2791515b7f349e860c",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "28738f9f-7427-4d23-bc69-756708b5f624": {
     "rule_name": "Suspicious File Changes Activity Detected",
@@ -2706,15 +2716,15 @@
   },
   "288a198e-9b9b-11ef-a0a8-f661ea17fbcd": {
     "rule_name": "AWS STS Role Assumption by User",
-    "sha256": "2988f8c5e5774464830730c7672f895c27574e37db7a0dd42027d9e4617f69f4",
+    "sha256": "953a7ce35bfed2b2ce4beb94c883fdfa3e7d04f037d8ffa09fefc2a054676072",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "28bc620d-b2f7-4132-b372-f77953881d05": {
     "rule_name": "Root Network Connection via GDB CAP_SYS_PTRACE",
-    "sha256": "50b88f12b91fe3feb9118bf703666cee8eef3f3a6c36a426e7b43936ed0e50e2",
+    "sha256": "8e540cba7b904b32d6b84add9bbcc2611190e0acc86307c9b1808f95efcc53af",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "28d39238-0c01-420a-b77a-24e5a7378663": {
     "min_stack_version": "8.13",
@@ -2722,15 +2732,15 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Sudo Command Enumeration Detected",
-        "sha256": "0f36e67505607bcb3888b92df081e70b54c5e239c9e0ed3345f8f8736beed326",
+        "sha256": "60350833224cc7d578b57e68377f5c6eec36459f3b1219b27857d2dfb83c1dcb",
         "type": "eql",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "Sudo Command Enumeration Detected",
-    "sha256": "baf439993dc981bafad369990438f1d3377f8fed5bd3dc2eb66c2df021a7898e",
+    "sha256": "ca3c91b710e64c16368c525e5853a28d7c78cd266645365f5365dc149a48b72b",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "28eb3afe-131d-48b0-a8fc-9784f3d54f3c": {
     "min_stack_version": "8.16",
@@ -2738,27 +2748,27 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Privilege Escalation via SUID/SGID",
-        "sha256": "c4446351419a5cceb8e8748abd412e3ab49e52aa075b01c4df54b5a970d08403",
+        "sha256": "6ace4761c9708044d26fcf7337460b8479b0c47a4aad784406a4831f875a8ea1",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Privilege Escalation via SUID/SGID",
-    "sha256": "3ad739db58620275cb4330a3cc329918aeae3bec457d3dff8ae127ef93ac05f7",
+    "sha256": "c7cea47065a3505125b65ea6912a9eb94cc3960f40931a96702b6d941aada582",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "28f6f34b-8e16-487a-b5fd-9d22eb903db8": {
     "rule_name": "Shell Configuration Creation or Modification",
-    "sha256": "82a1df00e80a4d2e8c1cbcdef1cbc52c47bca472993056876a09f27981ed2fe6",
+    "sha256": "871b644ecad8dbcc497878dc7e8709971fb1b44536be0fa5cd97cfb75cec1082",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "29052c19-ff3e-42fd-8363-7be14d7c5469": {
     "rule_name": "AWS EC2 Security Group Configuration Change",
-    "sha256": "48882709d629f366aa2742f2930bda9d8520aa354b7a9df6ecb07e58d3ce6a95",
+    "sha256": "3094fc894dfd934d136e44472bb85b39b667d39ae1af5bbdecb0def1e9ee08b3",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "290aca65-e94d-403b-ba0f-62f320e63f51": {
     "min_stack_version": "8.14",
@@ -2766,22 +2776,22 @@
       "8.12": {
         "max_allowable_version": 213,
         "rule_name": "UAC Bypass Attempt via Windows Directory Masquerading",
-        "sha256": "5cfe971491ae9ff4d1d7dfd27691dc0cdebf5a8553599712008e0504e0d7cc4c",
+        "sha256": "8fbc91f17e1079c6d25358d51370483f648279f3ad8e892d2a679df03c969ec2",
         "type": "eql",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 313,
         "rule_name": "UAC Bypass Attempt via Windows Directory Masquerading",
-        "sha256": "d5889d6fb11d2ccc008cab9342767cacc97ce35cad65e947b0e808f8dd323e78",
+        "sha256": "d77ce672bc5fc2088fafb1b6633cb2f5955b7939b1d1302b5c2da31c8d336950",
         "type": "eql",
-        "version": 214
+        "version": 215
       }
     },
     "rule_name": "UAC Bypass Attempt via Windows Directory Masquerading",
-    "sha256": "891e2a84a8bee293f84e2d2d2fb5755a5677ceb079a6adbd7cd800fd88b6a889",
+    "sha256": "d8fad9d3a7b3d3b175b9bfac15436fde23c180087fd9a61d05bbbdd70434ef3f",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "2917d495-59bd-4250-b395-c29409b76086": {
     "min_stack_version": "8.14",
@@ -2812,15 +2822,15 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "Enumeration of Privileged Local Groups Membership",
-        "sha256": "d286b03f6c891c4896afed86b560e97a72abef0f4f7984b2038916c0f9ef4ba4",
+        "sha256": "ca1675b3254c032d02eb36a19399f23707b98c5db2ccfb585fd8047fe45e718c",
         "type": "new_terms",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Enumeration of Privileged Local Groups Membership",
-    "sha256": "6b9ddb99af8aebdf137ebdbc012a627a5c96f21ad7dfab54a26dc16d5763ed3d",
+    "sha256": "5ac18ed0a46ab76604bf76b574a4dd4d177cff97fabf4ba50cf58d2559cf6ba3",
     "type": "new_terms",
-    "version": 415
+    "version": 416
   },
   "29b53942-7cd4-11ee-b70e-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -2828,28 +2838,28 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "New Okta Identity Provider (IdP) Added by Admin",
-        "sha256": "820c807bc5e8308b926a9cc3e3b84579b2b3877122e8c4d8426431805a1a4c47",
+        "sha256": "ced824201a88878d9e9186b2e710aea0f3325e0e249c379f3b6cc276abb4e8dd",
         "type": "query",
-        "version": 4
+        "version": 5
       },
       "8.14": {
         "max_allowable_version": 204,
         "rule_name": "New Okta Identity Provider (IdP) Added by Admin",
-        "sha256": "820c807bc5e8308b926a9cc3e3b84579b2b3877122e8c4d8426431805a1a4c47",
+        "sha256": "ced824201a88878d9e9186b2e710aea0f3325e0e249c379f3b6cc276abb4e8dd",
         "type": "query",
-        "version": 105
+        "version": 106
       }
     },
     "rule_name": "New Okta Identity Provider (IdP) Added by Admin",
-    "sha256": "953c407d8ef9a6d6bfd9326baf1d26551ef58ef6df60ad6f153d5cfd92b78211",
+    "sha256": "020aa41dcdc659d6c9cf5c0619429e17fc67a4ed3a229e63c3e2aa82ca64dc59",
     "type": "query",
-    "version": 205
+    "version": 206
   },
   "29ef5686-9b93-433e-91b5-683911094698": {
     "rule_name": "Unusual Discovery Signal Alert with Unusual Process Command Line",
-    "sha256": "18bae187efca3e9942f377e9508ca6f0266f122ab379929ab8d6a0d22dc4a342",
+    "sha256": "cb837753dc5b1e38c537d26af1c4c7ce8ac7211509bf369afa0654a9045f21e4",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "29f0cf93-d17c-4b12-b4f3-a433800539fa": {
     "min_stack_version": "8.13",
@@ -2857,27 +2867,27 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Linux SSH X11 Forwarding",
-        "sha256": "2562c461d5762274c7090f399cda06176716c846f045c4ba9c5d60ad1d63df91",
+        "sha256": "607bcf6166da9a0c07fa8208a598d656e9da82b719410a4b3861431a7ad23b41",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Linux SSH X11 Forwarding",
-    "sha256": "61ef0630017ee5ecedc27ac198533afc92662fccf83af9e680976fb38d7b6245",
+    "sha256": "00e2bb957fa4242ec45b9b70e37c642d9e2a9fda94bd439e3be93f136118c283",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "2a692072-d78d-42f3-a48a-775677d79c4e": {
     "rule_name": "Potential Code Execution via Postgresql",
-    "sha256": "31193d1ef0348a443dc4c9605b4f62d6242633a24281f63b10519a48bb6178b4",
+    "sha256": "c40db65118e9a93fd6d8e9b520bbce17da234a91ebb79cd1b51352c4215c0127",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "2abda169-416b-4bb3-9a6b-f8d239fd78ba": {
     "rule_name": "Kubernetes Pod created with a Sensitive hostPath Volume",
-    "sha256": "dc8b0a2fc0d7fa52084bd9ff94ef01de5dbafce96fa29a0e89c89ef27ab8e9a7",
+    "sha256": "9ed50af9932a336e33eacff970ebcb3d99c94830b55744d32565828d68c683cc",
     "type": "query",
-    "version": 204
+    "version": 205
   },
   "2b662e21-dc6e-461e-b5cf-a6eb9b235ec4": {
     "min_stack_version": "8.13",
@@ -2885,15 +2895,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "ESXI Discovery via Grep",
-        "sha256": "93e259e4c84d6f482879c952380259c33794efa042c0d5141a382f91661b8880",
+        "sha256": "0b220ddab575a1241b10575ba0fa022641bb5dd6d7b668a24f6e4e8e7795381c",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "ESXI Discovery via Grep",
-    "sha256": "d38a739617452964c32555576678742890611cdb452ed76394bb7a4dbc5b1bc1",
+    "sha256": "17186c1c0c162dc0877b0ee69ac30a87d0a2ab108b22eaa116c9df0c9a840578",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "2bf78aa2-9c56-48de-b139-f169bf99cf86": {
     "min_stack_version": "8.14",
@@ -2901,22 +2911,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Adobe Hijack Persistence",
-        "sha256": "161e5a766f9c183fcb7844ab9c00e463c61b5038163292d851264e784b67e6fe",
+        "sha256": "c39267858935a1708b5485ab0f15d8fec3c65af74dda3eabe1a645357b6ff54c",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 413,
         "rule_name": "Adobe Hijack Persistence",
-        "sha256": "444405e37e8e57d20939866f5b78a3a70eb14ff1533a0524f612c56daa2ce62a",
+        "sha256": "5d4eda2322ee604b41b05b508100d15e3d8230cf544f5e9685b20c82c9957fc4",
         "type": "eql",
-        "version": 314
+        "version": 315
       }
     },
     "rule_name": "Adobe Hijack Persistence",
-    "sha256": "98e76c4e7dfdfd6f4b1bbc860b8d1ded5399f58cf113baa58e96cbb4c2c34f65",
+    "sha256": "e7b371bc3cb56880f4b66c8f8fe941a3dc804cf4d7a909203eb1aac36b2eb4e8",
     "type": "eql",
-    "version": 414
+    "version": 415
   },
   "2c17e5d7-08b9-43b2-b58a-0270d65ac85b": {
     "min_stack_version": "8.14",
@@ -2947,15 +2957,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Suspicious Microsoft Diagnostics Wizard Execution",
-        "sha256": "afff98a0b90a5aae640601eba5921162ce7572b6838da100bc6c1a0be27e6f22",
+        "sha256": "19459360acfaabbee9191b0bffc67924d652582ec4b24d908ab43e31ed2baf8f",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Suspicious Microsoft Diagnostics Wizard Execution",
-    "sha256": "9cb101dff02725a228ac6abd8ec38be725b6f0375a41b27f1ce6e446fa009463",
+    "sha256": "ed9cc4c9d37caa1424d72d1771b8aaa477eee67588db0cf67131757668706a64",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "2c6a6acf-0dcb-404d-89fb-6b0327294cfa": {
     "min_stack_version": "8.14",
@@ -2963,22 +2973,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Potential Foxmail Exploitation",
-        "sha256": "a4f0739152df6e638b21a5eac1cc7cf12b94d145b6cccfb04e27fdce391b2f91",
+        "sha256": "9f86eac400e2faa31c8268ac8e848b69881a1f1609f46197976260493af312d7",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Potential Foxmail Exploitation",
-        "sha256": "677b62dc3502ba3192802220e5c25de4e44c1c068cc4cbb54124820c29ce13f2",
+        "sha256": "6d21068759a60e2fe7b6b07091cfa26e48f2b6c2a2cf16239f5aff16aa3e6819",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Potential Foxmail Exploitation",
-    "sha256": "2cbfc9b78f91dc490e73a2fda8ca38737b819a786d7912db3d0dee69983a971d",
+    "sha256": "deaa9f94ff0d77ec297bbe56228d604d0ec8ff93168338d0fe56ea6586be9b37",
     "type": "eql",
-    "version": 202
+    "version": 203
   },
   "2d62889e-e758-4c5e-b57e-c735914ee32a": {
     "min_stack_version": "8.14",
@@ -2986,28 +2996,28 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Suspicious PowerShell Execution via Windows Scripts",
-        "sha256": "809e425e3a5be9a9800b6d14b48f314124436ff849b26df4baf4ff68b0da5cbf",
+        "sha256": "ca696785db9d072b73354981c190cb3612631aff9bfb21a7e71087839979c28f",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Suspicious PowerShell Execution via Windows Scripts",
-        "sha256": "a80f52e2d0f126a7c18db7078056274ede0a847de4047bf98ab6fdeb58beef17",
+        "sha256": "db70fff6a4d8ac90ee2307787ac0d09653001e7019f4ef1014397d5d28e28264",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
-    "rule_name": "Suspicious PowerShell Execution via Windows Scripts",
-    "sha256": "f343d88c98d36193572a1726eef142417d8f9af99eb57da610bd75e4c1a79d9d",
+    "rule_name": "Command and Scripting Interpreter via Windows Scripts",
+    "sha256": "0f14291a9a4bfdb07c95473002beefcd90774b98afcf9d8e07c0e2c3ce47a9b2",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "2d8043ed-5bda-4caf-801c-c1feb7410504": {
     "rule_name": "Enumeration of Kernel Modules",
-    "sha256": "e476a54ff58dbe2b9ad2df9aa0a9e110cdaa9b7f6adea0b3fa77bd0f4638913c",
+    "sha256": "52c116a646055bd0157cedd2d9977b1582266b6dd9b8f6d1911d2e72232ae161",
     "type": "new_terms",
-    "version": 210
+    "version": 211
   },
   "2dd480be-1263-4d9c-8672-172928f6789a": {
     "min_stack_version": "8.14",
@@ -3015,15 +3025,15 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "Suspicious Process Access via Direct System Call",
-        "sha256": "aaba8635a16d40c33ab3f1e45cdefdd5afa1682b6b46e0a9e59bb5714053e328",
+        "sha256": "6f9f6d3a9b1c3c10ee6f372c529e3043cf57abbe70e819991e61b39bd48cfac8",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Suspicious Process Access via Direct System Call",
-    "sha256": "ddbbefc59783e983723d68990ec3bed4228de396458b94ed38fdc10ade8d9c9d",
+    "sha256": "9f2195a1ff14af308fa971db89cf85114f85149da9fab3f43237cc3cbb0a5bd6",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "2ddc468e-b39b-4f5b-9825-f3dcb0e998ea": {
     "min_stack_version": "8.13",
@@ -3031,21 +3041,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential SSH-IT SSH Worm Downloaded",
-        "sha256": "b15d311e27e1605b59979cfacff8ed02534809f2ac3067c91d6f252b9c99532c",
+        "sha256": "fc0687aaffa30b4402ffbb232a6609e8a832a677f70d6f87d826e0967cb6ae18",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Potential SSH-IT SSH Worm Downloaded",
-    "sha256": "493174dd97f98d9dc2385620938cdd1b1fb3bac13fbaf6cefd5bba1d9d52fbba",
+    "sha256": "54a054dded59179d223df5711dfe78e54de51c2d8c7f3fd91d4eb0b7cda1aa0c",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "2de10e77-c144-4e69-afb7-344e7127abd0": {
     "rule_name": "O365 Excessive Single Sign-On Logon Errors",
-    "sha256": "a6c2623e22edf439212d0065ea3329407e43fdc9756008e2a6cc39150c927f46",
+    "sha256": "8df93c4d2e8d8e22dc9b2519c322833798fd0dd6e0179688ad46849263b97038",
     "type": "threshold",
-    "version": 207
+    "version": 208
   },
   "2de87d72-ee0c-43e2-b975-5f0b029ac600": {
     "min_stack_version": "8.14",
@@ -3053,22 +3063,29 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Wireless Credential Dumping using Netsh Command",
-        "sha256": "7e5b7e7f86dcf4fbb6d5372775029f3abd32e945f33ed157e27d84917858b727",
+        "sha256": "a1f96c64b24f9a8b3741efd7057dd191f2cfe328e4418e21fa2861f4943345b0",
         "type": "eql",
-        "version": 9
+        "version": 10
       },
       "8.13": {
         "max_allowable_version": 208,
         "rule_name": "Wireless Credential Dumping using Netsh Command",
-        "sha256": "903805e8cc42654adfa662e19eab1b40069bf11b67935e85d3d175c3a969514a",
+        "sha256": "6f66a2c4f0eb285877ec1976337925c992b5644474d9a8292c702802bd961c34",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Wireless Credential Dumping using Netsh Command",
-    "sha256": "1e0176ef079975e1f7800254fbb79354318b4765c236b9cbb67f9ade42b3fa4f",
+    "sha256": "edaa7c97d52183cb2ff7b10553ab33fbdcfc197d78bc07cda7f29633f878e4e6",
     "type": "eql",
-    "version": 210
+    "version": 211
+  },
+  "2e0051cb-51f8-492f-9d90-174e16b5e96b": {
+    "min_stack_version": "8.14",
+    "rule_name": "Potential File Transfer via Curl for Windows",
+    "sha256": "6557b61c306bf5be34401d54dd293dc893f43c1ecd05c5705ad94ca2967878ff",
+    "type": "eql",
+    "version": 1
   },
   "2e1e835d-01e5-48ca-b9fc-7a61f7f11902": {
     "min_stack_version": "8.14",
@@ -3076,15 +3093,15 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Renamed AutoIt Scripts Interpreter",
-        "sha256": "c9fca874ba0aea66a0b05cce3eff5be4bec6fd71adbcdabb89b538dfe2294d8b",
+        "sha256": "3f92ade9c8cf46297f9846194909bde8477311035bce84de538a59154fab0a08",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Renamed AutoIt Scripts Interpreter",
-    "sha256": "868e3c2f1a196ebbc4dd930f064d4c6b6e935ec882160043674baf64605134b0",
+    "sha256": "ba2643e57a281cd68d1f699d40aa824bffb36faa4b50d6ee43eafdc67fbf0942",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "2e29e96a-b67c-455a-afe4-de6183431d0d": {
     "min_stack_version": "8.14",
@@ -3124,35 +3141,35 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Okta User Sessions Started from Different Geolocations",
-        "sha256": "3beda1aaafd667d3d07527a51968311e2237f960536219febd320c0b5ea7a0cc",
+        "sha256": "154a54c158e1072b12c8c12e5c0b1a4efd33eeb055cc0a97dfbce0af0e73dc48",
         "type": "threshold",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Okta User Sessions Started from Different Geolocations",
-        "sha256": "2d8cbe2bb53447876fb8943d0ef49ddbf04681215f96661df3c86af0602ba9ac",
+        "sha256": "9d2bcc3e964c0434187bfaa20b0f3273fdedbc87d5c26e8096ceaf6770db9e66",
         "type": "esql",
-        "version": 103
+        "version": 104
       },
       "8.14": {
         "max_allowable_version": 302,
         "rule_name": "Okta User Sessions Started from Different Geolocations",
-        "sha256": "2d8cbe2bb53447876fb8943d0ef49ddbf04681215f96661df3c86af0602ba9ac",
+        "sha256": "9d2bcc3e964c0434187bfaa20b0f3273fdedbc87d5c26e8096ceaf6770db9e66",
         "type": "esql",
-        "version": 203
+        "version": 204
       }
     },
     "rule_name": "Okta User Sessions Started from Different Geolocations",
-    "sha256": "2d8cbe2bb53447876fb8943d0ef49ddbf04681215f96661df3c86af0602ba9ac",
+    "sha256": "9d2bcc3e964c0434187bfaa20b0f3273fdedbc87d5c26e8096ceaf6770db9e66",
     "type": "esql",
-    "version": 303
+    "version": 304
   },
   "2e580225-2a58-48ef-938b-572933be06fe": {
     "rule_name": "Halfbaked Command and Control Beacon",
-    "sha256": "67f17bb4543d663bbd223adf3ed78c7e8f5018d561d5600b0b835ed24d9a6174",
+    "sha256": "33aca0b923a70f6be45450125434d1f43b00df2f2b4c53db570c103caff35644",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "2edc8076-291e-41e9-81e4-e3fcbc97ae5e": {
     "min_stack_version": "8.14",
@@ -3205,27 +3222,27 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Attempt to Disable Syslog Service",
-        "sha256": "b1a7d12998e1efd7ea299012dcf84947b7b732b5d5acaf875515adc5e0289cf9",
+        "sha256": "2ef044a4379ebf8587fd12c998257f558761c47509df7f0295893dd4bb6f34f3",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Attempt to Disable Syslog Service",
-    "sha256": "22a0fbb06dfda70d1adfd4babcfef821d608b27db689d38ad0a6da435108d146",
+    "sha256": "06b9e45618193c5102c36edb26ebfcf648ece1120ef3a26f650915c43b5881b2",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "2f95540c-923e-4f57-9dae-de30169c68b9": {
     "rule_name": "Suspicious /proc/maps Discovery",
-    "sha256": "ceb64517a4f38ec0b520e88bfd10c759040ae2fc573d8712c77889e56afddd93",
+    "sha256": "5316ada4014d2c9a7930574d4566f9b686174872e4fe5ceb6aadf5aa70ea9f33",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "2fba96c0-ade5-4bce-b92f-a5df2509da3f": {
     "rule_name": "Startup Folder Persistence via Unsigned Process",
-    "sha256": "16889344ca9108bf590521debc5e7f4f79d260b86172b2f1df97f6014b9e5813",
+    "sha256": "12a39f6d9969db63436c1a00acca99e9add307c1cd5027f78b8845251fab148b",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "2ffa1f1e-b6db-47fa-994b-1512743847eb": {
     "min_stack_version": "8.14",
@@ -3251,15 +3268,15 @@
   },
   "30562697-9859-4ae0-a8c5-dab45d664170": {
     "rule_name": "GCP Firewall Rule Creation",
-    "sha256": "bb0dfe6b9f2f4b9ceed60017b384a9ec5cdb5c52df95261b4b306681aa1f7a1e",
+    "sha256": "bdc8c042341275de2dda2fbb2cfe8352f8fef57e17ade3f9a6a0f4a2f34f6f7b",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "30b5bb96-c7db-492c-80e9-1eab00db580b": {
     "rule_name": "AWS S3 Object Versioning Suspended",
-    "sha256": "16e9f3ed67d6796c3a8d6b7fae2c3432ecec1180bccc33240b81d05c0d654d22",
+    "sha256": "501b384fc62d0114e489f893db676c77a67a7de686ed549cc96d28110a216431",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "30bfddd7-2954-4c9d-bbc6-19a99ca47e23": {
     "min_stack_version": "8.13",
@@ -3267,39 +3284,39 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "ESXI Timestomping using Touch Command",
-        "sha256": "3aded99ffea86675df0ab0f003bf86c0e5a794828e77b17812a3f979d0fb70ea",
+        "sha256": "087ddf9a38cc3a95ddd050c3af74a8205dcf16b78a267a1c40ecab0206895466",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "ESXI Timestomping using Touch Command",
-    "sha256": "696509a7cdb782460d36cfa3fa0aacd0526662d34d5b8104d0a5f75c0bdaeb93",
+    "sha256": "fde62451dcbc2aa7269cb18d276d8552cd6e745cb2f47292fcf56451ef9fdfec",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "30e1e9f2-eb9c-439f-aff6-1e3068e99384": {
     "rule_name": "Network Connection via Sudo Binary",
-    "sha256": "b469b8c3a65e085d1a09370ef4bf02f1feb2e98f438d6af4c42d1495c1959385",
+    "sha256": "78f4f52284b8ea5c871846b90d949f540c2cf40216301247c3589ad6e31e8aca",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "30fbf4db-c502-4e68-a239-2e99af0f70da": {
     "rule_name": "AWS STS GetCallerIdentity API Called for the First Time",
-    "sha256": "a0060f1d4d4a006b66f4dad527c7bf963002cf71864a361f0c45f7959030f08f",
+    "sha256": "fde6148916cb146e840e4017c597cb865ed148dd9eb6ad32b27f527b18e30866",
     "type": "new_terms",
-    "version": 3
+    "version": 4
   },
   "3115bd2c-0baa-4df0-80ea-45e474b5ef93": {
     "rule_name": "Agent Spoofing - Mismatched Agent ID",
-    "sha256": "ec70ea76f2b63b214733972e4c42caadfa150fe1b0efa06b5d369bdcf5d80129",
+    "sha256": "7cec198919a09236965c3fdfd4b59f77b7f52143b5764447161b1098935d2ee3",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "31295df3-277b-4c56-a1fb-84e31b4222a9": {
     "rule_name": "Inbound Connection to an Unsecure Elasticsearch Node",
-    "sha256": "7aca9860d8b4e2d6a3c826f3c89aad15a3ccef60bdb18f3a6c0e5d9d5eb96446",
+    "sha256": "ee23f22e47ceddb6e8677a346d2b5a4af9d9f5da170c238a64f5c8851cb61903",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62": {
     "min_stack_version": "8.14",
@@ -3307,53 +3324,53 @@
       "8.12": {
         "max_allowable_version": 213,
         "rule_name": "Bypass UAC via Event Viewer",
-        "sha256": "6803ee7c44e816c648b5cb1c7638f63b9a8952d06dc27673a10931537edcc6c7",
+        "sha256": "1d5b8b66ae45d9bcba982bcee8dc4994d4cedb7541738eda36dfb8de2accfb0c",
         "type": "eql",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 313,
         "rule_name": "Bypass UAC via Event Viewer",
-        "sha256": "3a5ba368eb9c20041f39f0ccb099b88622f09abeeca8836f0978e004928922e6",
+        "sha256": "27eb461382f469f2615f24a2887acc73df8bdfbe582d3d31d321bcefcaa5d201",
         "type": "eql",
-        "version": 214
+        "version": 215
       }
     },
     "rule_name": "Bypass UAC via Event Viewer",
-    "sha256": "7636e829317fb6054a6324982a7342705e13d8712bd9297b1e16195419b0edbb",
+    "sha256": "50e3fed73bd4705f76f78df40640d810c310f3acc21468d1246f910127187f4c",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "3202e172-01b1-4738-a932-d024c514ba72": {
     "rule_name": "GCP Pub/Sub Topic Deletion",
-    "sha256": "124b074b61fa892959b957078f6b0ce22d6fc14dfa12721b099e26e56784daa0",
+    "sha256": "5f12891f87725569f26f55d846990b172e4b083945291b524995a0c2b39d1f88",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "3216949c-9300-4c53-b57a-221e364c6457": {
     "min_stack_version": "8.13",
     "rule_name": "Unusual High Word Policy Blocks Detected",
-    "sha256": "e60e73464e34fc8b533162ec135fadf0b5dcfc463f310236241febc2eb032c17",
+    "sha256": "fbc24d43876fb187d170bf7067f200bfc4a9dc9315138429cf73dd99f867b8ba",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "32300431-c2d5-432d-8ec8-0e03f9924756": {
     "rule_name": "Network Connection from Binary with RWX Memory Region",
-    "sha256": "f4f1b93a821c7d0b22e83e0cf23a1df584971e45af788834809e1d6f1c716d1e",
+    "sha256": "a75544c3aa79d018caa2133ae6cea5c8ad25a63e3287613ed0a491e21ea8db90",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "323cb487-279d-4218-bcbd-a568efe930c6": {
     "rule_name": "Azure Network Watcher Deletion",
-    "sha256": "2639a17ce5e5d5cbfafd00c48a0d20d73a8f7fd26a389a962808a2d552c1cd1a",
+    "sha256": "4361eedfbd069e79f89dc6fc2cb69959fa012d9333bb12fa3a7a48bdc1956047",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "32923416-763a-4531-bb35-f33b9232ecdb": {
     "rule_name": "RPC (Remote Procedure Call) to the Internet",
-    "sha256": "bd14c9e18b459c255249f0f5e5e5d3fb94b2c32186ea0e40eb3847cf3da62ac3",
+    "sha256": "4225710e2f58d4c9a39ab24e6e05d1553387f3bd659ccf97398b490b820df50b",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14": {
     "min_stack_version": "8.14",
@@ -3361,28 +3378,28 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Program Files Directory Masquerading",
-        "sha256": "258a6e5c72a134ab06314270a0d8709dc02f850f08ae059cb9eb2467a30befef",
+        "sha256": "17788893fc6510e7f611de6c1046d1c0a8ebb5937ac675d96d8555b98ed4b9c8",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Program Files Directory Masquerading",
-        "sha256": "b971172eccda841cf458753c2173ec71dad386098f0aecce8d402912cc50f630",
+        "sha256": "dd7609c7ed75762383c65d441706b5cec4f6760974567894ea5e4b08fb80603f",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Program Files Directory Masquerading",
-    "sha256": "7118d989ba0d5e6e0b2a80bb486a7a93738b35454c185aa6edf9e558ca1662d3",
+    "sha256": "5e2521c495505730bc747cae7beaef82e123e96c4fa6dfcc7530e8d63d3640a6",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "32d3ad0e-6add-11ef-8c7b-f661ea17fbcc": {
     "rule_name": "Microsoft 365 Portal Login from Rare Location",
-    "sha256": "3e3186fdaf81508055217cd52ac7b74d8c88bda2fca0eca7f8e1b3b573b7cd02",
+    "sha256": "c839af879a5c765f5e319641da93e5418ac234abdb825d1d9f1df9d746f9e2e2",
     "type": "new_terms",
-    "version": 2
+    "version": 3
   },
   "32f4675e-6c49-4ace-80f9-97c9259dca2e": {
     "min_stack_version": "8.14",
@@ -3413,15 +3430,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Directory Creation in /bin directory",
-        "sha256": "f412ce479acffee82949aed77160fece5ab382dbec5d754ae3c3fdf213e61712",
+        "sha256": "e2fc0d10f43934c5dfad79a4f0f2618e38c52f91e897b1fbbaeb75b7d2ae0749",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Directory Creation in /bin directory",
-    "sha256": "2c803e78bc8f8a94d576257db77fc5299f73a5e7365d61ee7d2ca6168f5f8a1e",
+    "sha256": "b5fec392950d06c2eed32e7b773c1586b1664272bd889de75bf44e04bae6395a",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "333de828-8190-4cf5-8d7c-7575846f6fe0": {
     "rule_name": "AWS IAM User Addition to Group",
@@ -3435,27 +3452,27 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "ESXI Discovery via Find",
-        "sha256": "5ffb9a4076c8b9782893429052beeb256ac381d1d57cd0267fc84f9f5df944df",
+        "sha256": "e945a579fb2d4bdd868c12f606098cd96cd82197b76142880a5deab1ab401ab5",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "ESXI Discovery via Find",
-    "sha256": "fc783c447a0efdf2dbb9749e4af9982fcfe4ca9c0a25e771675c110d1e56672b",
+    "sha256": "3ce260f07de51346b47a66b5297226e6450cd3bb3e57a902ac1a06fb9bffbae9",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "33f306e8-417c-411b-965c-c2812d6d3f4d": {
     "rule_name": "Remote File Download via PowerShell",
-    "sha256": "a468cf285aeec523223067030229793d4769bc5659502779d939657e57a77976",
+    "sha256": "2d6cac53a7d7baf61d489765382f2b2d431be53f846101569f7e49a35e59df98",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "342f834b-21a6-41bf-878c-87d116eba3ee": {
     "rule_name": "Modification of Dynamic Linker Preload Shared Object Inside A Container",
-    "sha256": "80a1285a2fc10cd2a83830beb16066febaf04201e827216516c4e4dc9b47ade6",
+    "sha256": "8c1e8fd8134b90d32749366fb7d20b184a823a0e5e341af7b44f61679905bd6b",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "345889c4-23a8-4bc0-b7ca-756bd17ce83b": {
     "min_stack_version": "8.13",
@@ -3463,33 +3480,33 @@
       "8.12": {
         "max_allowable_version": 202,
         "rule_name": "GitHub Repository Deleted",
-        "sha256": "660476227e525d314ca01414cb724faceba46253e12dc63cc24f8ed8e5014fd5",
+        "sha256": "bbc9f533b703f0f2a2aec221e6c184c662bae31b89b8e01b2a7483f00fdbb84b",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "GitHub Repository Deleted",
-    "sha256": "31dfbf633245e9bf0fa40429d05f942caf186ed52c457ed58d90fd309dba218b",
+    "sha256": "680ea8566ca2b5e114053f331458450f3a9fdbdcda67246619a56e3304d7d4bb",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "349276c0-5fcf-11ef-b1a9-f661ea17fbce": {
     "rule_name": "AWS CLI Command with Custom Endpoint URL",
-    "sha256": "cf3130f23b44875cbdc95a497a47b56ca8d3eddfd51b8275318b17028b7f5e56",
+    "sha256": "0d6e63fdb711a79ed9a8236fbfa447b8dd9cd9c750fe206e4f69d544b4cb7127",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "34fde489-94b0-4500-a76f-b8a157cf9269": {
     "rule_name": "Accepted Default Telnet Port Connection",
-    "sha256": "d4d536d179c2456b42cc7463e03bb7cc9e7f6b8fc478a861c31138ba803c957a",
+    "sha256": "a93607d49470b41ab526136a54c50d0d65923b7af46008f570ecf780090ff342",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "35330ba2-c859-4c98-8b7f-c19159ea0e58": {
     "rule_name": "Execution via Electron Child Process Node.js Module",
-    "sha256": "e62ff0708c98fc9c3f113e773084f58a137eabb8da806c25c3871f0131fd7934",
+    "sha256": "93108f6db43019bf85a026b0e1a0283d1387d43696c8cbff0338ade95de87373",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "3535c8bb-3bd5-40f4-ae32-b7cd589d5372": {
     "min_stack_version": "8.14",
@@ -3516,16 +3533,16 @@
   },
   "35a3b253-eea8-46f0-abd3-68bdd47e6e3d": {
     "rule_name": "Spike in Bytes Sent to an External Device",
-    "sha256": "7f778783d142f64fbf3be96cbd7c5059a658dce8b1986144a77ebac82f8c9a58",
+    "sha256": "b78351582a7ddf68ad29828252540753accedab11361b21c3cb3cfdcd7ea6da0",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "35ab3cfa-6c67-11ef-ab4d-f661ea17fbcc": {
     "min_stack_version": "8.13",
     "rule_name": "Azure Entra Sign-in Brute Force against Microsoft 365 Accounts",
-    "sha256": "b8a5a3e5d42986cc6784293804bea5aa15d3f3062fce2ed4740680f384718d88",
+    "sha256": "3f28423faced2b8aa0493681362683f095c9464aa5ecb67465ac44f2694aefc3",
     "type": "esql",
-    "version": 2
+    "version": 3
   },
   "35df0dd8-092d-4a83-88c1-5151a804f31b": {
     "min_stack_version": "8.14",
@@ -3533,28 +3550,28 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Unusual Parent-Child Relationship",
-        "sha256": "914d7f53a2ee88fb24cd106ea8100b9f3a6f609a3e4eab9c8ca6de797f755dd0",
+        "sha256": "fdf30a404fcf1f457a3530ba76e543daad00de78c6c30a18ca40f103beb6caf2",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Unusual Parent-Child Relationship",
-        "sha256": "ec66f5859b414a64af3fb50ecdd42328868c38c15d769091fbe8b212c4bfeb46",
+        "sha256": "19bed7ae3eefe2b9f8d9f9cbd99efbff32206937e70a162d1491cd54c108c103",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Unusual Parent-Child Relationship",
-    "sha256": "d4084427ba4202e29ea9d52ef3f7dbf75c97b4a6f1a10725f786c723d5659016",
+    "sha256": "8c2faa0a772b773b9aa59da52cd46c6984b6271a148639ba16b293ccddce14a5",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "35f86980-1fb1-4dff-b311-3be941549c8d": {
     "rule_name": "Network Traffic to Rare Destination Country",
-    "sha256": "4717b0d0eb76707afa4f290f2239c9c078684d413574d6615ec4c298bd38495c",
+    "sha256": "cb3f4e2e92eeffed4bd1250dcc2811b1e4ee69877e3d14a107578a5b0d10fe24",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "3605a013-6f0c-4f7d-88a5-326f5be262ec": {
     "rule_name": "Potential Privilege Escalation via Local Kerberos Relay over LDAP",
@@ -3564,9 +3581,9 @@
   },
   "3688577a-d196-11ec-90b0-f661ea17fbce": {
     "rule_name": "Process Started from Process ID (PID) File",
-    "sha256": "fe046a7846b79f672e4e7b8458d89a2e198eed687295bd94b48f0aa55d4e2d18",
+    "sha256": "2c9b76f51b6b60aac35cbe7fe3bc6458f23d91c76c8cab96a30d6148b94b3d74",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "36a8e048-d888-4f61-a8b9-0f9e2e40f317": {
     "min_stack_version": "8.14",
@@ -3574,28 +3591,28 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Suspicious ImagePath Service Creation",
-        "sha256": "7c1d04e302bd0cc733f293024b81bb5d74dbde9e0d8fe8b71b07db53d4157eeb",
+        "sha256": "e0de6aabadb9b3edc0355ae72df8fa446a91a842ef12b8ef6ec687e906c931f5",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Suspicious ImagePath Service Creation",
-        "sha256": "d70480df37508e5a424c838ac5ccc1002758e722ac2e3a8fdb58ba327ec88eaf",
+        "sha256": "cd1475178a3952f625d34aa54ca62f9221babf15037db6ad279da8a14ec58ff7",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Suspicious ImagePath Service Creation",
-    "sha256": "6cb28ae624dbac6a4d47e720907a77cdf089d5b190a6cc3bbbc2cc16990dd488",
+    "sha256": "3cfd44cb623fa5f87fb2bc4b70fb4825b8c30cc422f5ca4959f8affa6a59c239",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "36c48a0c-c63a-4cbc-aee1-8cac87db31a9": {
     "rule_name": "High Mean of Process Arguments in an RDP Session",
-    "sha256": "702a6f3a2433e5ad66e4dd17b555c7bc979578f8248e27744f421e12791d0780",
+    "sha256": "0375f50891da2c560d538d9af682bf73815c0e8097191a66c4b7ad3d2d9f85a0",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "3728c08d-9b70-456b-b6b8-007c7d246128": {
     "min_stack_version": "8.13",
@@ -3603,21 +3620,21 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Potential Suspicious File Edit",
-        "sha256": "bf74f549ef8c05505839770cb6d64489d48d766df1312cd3524c9d65450352dd",
+        "sha256": "85b4308a095fda0a1a41576379cf8ca6d2bcc3ddb4aaec2c851eb2c5f083e6f8",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Potential Suspicious File Edit",
-    "sha256": "e3c28261518b3d09fe11ffba93334faea5c28a139351f3b8218907e2843ba3ee",
+    "sha256": "cdff182cf2a97fd9ff3c7d14e95a5a79e3462d548eeef0db8a2367e2af77e5d3",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "378f9024-8a0c-46a5-aa08-ce147ac73a4e": {
     "rule_name": "AWS RDS Security Group Creation",
-    "sha256": "a980e64d0ef17442e319eed703e3dc756434170c637087afded818fc1942c2e0",
+    "sha256": "2d9a2d2805620d5537bdc598986669726205be63bf72fd472e586860559f3c15",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "37994bca-0611-4500-ab67-5588afe73b77": {
     "rule_name": "Azure Active Directory High Risk Sign-in",
@@ -3633,15 +3650,15 @@
   },
   "37b211e8-4e2f-440f-86d8-06cc8f158cfa": {
     "rule_name": "AWS SSM `SendCommand` Execution by Rare User",
-    "sha256": "eaca01a4eabb8830d6e1829229535613f1f61dd22c301080198653b3cbbff971",
+    "sha256": "713fd8c17945bb80c3b98f60f14f907c30c2a333641b4671b9a0c3ff0c5618f4",
     "type": "new_terms",
-    "version": 210
+    "version": 211
   },
   "37f638ea-909d-4f94-9248-edd21e4a9906": {
     "rule_name": "Finder Sync Plugin Registered and Enabled",
-    "sha256": "858e1ed186fb82e360626319ec5bcc00cd623d9b58317239f8e44049e46d4916",
+    "sha256": "5f573869ccc59acdcce25fd3eb2fc8e2c968f0706d244c11c7ca14753b018257",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "3805c3dc-f82c-4f8d-891e-63c24d3102b0": {
     "min_stack_version": "8.15",
@@ -3649,22 +3666,22 @@
       "8.12": {
         "max_allowable_version": 309,
         "rule_name": "Attempted Bypass of Okta MFA",
-        "sha256": "436f9223ccab6fbb608cefb2a5a48747ed6134e25ee80358b92152f4fb0ba1f4",
+        "sha256": "5e5251cb58730100b0cc28f80d6377c224454944d105b37cfddbc186d96993c8",
         "type": "query",
-        "version": 210
+        "version": 211
       },
       "8.14": {
         "max_allowable_version": 410,
         "rule_name": "Attempted Bypass of Okta MFA",
-        "sha256": "436f9223ccab6fbb608cefb2a5a48747ed6134e25ee80358b92152f4fb0ba1f4",
+        "sha256": "5e5251cb58730100b0cc28f80d6377c224454944d105b37cfddbc186d96993c8",
         "type": "query",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Attempted Bypass of Okta MFA",
-    "sha256": "2c41bd41d4c6255bf8ef120778c88fea260a76f8400e445def9e9ebb1b6bf146",
+    "sha256": "335b721089e14060d49efd5a24e91c1234579d86f289c8e2d55a68f139685424",
     "type": "query",
-    "version": 411
+    "version": 412
   },
   "3838e0e3-1850-4850-a411-2e8c5ba40ba8": {
     "min_stack_version": "8.14",
@@ -3672,33 +3689,33 @@
       "8.12": {
         "max_allowable_version": 214,
         "rule_name": "Network Connection via Certutil",
-        "sha256": "abedf8ad3f6cbec189082eb584ef1af665eec659cf86b4d8f4c76e7aefa8e1be",
+        "sha256": "3f6234c8ab1d36fc0aee41b20d47c226fdddafbf988fd7a990edd1967bb6c123",
         "type": "eql",
-        "version": 115
+        "version": 116
       }
     },
     "rule_name": "Network Connection via Certutil",
-    "sha256": "a46ff963d1341267dc84e8cae348751c9602db28818d086bdbc2d06646e63071",
+    "sha256": "ee7de9f4e8ab3c5761b6312c919095c5cf492a9db5a0723c83799fc34b584f5e",
     "type": "eql",
-    "version": 215
+    "version": 216
   },
   "38948d29-3d5d-42e3-8aec-be832aaaf8eb": {
     "rule_name": "Prompt for Credentials with OSASCRIPT",
-    "sha256": "4082dec3872831be075b4437114dd49a7322440fc0f7650a4de37632a9a6b063",
+    "sha256": "97d4337cd351104a3925d2dee5c322200ea4f2f58aa5b199d556deee79d05105",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "3896d4c0-6ad1-11ef-8c7b-f661ea17fbcc": {
     "rule_name": "Microsoft 365 Portal Logins from Impossible Travel Locations",
-    "sha256": "b27504fdf50603f2d3b2d98b424475dd42fa3e57f3331ab23a5b8290dde2302d",
+    "sha256": "0300fec34ca31a5cea787eaded914a17bc72892cce35401a358a0cc6aa49fb1e",
     "type": "threshold",
-    "version": 2
+    "version": 3
   },
   "38e5acdd-5f20-4d99-8fe4-f0a1a592077f": {
     "rule_name": "User Added as Owner for Azure Service Principal",
-    "sha256": "0366d38e25390f27d5a88679fdeb1186fa00482024bab6e37b84f6d6ee4bdf2f",
+    "sha256": "c794cb33079d83fd0ff1a98396f73fc84073e6498982afb0f9bc08d82db37dea",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "38f384e0-aef8-11ed-9a38-f661ea17fbcc": {
     "rule_name": "External User Added to Google Workspace Group",
@@ -3708,21 +3725,21 @@
   },
   "39144f38-5284-4f8e-a2ae-e3fd628d90b0": {
     "rule_name": "AWS EC2 Network Access Control List Creation",
-    "sha256": "e91381a670fa911026a21863f0f82af1de6b7d106b32bea4d783d4e2c8ceddee",
+    "sha256": "60c301aadbc57095fbb764f310effa2a4d569269d7b1baa6f08adde2b312328c",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "39157d52-4035-44a8-9d1a-6f8c5f580a07": {
     "rule_name": "Downloaded Shortcut Files",
-    "sha256": "3734901c2dbce0d6f0b119ddff90fe866f68c2fc432c33ef166921f6ba83c1fd",
+    "sha256": "6c9bc695426f3a54fae927672294c7f2717d5cad3fcbfb5f08b482c14ca8939b",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "393ef120-63d1-11ef-8e38-f661ea17fbce": {
     "rule_name": "AWS EC2 Multi-Region DescribeInstances API Calls",
-    "sha256": "c17aaffab1800f50439ea947e5d83bad847542dce0fa3a035bff758b4b41d5a6",
+    "sha256": "3baef76c046e4ec7eefef4ea4afd2a3ab5e3087df2e8501087fcd54235a0ea2c",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "397945f3-d39a-4e6f-8bcb-9656c2031438": {
     "min_stack_version": "8.14",
@@ -3730,28 +3747,28 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Persistence via Microsoft Outlook VBA",
-        "sha256": "552ee91e75f7ccd44773852337f72d88a83bf6868aa5afbefe6ff4634db9fff3",
+        "sha256": "b4336a223059e535a011019a1195afac85891381ddf49844a802db5e2b477d60",
         "type": "eql",
-        "version": 107
+        "version": 108
       },
       "8.13": {
         "max_allowable_version": 306,
         "rule_name": "Persistence via Microsoft Outlook VBA",
-        "sha256": "fbccc75ff02a26ccb579fc912dbe3bf5e26a7b1c0e7f2084425a15d680bda382",
+        "sha256": "6fea9ce2228537a8fdd8bed28be66ad7dda0b6cab23977c97c5c546f0d948fdd",
         "type": "eql",
-        "version": 207
+        "version": 208
       }
     },
     "rule_name": "Persistence via Microsoft Outlook VBA",
-    "sha256": "33de23d497e65bf6580cc0881d00591732c13e58e5e35d309d5a9bc28346b5de",
+    "sha256": "e8b70f2aab1ae0ee6ed818eb7bb5e7feb7fb75ac124680f6f0e9e79ae7395e46",
     "type": "eql",
-    "version": 307
+    "version": 308
   },
   "39c06367-b700-4380-848a-cab06e7afede": {
     "rule_name": "Systemd Generator Created",
-    "sha256": "b336dcc55cb6d9c74fd8f467faab033cf4e5c408d97b06a750b73840b1ba098b",
+    "sha256": "e121d39bd55b1f521c46bde65369f4dc594bf36659e4f5ccc0716bc3a1179e46",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "3a59fc81-99d3-47ea-8cd6-d48d561fca20": {
     "min_stack_version": "8.14",
@@ -3778,9 +3795,9 @@
   },
   "3a6001a0-0939-4bbe-86f4-47d8faeb7b97": {
     "rule_name": "Suspicious Module Loaded by LSASS",
-    "sha256": "372861b3a0dbd56bd07c70db72fade23ea4a42e3e23bb7f2abdcb213da4ebc17",
+    "sha256": "e01f62982334437f828c2aa0c07b8867b2b9811b190a82c5b871d1f47226447d",
     "type": "eql",
-    "version": 9
+    "version": 10
   },
   "3a657da0-1df2-11ef-a327-f661ea17fbcc": {
     "min_stack_version": "8.13",
@@ -3794,9 +3811,9 @@
       }
     },
     "rule_name": "Rapid7 Threat Command CVEs Correlation",
-    "sha256": "84bf983155b5e76077e32a0adf47cc76be94453dbd39a996d7cb55b112a6eb99",
+    "sha256": "eea438035c9adcd9486112d776374a2097e248b2311e73e0feb0d239e6507a7c",
     "type": "threat_match",
-    "version": 103
+    "version": 104
   },
   "3a86e085-094c-412d-97ff-2439731e59cb": {
     "rule_name": "Setgid Bit Set via chmod",
@@ -3806,15 +3823,15 @@
   },
   "3ad49c61-7adc-42c1-b788-732eda2f5abf": {
     "rule_name": "VNC (Virtual Network Computing) to the Internet",
-    "sha256": "7201f6b6243d0d0dc0eac73fe827a1ffb624b049a65a51c6841c687ffe51721f",
+    "sha256": "32d8adf51c1b7880e73d4cdb4e6b9e4a748807c35a66aea5866abec659490bd6",
     "type": "query",
-    "version": 105
+    "version": 106
   },
   "3ad77ed4-4dcf-4c51-8bfc-e3f7ce316b2f": {
     "rule_name": "Azure Full Network Packet Capture Detected",
-    "sha256": "5ff3c05e76cc5d8d9d4be4f532e57b7f4b864c7b441e409db8c6424396b0030d",
+    "sha256": "136ba855c996285fe602c5a751d85e4d5597adabab876c0840fb892207d97fb7",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "3af4cb9b-973f-4c54-be2b-7623c0e21b2b": {
     "min_stack_version": "8.13",
@@ -3834,9 +3851,9 @@
   },
   "3b382770-efbb-44f4-beed-f5e0a051b895": {
     "rule_name": "Malware - Prevented - Elastic Endgame",
-    "sha256": "6f120439816dc0fbb5966bc6163654d86dd3d1325de8e31e9b58acc704fca442",
+    "sha256": "f47e578ad81a99ac6ee1bd6045dddbe2ded14cc8f273b02f0f64ab04824557de",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "3b47900d-e793-49e8-968f-c90dc3526aa1": {
     "min_stack_version": "8.14",
@@ -3844,22 +3861,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Unusual Parent Process for cmd.exe",
-        "sha256": "1eeaf9397562f84443b1cd7a3422d97278a8b9aacfce241cb84f7a7fd0fa822b",
+        "sha256": "9bd527185ec4c38596e49c3a7ad276daa080ef3cf609a464de4f59e21fc1080d",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 412,
         "rule_name": "Unusual Parent Process for cmd.exe",
-        "sha256": "fc39f2acde3920cf811fffeba7c26a81cdba43f00f44e9649e96c6638439f59c",
+        "sha256": "fbe869ca88d432de9d48ffbb12ee20f5a623aed0aab53eba99bd3e08daf687e4",
         "type": "eql",
-        "version": 313
+        "version": 314
       }
     },
     "rule_name": "Unusual Parent Process for cmd.exe",
-    "sha256": "6607d2b148d51566de12ce0fadb3f13c90bb62e32b04a73759da7217d76f611a",
+    "sha256": "ae201f63b498ee9be3fb10b20daa1fefbe924dae1f8f7aecdfa986d172ae93e1",
     "type": "eql",
-    "version": 413
+    "version": 414
   },
   "3bc6deaa-fbd4-433a-ae21-3e892f95624f": {
     "min_stack_version": "8.14",
@@ -3867,40 +3884,50 @@
       "8.12": {
         "max_allowable_version": 213,
         "rule_name": "NTDS or SAM Database File Copied",
-        "sha256": "69c5c662633b3e2c7294f38dc1d1f983aa3bd4d8861b680baea696b37b0c4686",
+        "sha256": "9156d62db12466eaacc5c148af5205afdccba699bacc8d950d5d34aa5b2df532",
         "type": "eql",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 313,
         "rule_name": "NTDS or SAM Database File Copied",
-        "sha256": "7dbd101cfc60e0f4febc19c31533e12bb0a1abb9ecb7563306f9f11e42d65fdf",
+        "sha256": "dd1b2492ffdf8c527d2d87c4912e2cf19379fed1f522ba7e4db9fcee5d00d046",
         "type": "eql",
-        "version": 214
+        "version": 215
       }
     },
     "rule_name": "NTDS or SAM Database File Copied",
-    "sha256": "efc4be7065fb21dda602cb05f908b052088f468c4d5895557352b0bb7b435b0b",
+    "sha256": "d19835254ddf472acf6a543dbe42f0a508febba6db3f7f41149edfda7b57673b",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "3c7e32e6-6104-46d9-a06e-da0f8b5795a0": {
     "rule_name": "Unusual Linux Network Port Activity",
-    "sha256": "c9f2e221dc5c9b631010dd7a284367f67e996150f41da955b0bcb0608b3c0358",
+    "sha256": "c64036bdf9d9943178534e62dec4700829eb822cd497d08d1ac1d8f838d9d342",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "3c9f7901-01d8-465d-8dc0-5d46671035fa": {
     "rule_name": "Kernel Seeking Activity",
-    "sha256": "26c46bd62ff0d516a55fc08e17a9f41f3409d3490f4e6eb2c8204567f91e39f1",
+    "sha256": "647988b210c60c004ffe25efb4cce91136936f1cd83245f9f2b502058e6a2f02",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "3ca81a95-d5af-4b77-b0ad-b02bc746f640": {
+    "min_stack_version": "8.13",
+    "previous": {
+      "8.12": {
+        "max_allowable_version": 102,
+        "rule_name": "Unusual Pkexec Execution",
+        "sha256": "39004fc8c21df3175d05b13e4a85cc34c55f385af7ce819312b04b1a4df1148c",
+        "type": "new_terms",
+        "version": 3
+      }
+    },
     "rule_name": "Unusual Pkexec Execution",
-    "sha256": "f881f99cc51d27e19d500ed2de935f93246a9867a31fa8c9131db09d72eee2fa",
+    "sha256": "72cce527b0f0efd2f300fcd93f1c0273b4fd5476d6771008722109e0923882a1",
     "type": "new_terms",
-    "version": 2
+    "version": 103
   },
   "3d00feab-e203-4acc-a463-c3e15b7e9a73": {
     "min_stack_version": "8.14",
@@ -3908,22 +3935,22 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "ScreenConnect Server Spawning Suspicious Processes",
-        "sha256": "644088f8272495a09f98f2e60b82bdc7e491488962026c367645213608a99d86",
+        "sha256": "2b9c1287e301ff5273bf46bd4bc28af19a2c2e647f220ca8e0852fb643de0ebc",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 201,
         "rule_name": "ScreenConnect Server Spawning Suspicious Processes",
-        "sha256": "73219570f39fd74e63d334cf190ecad1456cf55d17635400acccced12f4145db",
+        "sha256": "cb777b967e2bef0af6adc011736d39ada2837c23d819ee51dde816731fa5a898",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "ScreenConnect Server Spawning Suspicious Processes",
-    "sha256": "152d719bdeb4edfad363cab37bbcfc8cba76396e6167e9191f3cee7e4ea76042",
+    "sha256": "f87fa55947db415ecfae1427203360803e4bb8d727b1e46383b1f6478f252bf5",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "3d3aa8f9-12af-441f-9344-9f31053e316d": {
     "min_stack_version": "8.14",
@@ -3943,9 +3970,9 @@
   },
   "3df49ff6-985d-11ef-88a1-f661ea17fbcd": {
     "rule_name": "AWS SNS Email Subscription by Rare User",
-    "sha256": "3782f3b4a3f1178ef89a11153e95f81c46ce674abc47b6c266753a0216a05c5c",
+    "sha256": "0845930f3f6cca07e769a39389e06a1fea6d273cfaf4c9470cd1a04c34b9c947",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "3e002465-876f-4f04-b016-84ef48ce7e5d": {
     "rule_name": "AWS CloudTrail Log Updated",
@@ -3955,9 +3982,9 @@
   },
   "3e0561b5-3fac-4461-84cc-19163b9aaa61": {
     "rule_name": "Spike in Number of Connections Made from a Source IP",
-    "sha256": "12c6038b69842f3fafbe9f2dd9630e0d41734d2b8678ebefe442944fe4a7595f",
+    "sha256": "0c33ca9283c1c2552060c3b5000ec87d338048cd715f4e7be2d3fdefe8a28fc0",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "3e0eeb75-16e8-4f2f-9826-62461ca128b7": {
     "min_stack_version": "8.14",
@@ -3965,40 +3992,40 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Suspicious Execution via Windows Subsystem for Linux",
-        "sha256": "8a6f3d4d6d2ab609c03f95537b72d713e9810f920db111edecb52d9d38d8f6de",
+        "sha256": "c0609df66a0848dc19f078200819edba894a861449ad572c19d8eef041240566",
         "type": "eql",
-        "version": 7
+        "version": 8
       },
       "8.13": {
         "max_allowable_version": 206,
         "rule_name": "Suspicious Execution via Windows Subsystem for Linux",
-        "sha256": "80ec99e7e9c7ceb86a2819a92409d1afbf4232a8603b961b1c2a06d3d5fec295",
+        "sha256": "89a4b41e934b13c0e79392e7730805f3e18c7d8cb6c3121b8b54b69a1aef8450",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Suspicious Execution via Windows Subsystem for Linux",
-    "sha256": "ed255a3528818035e55fb704799e92c28c150eb25062d2a1f17bcb57f7606766",
+    "sha256": "c7ce8b4413d99ed660c419bd822448ecdb2bb29f85095afc3954b5b698f0510e",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "3e12a439-d002-4944-bc42-171c0dcb9b96": {
     "rule_name": "Kernel Driver Load",
-    "sha256": "0d805e30368d7d1a1c774e0e29386cb807ff617bc0d294c11a6ecf97e9cf3bdc",
+    "sha256": "383925a7469fa24f12272515f90f29aa907b908a1f8cec676765b5c5cc5155d3",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "3e3d15c6-1509-479a-b125-21718372157e": {
     "rule_name": "Suspicious Emond Child Process",
-    "sha256": "b6aae2c2f1319d6dfcfceea3d42f2c90a421b25587e321a4bcc543da9488b064",
+    "sha256": "3cebf88aa246878db291a8148f143b3c0a07f8319cfd99c30942934db57c8a0f",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "3e441bdb-596c-44fd-8628-2cfdf4516ada": {
     "rule_name": "Potential Remote File Execution via MSIEXEC",
-    "sha256": "f427e7262f3caaa30fad3f63a14f32e77e72e8e8606381f64c7b2b3718fe7684",
+    "sha256": "66d3c7048c18aeeae2d032d26dcdc294b41eb32679eb445839815f7fcf66e4a8",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "3ecbdc9e-e4f2-43fa-8cca-63802125e582": {
     "min_stack_version": "8.14",
@@ -4006,22 +4033,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Privilege Escalation via Named Pipe Impersonation",
-        "sha256": "07b7a1afa550e1df6cbbf323c40b3819f4f1cdbd327efeabd9ad0efac059d864",
+        "sha256": "5e547726d704a4301dc4615b98d9b7ad1f182d5cc3aedce53b9b6b8185aa41eb",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Privilege Escalation via Named Pipe Impersonation",
-        "sha256": "495df18eb2e7fce9cab92e0daa1a6fc851b024af00ffe18364998f6349b22c9c",
+        "sha256": "5185ebda64142769dbcbdea022b195c73dfdfaa284fe60c4447cf57b4ce31119",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Privilege Escalation via Named Pipe Impersonation",
-    "sha256": "b3772a465fb94393a11a17110e5399564938138ce5e9a99952cecc8c7740c048",
+    "sha256": "767b7b4563a4fb94ee651353066ae8d1b66db8074cbafea2af6ee54fa111fb1f",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "3ed032b2-45d8-4406-bc79-7ad1eabb2c72": {
     "min_stack_version": "8.14",
@@ -4047,21 +4074,21 @@
   },
   "3f0e5410-a4bf-4e8c-bcfc-79d67a285c54": {
     "rule_name": "CyberArk Privileged Access Security Error",
-    "sha256": "c386d6369ab49aa1ccb5c14a29f84d5f2856b09ca44e9d53418a1477ace1a37a",
+    "sha256": "1a8ce0d911498f3340f7c6af2471615c1614881de45680175490600cd63fdad1",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "3f12325a-4cc6-410b-8d4c-9fbbeb744cfd": {
     "rule_name": "Potential Protocol Tunneling via Chisel Client",
-    "sha256": "4cf0ffba6ff6f1228756a6782ad1152b613568a74869d6299a2bedf9881f9420",
+    "sha256": "e3e1a89317aac3d3163e762c015186ff6195e391a1d3c206d9ed54926a2cc6d0",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "3f3f9fe2-d095-11ec-95dc-f661ea17fbce": {
     "rule_name": "Binary Executed from Shared Memory Directory",
-    "sha256": "6fe016ba390e8dc87666f4ef0c548568711ad0404b3acab74fedccdc68e0880d",
+    "sha256": "ec3773996957cf55b8cd5ac6098d1fcd503543308d70f1848e13577fa9dafef3",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "3f4d7734-2151-4481-b394-09d7c6c91f75": {
     "rule_name": "Process Discovery via Built-In Applications",
@@ -4071,16 +4098,23 @@
   },
   "3f4e2dba-828a-452a-af35-fe29c5e78969": {
     "rule_name": "Unusual Time or Day for an RDP Session",
-    "sha256": "da80ff0e6020c1f4b703d597ce09ad294629d13d57cddce31f7eac0eb7d51f16",
+    "sha256": "19b368441d2d3df9e36cec3f78601af029ba7a4ad96080e8a8a260e0062e4014",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
+  },
+  "3f7bd5ac-9711-44b4-82c1-fa246d829f15": {
+    "min_stack_version": "8.14",
+    "rule_name": "Command Execution via ForFiles",
+    "sha256": "a07d79ae3c7704e2254a7b3acfbb61cb39794537180723d6f351c719ecbba5e4",
+    "type": "eql",
+    "version": 1
   },
   "3fac01b2-b811-11ef-b25b-f661ea17fbce": {
     "min_stack_version": "8.13",
     "rule_name": "Azure Entra MFA TOTP Brute Force Attempts",
-    "sha256": "1a4b33f58f3f5e8119f8fdac2f49f61b75eb76cc5b91e8be6045078961c6f24c",
+    "sha256": "096663ac4f2f65728b65859267b7a5df52cae07f45541fc4df53d7d2c0162a1c",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "3fe4e20c-a600-4a86-9d98-3ecb1ef23550": {
     "min_stack_version": "8.13",
@@ -4088,15 +4122,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "DNF Package Manager Plugin File Creation",
-        "sha256": "9b7debfbc518927643432a23e5b412f09c4bb9379485e844cf368b99ac7ebfbc",
+        "sha256": "fac0417f4ce9d3dd3a95c48c5bc2916286db6bc572c8a5e31160761ffae8cf56",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "DNF Package Manager Plugin File Creation",
-    "sha256": "1aa2a1b1eca396c2a3f70bbc52d318ee9f31bda76398c543d78e25726cb02d3e",
+    "sha256": "9720e2ceb0deb64ad3773f7fb220ced4722d2586e68fffe60616480b49faf4c5",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "40155ee4-1e6a-4e4d-a63b-e8ba16980cfb": {
     "min_stack_version": "8.14",
@@ -4104,15 +4138,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Unusual Process Spawned by a User",
-        "sha256": "2a6704800d9d4ac73e97a1241f8f991ff2aff985ef0da43109ca59eda2b02134",
+        "sha256": "224877a0c6c75c03df527910da6a040b10e978b5277a900b3a5ebd606e5dcebc",
         "type": "machine_learning",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Unusual Process Spawned by a User",
-    "sha256": "201e146529ae1e7eeb0af4b0bc377ec5381676db3b1d5027332f45a8027f195e",
+    "sha256": "c26260d1977bf5bdca1f886c44ec9eb78f3a2a3f006f7c578474c60debadf653",
     "type": "machine_learning",
-    "version": 107
+    "version": 108
   },
   "4030c951-448a-4017-a2da-ed60f6d14f4f": {
     "min_stack_version": "8.13",
@@ -4136,22 +4170,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Unusual Persistence via Services Registry",
-        "sha256": "9124fc2a6d76be52cfaaa7edfd6b3c4272290e8964d42e59d8f1d1fba215848a",
+        "sha256": "f1c3d405ae61b94497a8a3b5ee7ad7b72dcadfec716c42f2975f6e18b624ec88",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Unusual Persistence via Services Registry",
-        "sha256": "189be13789b4fe9c8186eb9792601f98902e9e4f771519b7b2fa1a3730ac9783",
+        "sha256": "a73f4f5a3392e6fdcae94374c133aa55cd47a2a5f09dbd25ddec84a3f5d3f29f",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Unusual Persistence via Services Registry",
-    "sha256": "d4f0b0b8e409cfc73e748281d83319870c4576cc95f3859d8935524d3bc92af0",
+    "sha256": "5e43f778807201218a8a3cd2b8d33600b9cad394bf1d10a1a6a2bb8219170ffe",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd": {
     "rule_name": "Suspicious Modprobe File Event",
@@ -4165,15 +4199,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Unix Socket Connection",
-        "sha256": "36c91409f9ebf48e88b25078d6bd2b3b73f9800c2e99335803ecbcbaa0ec45f0",
+        "sha256": "66104dc588552246b0806f00f248c812a63ff54ca038949740267b9b913b3ec0",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Unix Socket Connection",
-    "sha256": "48a869a44950954d5f8f9e7e503bc71a3aef2f85baf249208f3562f525347ce9",
+    "sha256": "4e6ed5c689e74843dfe8eb79179c061375fa76071e31e878a498eb81896a3be0",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "416697ae-e468-4093-a93d-59661fa619ec": {
     "min_stack_version": "8.14",
@@ -4181,22 +4215,22 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Control Panel Process with Unusual Arguments",
-        "sha256": "0ec964d19b677c5a3602725e1d6954220c23d9d952c16ff1b6da2eea29a44e72",
+        "sha256": "eb0e17bd095fd38ddf2c2ed71f1364ac981fb062c0fae437dd381d62debc8747",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "Control Panel Process with Unusual Arguments",
-        "sha256": "ef575bc7d7acfcd5bbcb58ad8207b7e652bf99f488da62ebd21d3f1f263c804c",
+        "sha256": "158669641e518716cc54cccf172ae7f2a1640c5c56d8a13c1bfb3ec8b1099c39",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Control Panel Process with Unusual Arguments",
-    "sha256": "00d4df4d402cbc68f54277c6595937da99601194d0c3c14f55b63bc2480f3d53",
+    "sha256": "291b11e58bc1c7474e180f4367210eb8d6c53f5f2d722ba277a503097991353d",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "41761cd3-380f-4d4d-89f3-46d6853ee35d": {
     "min_stack_version": "8.13",
@@ -4216,40 +4250,40 @@
   },
   "41824afb-d68c-4d0e-bfee-474dac1fa56e": {
     "rule_name": "EggShell Backdoor Execution",
-    "sha256": "a000d7946f2d9c6608fef001a71aa8b626b93b668a56cb558aae7b94e49089cb",
+    "sha256": "f97c48740ffa8df05329c651c9620651fc36b543d6cdf582bec60f4945539c70",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "4182e486-fc61-11ee-a05d-f661ea17fbce": {
     "min_stack_version": "8.13",
     "rule_name": "AWS EC2 EBS Snapshot Shared or Made Public",
-    "sha256": "fe2c4a17447305354c8b9fb488d5c6fb13c563a31ab9baa5f8e4c630c4ab21dd",
+    "sha256": "f5901faceadcddad30aa0d48e7489446e561374f349a4bacaf544f9c5c418f6c",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "41b638a1-8ab6-4f8e-86d9-466317ef2db5": {
     "rule_name": "Potential Hidden Local User Account Creation",
-    "sha256": "41e2911f06e94357105e93c803ee44dbd7f4ec32bd8d4913fd5154123b4b677a",
+    "sha256": "777ea9757b7d3052124e6cc8d8748e0f0b03cc82e8c82535853132c99389a688",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "41f7da9e-4e9f-4a81-9b58-40d725d83bc0": {
     "rule_name": "Mount Launched Inside a Privileged Container",
-    "sha256": "cbe5528e821d12676b1467cbad8a167c831250bb28080658e40c69119be90c7d",
-    "type": "eql",
-    "version": 1
-  },
-  "420e5bb4-93bf-40a3-8f4a-4cc1af90eca1": {
-    "rule_name": "Interactive Exec Command Launched Against A Running Container",
-    "sha256": "3e2d9d02297e6659a2e22c12019c924caed14914e8e223416d9275a1c232f063",
+    "sha256": "b1264c8dba37013a036a37be5f2224231f056b698da7eacb55869127c98aa729",
     "type": "eql",
     "version": 2
   },
+  "420e5bb4-93bf-40a3-8f4a-4cc1af90eca1": {
+    "rule_name": "Interactive Exec Command Launched Against A Running Container",
+    "sha256": "ccaeaaf1218304a670c49ca863e898fd726c57156474f56613921232d21d71a2",
+    "type": "eql",
+    "version": 3
+  },
   "428e9109-dc13-4ae9-84cb-100464d4c6fa": {
     "rule_name": "Login via Unusual System User",
-    "sha256": "66fd861d1fa983a1abce1672b26a0ec424f5021eadbd38113c20cf070607a573",
+    "sha256": "98d6ad1428c6a1aa6239bfa75936d88f18749d6fb33d148792889108ee6f792a",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "42bf698b-4738-445b-8231-c834ddefd8a0": {
     "min_stack_version": "8.15",
@@ -4257,22 +4291,22 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "Okta Brute Force or Password Spraying Attack",
-        "sha256": "8cb82022ca04ad306c8f666ca1ebda971f41e8fb038555e01889eb1ffa9140f8",
+        "sha256": "f65119ef6918a244fc9d7e77a24da44f7c9571685cd9e6c587ea87d19951038a",
         "type": "threshold",
-        "version": 211
+        "version": 212
       },
       "8.14": {
         "max_allowable_version": 411,
         "rule_name": "Okta Brute Force or Password Spraying Attack",
-        "sha256": "8cb82022ca04ad306c8f666ca1ebda971f41e8fb038555e01889eb1ffa9140f8",
+        "sha256": "f65119ef6918a244fc9d7e77a24da44f7c9571685cd9e6c587ea87d19951038a",
         "type": "threshold",
-        "version": 312
+        "version": 313
       }
     },
     "rule_name": "Okta Brute Force or Password Spraying Attack",
-    "sha256": "28b663b19f5cf5fbe270dd54c5a6ab816765dd4ff6cb1fc3f6501ac8c353a669",
+    "sha256": "7de53603ee4b0fe24f98d5eac198e89c58e92243d6a6e67795968369a9fff2a3",
     "type": "threshold",
-    "version": 412
+    "version": 413
   },
   "42eeee3d-947f-46d3-a14d-7036b962c266": {
     "min_stack_version": "8.14",
@@ -4280,21 +4314,21 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Process Creation via Secondary Logon",
-        "sha256": "525c2144bf947ec8f46831b5237798e93320e6a3b2913ac51d2c48ec4c21c257",
+        "sha256": "91d70e5b1107013dad8be7bae393bcca1047e1bba36313312bcf1ab8865abe14",
         "type": "eql",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Process Creation via Secondary Logon",
-    "sha256": "6674dfbc494de648492942264a74378878bd65349a373567ab79725690c27aba",
+    "sha256": "0a1002224da121ca30f21a8dd641d8128a10f7113c132713aafe7cb287e82fec",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "4330272b-9724-4bc6-a3ca-f1532b81e5c2": {
     "rule_name": "Unusual Login Activity",
-    "sha256": "fdcb136029096fba35b1435354f3b4a22f6dcab41a79c2096a9f6a69530cf553",
+    "sha256": "eb323bc47a138a26bc5bcd92f8c25da588ca83b5b8dd6a8e7203111d13961caa",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "43303fd4-4839-4e48-b2b2-803ab060758d": {
     "rule_name": "Web Application Suspicious Activity: No User Agent",
@@ -4308,15 +4342,15 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Linux User Added to Privileged Group",
-        "sha256": "b36dd6fcfb99d97dac139862308b9eacab7435ef10661b56e29a24b22eebdf4e",
+        "sha256": "9ea5cc7a7d60adf681ee39ab6a1c142f5864ce9d989756808a78d1d00b5e0a1f",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "Linux User Added to Privileged Group",
-    "sha256": "f1c6054713eb3ad3792dee7d6aea237da18cf74fab7306e92ee2065db3607361",
+    "sha256": "aed1e55bff87f141c5ea1dd5d2bd5453a61f1e0d72d2c26f2e961a0107d1be5e",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "440e2db4-bc7f-4c96-a068-65b78da59bde": {
     "min_stack_version": "8.14",
@@ -4324,22 +4358,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Startup Persistence by a Suspicious Process",
-        "sha256": "5baf6e3486c22a80384b9ddf3b38bad2c2d273785cd3fddd585a2a2fdbf24d77",
+        "sha256": "3093b3093e9dfac5593dd9dead91b15345100e95d1bca816d602302c4ad03332",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Startup Persistence by a Suspicious Process",
-        "sha256": "55097fe7650ccd542aec1b7f2aa6cbd2363a7907f40ad5d19c69854a09f8a21e",
+        "sha256": "83e9d41fa1688f6e43f49b8f90e227adc1faa9a2cac3db9e262c7d452e68bc6e",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Startup Persistence by a Suspicious Process",
-    "sha256": "d22e1212d466beeea462d473302315e0145664ef7364a5d7055e1e499b1d1543",
+    "sha256": "c0608c95611f1a89e093cb3a0b2080c46a012ec91358883418506af1cd874eb3",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "445a342e-03fb-42d0-8656-0367eb2dead5": {
     "min_stack_version": "8.14",
@@ -4347,15 +4381,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Unusual Windows Path Activity",
-        "sha256": "55a14d59ed931d8a978a293e06c04c86113da5bba42e828f4d6f59908cfb7c94",
+        "sha256": "67bd807b50763f06dc6861bd1b4a7ad996afbb5766a7dc22bec1762999b6b281",
         "type": "machine_learning",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Unusual Windows Path Activity",
-    "sha256": "041957d983301e74d0e06438e1ee8ac7badf8dd542f3a501ad94e29ad6bf27e4",
+    "sha256": "0c67162e07a41a693f97af4942752d9557c76b058a4fa0df6be8777647152a80",
     "type": "machine_learning",
-    "version": 207
+    "version": 208
   },
   "4494c14f-5ff8-4ed2-8e99-bf816a1642fc": {
     "rule_name": "Potential Masquerading as VLC DLL",
@@ -4369,33 +4403,33 @@
       "8.12": {
         "max_allowable_version": 110,
         "rule_name": "Multiple Vault Web Credentials Read",
-        "sha256": "c1d407b17617d847a235c98e3d883e34fbac8e998edb79f15b1691b8a196691a",
+        "sha256": "e05edd0663a23b3dc3d0dd5f2131a31dd196f6d5357755443093cbb8bf3ea29c",
         "type": "eql",
-        "version": 11
+        "version": 12
       }
     },
     "rule_name": "Multiple Vault Web Credentials Read",
-    "sha256": "05a22c3ee9741e987667e6487211254de88c897b90832c45430c18a6b4582a38",
+    "sha256": "5fe1ae3d15fd72cc199a3ad6e01a42350d17065a06bc1bb2e3dc03455fe8b873",
     "type": "eql",
-    "version": 111
+    "version": 112
   },
   "453183fa-f903-11ee-8e88-f661ea17fbce": {
     "rule_name": "Route53 Resolver Query Log Configuration Deleted",
-    "sha256": "fe85472e289bd363341d59f4b9a362e21110fd6fb58902f400f3575b09f612a0",
+    "sha256": "bca21aeb358e7719e930c2792a3c5b1b899b86341952c8e0acf0f7a4fa84d36b",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "453f659e-0429-40b1-bfdb-b6957286e04b": {
     "rule_name": "Permission Theft - Prevented - Elastic Endgame",
-    "sha256": "e125e05070fd9e4879366bc19b3262c739e7820cfa207a0de2ddd94c30c7459a",
+    "sha256": "bc6f767d4be0de3156f54c606bcf218fc712696406e84ecd976a907d90c156bb",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "4577ef08-61d1-4458-909f-25a4b10c87fe": {
     "rule_name": "AWS RDS DB Snapshot Shared with Another Account",
-    "sha256": "bc96c80774873e20fc93cc0aeb3cc34e08ce5f4b3109b4218de43a44228be7ed",
+    "sha256": "ed499f9d7399c1be4f54417888b74be031a5b50a48b1d7c68b8caf33c4e24d44",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "45ac4800-840f-414c-b221-53dd36a5aaf7": {
     "min_stack_version": "8.14",
@@ -4435,22 +4469,22 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Adding Hidden File Attribute via Attrib",
-        "sha256": "7a07d3a3c11d1364d2b213517c43cc9fab8aab4adc8c2f3595c4bedba3f5765f",
+        "sha256": "40e7e669f1d9642518565d307ffc5b75f32bc59dbc783bf57db3e2375b38c647",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Adding Hidden File Attribute via Attrib",
-        "sha256": "7ad3e21c453191513dfe0e226519ce81d8d70e633876b9c5c611b097850e5c22",
+        "sha256": "e08df69ea36b56a927183010b7fbfe8e60d6c949a5489a3cfc82b7e9f45a3af0",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Adding Hidden File Attribute via Attrib",
-    "sha256": "911870b02ee518a2da8c3f8f090cd4b295555c15a1be6cd1ebc0aa8b569b12e6",
+    "sha256": "7546574a8ca4d5b8c758c17fb1658b2b1abbed196bd8d2090721d8efac0ec65d",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "4682fd2c-cfae-47ed-a543-9bed37657aa6": {
     "min_stack_version": "8.14",
@@ -4458,28 +4492,28 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Potential Local NTLM Relay via HTTP",
-        "sha256": "8c08daa0c05dcee4ed2250136b61ff79be87b9d5b3145a67e7b5aa0114bb3b8e",
+        "sha256": "9220e8499f32c72c36f2717e2499061f06a342f3e277f61283527351218c1329",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Potential Local NTLM Relay via HTTP",
-        "sha256": "70ebcc9b4db135969838d698ab1670f702ef00ddc29111226b7fa8d6b0a95f7e",
+        "sha256": "a2c4ebd5c69128fb78c6779664f8db208871ddc836b4b5854a0cd479429cd1af",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Potential Local NTLM Relay via HTTP",
-    "sha256": "ef467b076c584bc58e0fb6a3391048706f314e25ebb970eb1c7861eaaac4eacc",
+    "sha256": "3b0c27765337c2d89b8c6b82102d1f32fda82841806112bc4ac4d54c7d5ec5be",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "46f804f5-b289-43d6-a881-9387cf594f75": {
     "rule_name": "Unusual Process For a Linux Host",
-    "sha256": "816980152a0f36cc1d798d0b07b1c2c7814d4362233efb481d1f0525d8705fb1",
+    "sha256": "6cefd4c22a36577834d4d834fc5c1929fed830cef4703c1df262425f4f6b2cbb",
     "type": "machine_learning",
-    "version": 105
+    "version": 106
   },
   "474fd20e-14cc-49c5-8160-d9ab4ba16c8b": {
     "min_stack_version": "8.13",
@@ -4487,21 +4521,21 @@
       "8.12": {
         "max_allowable_version": 112,
         "rule_name": "System V Init Script Created",
-        "sha256": "bffd4c3c138597c1e8697e47dd4862d762e32635fa8b8a20e3272318eea1d034",
+        "sha256": "c38ce796006c8f39b82f0922d30cc71ddfbe8de3d7e7fa13c58947169f07dab2",
         "type": "eql",
-        "version": 13
+        "version": 14
       }
     },
     "rule_name": "System V Init Script Created",
-    "sha256": "75707b6e1215c02b5b333be4caefad14917a87d8d0d5b38a18c346eb857ba622",
+    "sha256": "30cfadc148e90c2cfc4382b7c085885ddc67f47211258ad9e8c35e63fb80d117",
     "type": "eql",
-    "version": 113
+    "version": 114
   },
   "475b42f0-61fb-4ef0-8a85-597458bfb0a1": {
     "rule_name": "Sensitive Files Compression Inside A Container",
-    "sha256": "4e4eac63997eab8b7b05da7301b3f3d904afbc53f9ac2c2789df7ff023df7939",
+    "sha256": "dc24c07ba236a3bb8628763095daaad91b96ba4e6d7905cb1ef854665513ea6c",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "476267ff-e44f-476e-99c1-04c78cb3769d": {
     "min_stack_version": "8.13",
@@ -4509,15 +4543,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Cupsd or Foomatic-rip Shell Execution",
-        "sha256": "fb87274ccfb96c0641b3aea5ddf1537d06990126a1c3f7c0406938ea5aaf0f01",
+        "sha256": "725b79909f3f199afec5b728eac38e0b2be9545c1c9fb3963576649af48a2e7a",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Cupsd or Foomatic-rip Shell Execution",
-    "sha256": "ee6cc99ccb00b4e64d3f60240e0c12a4355d9c77cb1bbdc35e834683ff68f85a",
+    "sha256": "f31488d82e4159063e7e92fa484c6c5f2b0d7c8287a8fb02adb790ef55d6242e",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "47e22836-4a16-4b35-beee-98f6c4ee9bf2": {
     "min_stack_version": "8.14",
@@ -4531,9 +4565,9 @@
       }
     },
     "rule_name": "Suspicious Remote Registry Access via SeBackupPrivilege",
-    "sha256": "24516e60132d4debae6058458462d958f659d37c82f6f68ae24cb1af134fa428",
+    "sha256": "de0bde89f44173a386cd38d4dd5c6e02a3fba6f877fd803f6e7e9108d609dc51",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "47f09343-8d1f-4bb5-8bb0-00c9d18f5010": {
     "rule_name": "Execution via Regsvcs/Regasm",
@@ -4543,9 +4577,9 @@
   },
   "47f76567-d58a-4fed-b32b-21f571e28910": {
     "rule_name": "Apple Script Execution followed by Network Connection",
-    "sha256": "1e70613b9ab01d3e1eabe9dc9ec52bb46b06c551a2bd5f19bc437c35219afd3a",
+    "sha256": "27d113fc9dd74c3da88815021fbd3a91cad66fb4959ca57d5033e135ddf75d69",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "483c4daf-b0c6-49e0-adf3-0bfa93231d6b": {
     "min_stack_version": "8.14",
@@ -4553,34 +4587,34 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Microsoft Exchange Server UM Spawning Suspicious Processes",
-        "sha256": "e00daf78742e5d25f05f11ec86efbda6a185e2b45e5738e6abd73e6795530c1f",
+        "sha256": "cd78c0361c8ca0f7334582409bb0bd2d14c582ec978c231bc26932cbd1a614e2",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Microsoft Exchange Server UM Spawning Suspicious Processes",
-        "sha256": "03e1e388a616fd76a913bb276b36b25a9a92ad0d3421a55ca134c175af61f971",
+        "sha256": "a1ebcfed8cf45331acadbd7adebe5f1eb37206754cdedcbe980c8b27bf0fd178",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Microsoft Exchange Server UM Spawning Suspicious Processes",
-    "sha256": "927864e2de84459226772454150dfa72d9134da990b83c7f61d2f4621e2bd541",
+    "sha256": "ed365c174fdf3dc7616909685c4dc4cafc7d521448ef6e96bb2b224ee25fdf54",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "48819484-9826-4083-9eba-1da74cd0eaf2": {
     "rule_name": "Suspicious Microsoft 365 Mail Access by ClientAppId",
-    "sha256": "33e3379959ca6f93326f5069bb4e5104c77c30f399d41fdb0108d3f4de3d7444",
+    "sha256": "a396e648dc8058d8a7af3f97d34c5784cc2e81b5a1e4616f31edc818a101ddc9",
     "type": "new_terms",
-    "version": 107
+    "version": 108
   },
   "48b3d2e3-f4e8-41e6-95e6-9b2091228db3": {
     "rule_name": "Potential Reverse Shell",
-    "sha256": "5cb666b8db28f6ef91c652488905003a54f688578c1a34017e77b80bc87c153a",
+    "sha256": "fdc6ca399ab1cfd315850c7822e7120a2710979cfbe329ca647b659fcf62ddb4",
     "type": "eql",
-    "version": 9
+    "version": 10
   },
   "48b6edfc-079d-4907-b43c-baffa243270d": {
     "min_stack_version": "8.14",
@@ -4588,39 +4622,39 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Multiple Logon Failure from the same Source Address",
-        "sha256": "36369b787180e53e8d9a0921e177975ce33ac03e4c3e101837cc43faa0aba56f",
+        "sha256": "787f60363fc9c42dd87f5774f5a6f219c201d492323d12dcfc3ec5d06acd4d02",
         "type": "eql",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Multiple Logon Failure from the same Source Address",
-    "sha256": "50742a90a9cfc7318d787fe297c644ba6ff7658ae59bda3650452a451ed3969c",
+    "sha256": "db4dd0177df2c0fbba77ba531c3f6f51c0724b44ea31fd2e84ca4cf2536f6b5f",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "48d7f54d-c29e-4430-93a9-9db6b5892270": {
     "rule_name": "Unexpected Child Process of macOS Screensaver Engine",
-    "sha256": "14e09fb223671c9a69d290403ce41fb14decb3fa7b322e5cdfee720edf523312",
+    "sha256": "4be8032dbbeecc1497aff05372e2139e72011b598bc146763878eaee2be2a499",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "48ec9452-e1fd-4513-a376-10a1a26d2c83": {
     "rule_name": "Potential Persistence via Periodic Tasks",
-    "sha256": "195c6ae2218bd1ce6a72411bb052c6c8be490604c24657b057699c3f7302aac6",
+    "sha256": "070bc3d77b85c97628a5f7626bba0e95d76cf34954f5db82e4abbdd323126b88",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "48f657ee-de4f-477c-aa99-ed88ee7af97a": {
     "rule_name": "Remote XSL Script Execution via COM",
-    "sha256": "8dcdd68d3f519784397cb030a40cfccbf754fcc330df54ab782ff54a1bed69fc",
+    "sha256": "986c22f239fcc3d437e58dcb98df458a9d9435c5f561c9da3628425f6dcd591f",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "493834ca-f861-414c-8602-150d5505b777": {
     "rule_name": "Agent Spoofing - Multiple Hosts Using Same Agent",
-    "sha256": "c43d7caff55a0e669d84e34d8cb65261d090952151144bb98ddc066fb35fb251",
+    "sha256": "6144987feeea5f57fa67484e121452ca28b0a522c8ee105f48e14de7fd4ef115",
     "type": "threshold",
-    "version": 102
+    "version": 103
   },
   "494ebba4-ecb7-4be4-8c6f-654c686549ad": {
     "min_stack_version": "8.13",
@@ -4628,15 +4662,15 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Potential Linux Backdoor User Account Creation",
-        "sha256": "5a9dab10c85e4612a211b8a0462ad02f3b63ea8ebe7964113b4fe4c6cf0ade62",
+        "sha256": "e9fba7cb50d7c0edfe213e52665e64b9fbaf596bbc274d66c2677a16b6524e00",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "Potential Linux Backdoor User Account Creation",
-    "sha256": "41858fb1b885aef0b0a2aee2353ba70f43841b18b6fab7efaa3f142a61b7db9f",
+    "sha256": "bffeae97a26ace150963159905c7c1cb2d3dd3aa299db431b4b0844567c257b9",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "495e5f2e-2480-11ed-bea8-f661ea17fbce": {
     "rule_name": "Application Removed from Blocklist in Google Workspace",
@@ -4668,9 +4702,9 @@
   },
   "4a4e23cf-78a2-449c-bac3-701924c269d3": {
     "rule_name": "Possible FIN7 DGA Command and Control Behavior",
-    "sha256": "340f1c9b6d0d92fa721456ed567e265ee5b0b193bb96bea2145541912b19c536",
+    "sha256": "df02c5a18062b26bd791e0bc8b97a58b4d463df63e0d16dd6352edde4318c54c",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "4a99ac6f-9a54-4ba5-a64f-6eb65695841b": {
     "min_stack_version": "8.13",
@@ -4678,15 +4712,15 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Potential Unauthorized Access via Wildcard Injection Detected",
-        "sha256": "ead602528c1e965f9015450bec41285bbba8c0d37139735cfbf3eb7e954067ea",
+        "sha256": "2bfb9d1c293185db7cebfaf6649ecce4d26ca6bd6e8f6fb252e811960272d4e7",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Potential Unauthorized Access via Wildcard Injection Detected",
-    "sha256": "1a3a1dd2c62931e4f4219efcb21815a2873f452e37b5a43a99bc6c1097e5456c",
+    "sha256": "fbc9b003a74a72df517c09f83f2629428a29346428ee3311faa27da6614488d3",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "4aa58ac6-4dc0-4d18-b713-f58bf8bd015c": {
     "rule_name": "Potential Cross Site Scripting (XSS)",
@@ -4725,9 +4759,9 @@
   },
   "4b4e9c99-27ea-4621-95c8-82341bc6e512": {
     "rule_name": "Container Workload Protection",
-    "sha256": "232d94bfc84f58f133c5ffa086853fc01f635acea7ff1d6298f9d781a383ed24",
+    "sha256": "b58a5fb3b121b08852cc186827479ae739d8b155cf8c9d12dbd17fa70d9fd74c",
     "type": "query",
-    "version": 4
+    "version": 5
   },
   "4b868f1f-15ff-4ba3-8c11-d5a7a6356d37": {
     "min_stack_version": "8.13",
@@ -4735,21 +4769,21 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "ProxyChains Activity",
-        "sha256": "2997e880be8be8e48bd8066e4736d34483677decfa5262604e7c884d9ff407d3",
+        "sha256": "6d2bb84fbddf0c3a063f3b83fe3182017edbe19020c1e1dafc558ec07a767a0b",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "ProxyChains Activity",
-    "sha256": "50873c947464e5b7e0f7bf3dc3cf714ad8cb4afc0b467858fac06331df2723f1",
+    "sha256": "7b6c538ea2e93784ce64d2a04dbb00ddbc28aac92ab6008312821b65a46d8717",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "4b95ecea-7225-4690-9938-2a2c0bad9c99": {
     "rule_name": "Unusual Process Writing Data to an External Device",
-    "sha256": "d5d28b9af1ed399604eb5bc1744453ce1f5dbc4839e7650ccf12c30616fe3d07",
+    "sha256": "ed51342a669aca3acd05b70564dd2b6c9e0ff02f83266d5665ef6dca3851a6c7",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "4bd1c1af-79d4-4d37-9efa-6e0240640242": {
     "min_stack_version": "8.14",
@@ -4757,28 +4791,28 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Unusual Process Execution Path - Alternate Data Stream",
-        "sha256": "8cd12a854dbd43e2cd0db12f9515413ced21fa11fbc405bf87983c4e4635ae45",
+        "sha256": "c6c357f72dda9ad192ec0f1297502bd068bf0cbdcc97ab58e49d86e7cfdde988",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Unusual Process Execution Path - Alternate Data Stream",
-        "sha256": "dd78ff329788e32ccfcd11f3331174f609f2a0b868ccfbf47b8d997dbfd30096",
+        "sha256": "57c2b49691db8ebbed599f9985cf9d43545ea46a7e458dd4a28bd20f0f0476ca",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Unusual Process Execution Path - Alternate Data Stream",
-    "sha256": "fdac8198180b87285d0dce793712e89ac9bdb36ea90ce122de8f4b1095c4dd6f",
+    "sha256": "724c9eb77e876a0609dca7f377c3b888ee71c8ace7316e67235b6399e7dde6d3",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "4c3c6c47-e38f-4944-be27-5c80be973bd7": {
     "rule_name": "Unusual SSHD Child Process",
-    "sha256": "482163bba1d5afced4faf24a38e7ed0317164468a4faf3bcb8ecb58d21024320",
+    "sha256": "1563951eaa26040f25dcd3eae36d9f46c9bdcf45a6f24398ce7a7fc4382da092",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "4c59cff1-b78a-41b8-a9f1-4231984d1fb6": {
     "min_stack_version": "8.14",
@@ -4802,27 +4836,27 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Kernel Load or Unload via Kexec Detected",
-        "sha256": "12adf24b45b80651b336e5b4671fab85fbc28d4537ec3a96a58e9e0dba18da77",
+        "sha256": "d477a1c1cf4b80c1c4b058813b66f4952e183bd224d21bd44d145c7845ff027f",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Kernel Load or Unload via Kexec Detected",
-    "sha256": "9fac7bb1e34b314d0950b254edfbcb8b0035486525df4e2fc5b9e9cbb65785b1",
+    "sha256": "276e07ad6386011b5ba83107e7f863831a18b2c1b755a679005768a02b1d9f6d",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "4d50a94f-2844-43fa-8395-6afbd5e1c5ef": {
     "rule_name": "AWS Management Console Brute Force of Root User Identity",
-    "sha256": "64dc42dae58d6c7edafe597e4c2cf33845002b02ae71649f5f19a5efe11089c1",
+    "sha256": "189ef68f8b1654ea9486b7831d9a69f4b42554453426d0d7531fe7052cd96756",
     "type": "threshold",
-    "version": 207
+    "version": 208
   },
   "4da13d6e-904f-4636-81d8-6ab14b4e6ae9": {
     "rule_name": "Attempt to Disable Gatekeeper",
-    "sha256": "af8d10ad0bf3fd9de00ec04cf9ec8786a9deae55c4c5086fd8101b18e5ab22ba",
+    "sha256": "37d2ef8b050dfdece62cbbe06bc676f8199d5b4f1fddca44de9748f463a2ad80",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "4de76544-f0e5-486a-8f84-eae0b6063cdc": {
     "min_stack_version": "8.14",
@@ -4853,15 +4887,15 @@
       "8.12": {
         "max_allowable_version": 110,
         "rule_name": "Multiple Logon Failure Followed by Logon Success",
-        "sha256": "bf31596123965d48e9aa656e0e935a6038395a1f7aa60a94aca3e18d72b79dc8",
+        "sha256": "f68db77a65c50c4489742ca308f8beef345bcd834e6782fd47c79d47c4cb7af9",
         "type": "eql",
-        "version": 11
+        "version": 12
       }
     },
     "rule_name": "Multiple Logon Failure Followed by Logon Success",
-    "sha256": "7b0176c520ea313b2012e6843edc760f64652558471e6f971e2b6d86d90116df",
+    "sha256": "b8743c73288c176d82f7c326f655ad546ca945eaabe141bf1da60e5f045481a0",
     "type": "eql",
-    "version": 111
+    "version": 112
   },
   "4ec47004-b34a-42e6-8003-376a123ea447": {
     "min_stack_version": "8.13",
@@ -4869,15 +4903,15 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Process Spawned from Message-of-the-Day (MOTD)",
-        "sha256": "dc02518c5ff827d505855e686392c55611d0d5d05b81c9febbb3f9ef60cbbd38",
+        "sha256": "26c209b252768d129ab5bccfb4006456a5cd64d7ed097dd81d513beb333d8d7e",
         "type": "eql",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Process Spawned from Message-of-the-Day (MOTD)",
-    "sha256": "37e55cdb7d8b2334bc54fc6a9a492d1dffe8309b0ee44811480a42ee01190bde",
+    "sha256": "f680d6c8ee7249b89249a6710ce30801b2c982cef68f015538d7cfac8430cc94",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "4ed493fc-d637-4a36-80ff-ac84937e5461": {
     "min_stack_version": "8.14",
@@ -4908,15 +4942,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Suspicious Script Object Execution",
-        "sha256": "ff51979abf90a96b0ab21324887f4c1b54fce14ba48a37fa78f1350865e6b77f",
+        "sha256": "d03461949ea02ae5d1a9afa32408fcc350c90751725cecedddb19bc153f58ba7",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Suspicious Script Object Execution",
-    "sha256": "87be064ac19c5ea66f69f2e2387eea0c3cd7bf236626285df2b76b760f408845",
+    "sha256": "21d6ca38910e536e9886d360bd1cfe63932e9d4036a7d6a26af4708806dfecdb",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "4edd3e1a-3aa0-499b-8147-4d2ea43b1613": {
     "min_stack_version": "8.15",
@@ -4924,35 +4958,35 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Unauthorized Access to an Okta Application",
-        "sha256": "95e0cd3a2a3bc15c0bbbd9e22b5a372804d997f19dadf55ebf29acb592d16269",
+        "sha256": "7c9a2609b0c927d2b54d9609d677f0379515475dbcb523900a3bab9c18910f63",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Unauthorized Access to an Okta Application",
-        "sha256": "95e0cd3a2a3bc15c0bbbd9e22b5a372804d997f19dadf55ebf29acb592d16269",
+        "sha256": "7c9a2609b0c927d2b54d9609d677f0379515475dbcb523900a3bab9c18910f63",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Unauthorized Access to an Okta Application",
-    "sha256": "872ca06a3df823a9c316611272ac1752aab862fc1e64862d1975653a142152bd",
+    "sha256": "d92cb4bcc5aadaea4dc0e6b7b35a1bf6e2ae910fa754432faf4dfb96696001be",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "4f725dc5-ae44-46c1-9ac5-99f6f7a70d8a": {
     "rule_name": "Kernel Unpacking Activity",
-    "sha256": "20d605e52736db120b290b4b7629c450f6b3d0a127d68f5aea96d3002df522eb",
+    "sha256": "d10bf82f2f2925d3893f3170c4824f6e0cd1c812c901dc8fc256f113e735498e",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "4f855297-c8e0-4097-9d97-d653f7e471c4": {
     "min_stack_version": "8.13",
     "rule_name": "Unusual High Confidence Content Filter Blocks Detected",
-    "sha256": "b7158a40dd8e99134d485c6d09a2aebc63453ffe622fb446d43f1f4d20247a0e",
+    "sha256": "c2e729e23f37d687504d5c86cb91f01a1d9363cd489f06a54723e557f02903cd",
     "type": "esql",
-    "version": 5
+    "version": 6
   },
   "4fe9d835-40e1-452d-8230-17c147cafad8": {
     "min_stack_version": "8.14",
@@ -4960,22 +4994,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Execution via TSClient Mountpoint",
-        "sha256": "13f5cc6ad0ceb744bd444965dad8371e0611a07853e0a95e644693752311fef2",
+        "sha256": "02b2a3c16d505ff7b41a860c6ba3587cf4376a57a4dfb1d8af17d0620d4dea7f",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Execution via TSClient Mountpoint",
-        "sha256": "8fcabaf421ead8967729841048f4304562f4719e3d0b887656122fe831a43b9d",
+        "sha256": "186e25b241af067c22b65d97a6746b5a72b63e2aad403893a00ef3b7d39b1982",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Execution via TSClient Mountpoint",
-    "sha256": "72eaaba3e4541c4b67787d99cacc0cc2a13b0947f01563d4fb97ee7c1b5230df",
+    "sha256": "133dd8bfb660f0ac4114ee86831af289b29876b1e47d9868ae4380002e493545",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "50887ba8-7ff7-11ee-a038-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -4983,28 +5017,28 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy",
-        "sha256": "896180c01cd25b69f007c4d08fd62ffe4932d008921e11caacaa7ba40718cbdb",
+        "sha256": "3fd4abe84fade840ddabfa0b4a59937c3d0c030a1681cc96bef3b4c37db789f7",
         "type": "threshold",
-        "version": 5
+        "version": 6
       },
       "8.14": {
         "max_allowable_version": 205,
         "rule_name": "Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy",
-        "sha256": "896180c01cd25b69f007c4d08fd62ffe4932d008921e11caacaa7ba40718cbdb",
+        "sha256": "3fd4abe84fade840ddabfa0b4a59937c3d0c030a1681cc96bef3b4c37db789f7",
         "type": "threshold",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy",
-    "sha256": "80783610742a22be0730b4d1eb9099aba07a76dd22481771f6f15a4c8175b408",
+    "sha256": "6a554290e7a84ccbd18f8a19971e557ac7a9838d92308436ae1252d215f09d94",
     "type": "threshold",
-    "version": 206
+    "version": 207
   },
   "50a2bdea-9876-11ef-89db-f661ea17fbcd": {
     "rule_name": "AWS SSM Command Document Created by Rare User",
-    "sha256": "92832a1d67cc61df5e937f62a495aead9cfcc980486b8d2b754f3416427265aa",
+    "sha256": "16bcc4e20cbecdeda51970a7c080df121c8c49778592fd2b3384519d93b21280",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "51176ed2-2d90-49f2-9f3d-17196428b169": {
     "min_stack_version": "8.14",
@@ -5028,15 +5062,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Hidden Files and Directories via Hidden Flag",
-        "sha256": "12f8eb3b4618ce0341401b73c190673b46bb61613acb4341b028e3e4bec093c9",
+        "sha256": "48ab779e161fbd3bfc978ec8def0e6511023cebad2f6c5874cc71cd14d2da1d4",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Hidden Files and Directories via Hidden Flag",
-    "sha256": "daf596f6901bee71cb114cdd3ba6d93425bf62553a144a91ea77214278402800",
+    "sha256": "b73939a26aed301cde9d16fd437a77e325a4393d91a96a981d2fb92dedb61b74",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "513f0ffd-b317-4b9c-9494-92ce861f22c7": {
     "min_stack_version": "8.14",
@@ -5044,34 +5078,34 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Registry Persistence via AppCert DLL",
-        "sha256": "c5ff7eb8172555229b212c9210db00fb26898ce71473a3879fcd04d270da857d",
+        "sha256": "13b9667f77ece11fa75c760717a7f1a7474e6cf3583c6d428b0b835bbb79c161",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 411,
         "rule_name": "Registry Persistence via AppCert DLL",
-        "sha256": "12362423f221d5f78a62ede69455b6acc8926caeb7057ac6af76e9e8663839a1",
+        "sha256": "4605f205b084980b9052a6f82ff9ace18abaddddba5a0901b25ee42d0a048865",
         "type": "eql",
-        "version": 312
+        "version": 313
       }
     },
     "rule_name": "Registry Persistence via AppCert DLL",
-    "sha256": "6888e4d8dc2ffc69e0f3b29e7601596b7ed396f3071eb3bf4b22614aec126f6d",
+    "sha256": "a122de466303b9918efe6f15d1a658addad361829c6bf7d515d823a75eb19a2f",
     "type": "eql",
-    "version": 412
+    "version": 413
   },
   "514121ce-c7b6-474a-8237-68ff71672379": {
     "rule_name": "Microsoft 365 Exchange DKIM Signing Configuration Disabled",
-    "sha256": "51cc46687ba4f2ec1ce8b6d3af9bcf1d8e6449e6300a2dfde2ec5442af150b87",
+    "sha256": "f5a4de0b0ac06eb1a69c2cb23b7f9d7b884a576168db1d956ef9ff6144c5756d",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "51859fa0-d86b-4214-bf48-ebb30ed91305": {
     "rule_name": "GCP Logging Sink Deletion",
-    "sha256": "c9a8ece69b7f242aba612e1ba56c3839f13edb69babaff4ec9dd0f717dbcf827",
+    "sha256": "5d8877660ac02415a7e931d15a718cadb7de72da25f5bcdc79d9fd493d4c71f5",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "5188c68e-d3de-4e96-994d-9e242269446f": {
     "min_stack_version": "8.14",
@@ -5079,28 +5113,28 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Service DACL Modification via sc.exe",
-        "sha256": "9c5a9c19d4b67840dde2145064352324b6f1374a3fb8b77016e69e70c047fb9d",
+        "sha256": "0103f881f5ee4e7c9d82ed15157325d5b5a58d4e397d6367d4da02bbf8ce0034",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Service DACL Modification via sc.exe",
-        "sha256": "bb0ebdc1eaa518a43a85a25951a8d3bb5afc5efe28ed295961a00afbb0f048f4",
+        "sha256": "f3deede5cd5976b88fba9f4fe5814c558ca142f46001382dd888e8f1294a9892",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Service DACL Modification via sc.exe",
-    "sha256": "4966b4c68a294538d5fe7fdd895bf295a7b8220649477a2de843e07ffbbd038b",
+    "sha256": "2196b597b084d5ecbb13b0b17492f36f5b84dcca3a09a280a2e2d59035ac22bb",
     "type": "eql",
-    "version": 204
+    "version": 205
   },
   "51a09737-80f7-4551-a3be-dac8ef5d181a": {
     "rule_name": "Tainted Out-Of-Tree Kernel Module Load",
-    "sha256": "ade59253fc0de2627984007ba84a2d944a16000aa69c83193c63f1dda8b806fa",
+    "sha256": "097a5bc6720f07acfae2d20f11d9a717f1fe350cf94d7145adaa481146c184df",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "51ce96fb-9e52-4dad-b0ba-99b54440fc9a": {
     "min_stack_version": "8.14",
@@ -5108,33 +5142,33 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Incoming DCOM Lateral Movement with MMC",
-        "sha256": "7592f24cbedd399be83dd10921cadbae21a7f07859288848bc34cce173c9a03a",
+        "sha256": "341be9c43bad17537b54fdc7f40f8c156c772443e30caf8193c825ef8ae6e632",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Incoming DCOM Lateral Movement with MMC",
-    "sha256": "84c893dffd43871523001e934f53b55aa3560ab0e48927a519cc9890b21e6206",
+    "sha256": "98bc7f7c240e76cd9d3ecb1a5633fb0d68e571ceffa5569f91e5702c53b02d8f",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0": {
     "rule_name": "Potential Successful Linux RDP Brute Force Attack Detected",
-    "sha256": "3a3059d247c0e3ef2e352ab75eb703f91476c8c3f57f2b33c79c545cc0e34325",
+    "sha256": "1e7bfe4a829855d26e56d29a29a24edf68130b67fb19c38c807680c99f335d69",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "523116c0-d89d-4d7c-82c2-39e6845a78ef": {
     "rule_name": "AWS GuardDuty Detector Deletion",
-    "sha256": "f4d0bc7c75781581ae0325bb506f235d080a25501776cac6a7268376499066ce",
+    "sha256": "0d18d9439a5628f8f0339e9c968f779926c27addbf3835666f0b4312115511b5",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "52376a86-ee86-4967-97ae-1a05f55816f0": {
     "rule_name": "Linux Restricted Shell Breakout via Linux Binary(s)",
-    "sha256": "fd77da125fda39b0791110d21e18fe7c21233971339f47f4d46a1f228f048839",
+    "sha256": "94dbbc192b8f9c9fb802a3785bc420e0f318b461c50fb90a879eca803aa6d523",
     "type": "eql",
-    "version": 113
+    "version": 114
   },
   "5297b7f1-bccd-4611-93fa-ea342a01ff84": {
     "rule_name": "Execution via Microsoft DotNet ClickOnce Host",
@@ -5160,9 +5194,9 @@
   },
   "52afbdc5-db15-485e-bc24-f5707f820c4b": {
     "rule_name": "Unusual Linux Network Activity",
-    "sha256": "55992af5ec9860d11678c489909dda9a45c32e993b83107a655b61fffe7b5fd1",
+    "sha256": "7705ae36b0bdaf932acba46ebafffb17e3e085213212f44314d4bcc79090bb04",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "52afbdc5-db15-485e-bc35-f5707f820c4c": {
     "rule_name": "Unusual Linux Web Activity",
@@ -5178,33 +5212,33 @@
   },
   "530178da-92ea-43ce-94c2-8877a826783d": {
     "rule_name": "Suspicious CronTab Creation or Modification",
-    "sha256": "a7492fef4099c032e096729ad621e9e19ed59798e0df2a83ef45c381a4d821ab",
+    "sha256": "c30eb96fc6194d443c353229802bba9be8aaebc4e8abc78d2734cc5612fd49f1",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "53617418-17b4-4e9c-8a2c-8deb8086ca4b": {
     "rule_name": "Suspicious Network Activity to the Internet by Previously Unknown Executable",
-    "sha256": "31fdbcd1bcd6c7fd916a92c19c40e5cbe355a75a3b31c97758f5723d31bdf870",
+    "sha256": "dda8b86ee8d2dcee8026d296c9e5f313eaa3dc3d50eedfd6ae6e19c938486a92",
     "type": "new_terms",
-    "version": 11
+    "version": 12
   },
   "536997f7-ae73-447d-a12d-bff1e8f5f0a0": {
     "rule_name": "AWS EFS File System or Mount Deleted",
-    "sha256": "f0730064c70db89a626831b93e76595c6003a60060e20198818f45aa1f710990",
+    "sha256": "e6c6dd49909f5672bab0d1d27d7ea1b5661d81198a9568926b30ca91064fbe16",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "5370d4cd-2bb3-4d71-abf5-1e1d0ff5a2de": {
     "rule_name": "Azure Diagnostic Settings Deletion",
-    "sha256": "d8cf4f99c49156e9bc70819e7e213ddc8254034a37779b4650402dfe6597dce2",
+    "sha256": "8227f6204aca346ad00f70681a540b2e14358f63b3415da0a722d3fe8c4bf796",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "5397080f-34e5-449b-8e9c-4c8083d7ccc6": {
     "rule_name": "Statistical Model Detected C2 Beaconing Activity",
-    "sha256": "d973fcbb65bfb1114bf7274eec0a49753fc3ac6e545fb635cd87b176b08276cc",
+    "sha256": "9eafe3af498b5f504346bcbb44ddacf2157ebf9f7dc56a66e0f6512ccbcaa61e",
     "type": "query",
-    "version": 6
+    "version": 7
   },
   "53a26770-9cbd-40c5-8b57-61d01a325e14": {
     "min_stack_version": "8.14",
@@ -5247,9 +5281,9 @@
   },
   "53ef31ea-1f8a-493b-9614-df23d8277232": {
     "rule_name": "Pluggable Authentication Module (PAM) Source Download",
-    "sha256": "4506697959db38106a2f20808c7650d71b4bb69ca921ecb433f9f7d437e1b418",
+    "sha256": "af9d57399895c1474ce02d98053dee54db65bf201345fb22036a0935476ec4bc",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "54902e45-3467-49a4-8abc-529f2c8cfb80": {
     "min_stack_version": "8.14",
@@ -5257,15 +5291,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Uncommon Registry Persistence Change",
-        "sha256": "b18ae237ecf1195a3a18d5e282ebbd4f5b841f81e0b4589c75029d4e2509468a",
+        "sha256": "44240eefb782b212aa0e92aa499c5c53a15dd47c2d5ccd8d5bbd7e730a2ced0d",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Uncommon Registry Persistence Change",
-    "sha256": "05f4e7d83a92a1aaed215be67f65efbc6491fca10438887f10a7d47cfb88c838",
+    "sha256": "b7dac84100da5dd86f5b3db2e97a9c0d5bbc086be021a8d71d6801723d7317ee",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "54a81f68-5f2a-421e-8eed-f888278bb712": {
     "min_stack_version": "8.14",
@@ -5289,15 +5323,15 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Network Logon Provider Registry Modification",
-        "sha256": "9838e651bcc3ca696c8bbe02db34f5ab98e93e30ff733022c2f835f995de5698",
+        "sha256": "c1d15e3f87d0c06656e38903de062e3f17bdbd3884c26fd330cb747036019545",
         "type": "eql",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Network Logon Provider Registry Modification",
-    "sha256": "5132f31e51639151e91e5c3302b4650fc9f619e7eb892a051a03487eb3b5e62e",
+    "sha256": "dccddc93820e882a05daa4e44e2f269398b302098bbe00d5c1571ffd86581be4",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "55c2bf58-2a39-4c58-a384-c8b1978153c2": {
     "min_stack_version": "8.14",
@@ -5305,15 +5339,15 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Windows Service Installed via an Unusual Client",
-        "sha256": "98cb1835def5a7a494d229dd5fe558e75afce8c5dfa2aa0f39ff9e0f71871347",
+        "sha256": "339bd5dfcc9715aebb297d9e0f1c984616bf99c0dd887935f7b94a77c4b1889d",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Windows Service Installed via an Unusual Client",
-    "sha256": "b6183b74d47d3cfe8b22dcff57a47da7713bc366002dbf9f7979a42bf76f6cc6",
+    "sha256": "d727778c418f5ff259d819e6c8c56cd07c2f086ea12d877c3379792b549ba948",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "55d551c6-333b-4665-ab7e-5d14a59715ce": {
     "min_stack_version": "8.14",
@@ -5343,15 +5377,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Unusual Process Spawned by a Host",
-        "sha256": "288753c0acbb4ead22f3c4e6457bb3ea4019d812147816fc00c1b4c855ae4098",
+        "sha256": "20041d45b1675b29ac029036acb9a791d296507da6fc2d342c22e8ae9d37add9",
         "type": "machine_learning",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Unusual Process Spawned by a Host",
-    "sha256": "fc15e14ff5e5b9a4e9791cd5a68b234418e8d305be7f057eb8a3d00248eac66b",
+    "sha256": "3910654eec2497e6c45f9eba623296d166de75f2bf26bf5f27f652de0fe602b3",
     "type": "machine_learning",
-    "version": 107
+    "version": 108
   },
   "5610b192-7f18-11ee-825b-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -5359,22 +5393,22 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Stolen Credentials Used to Login to Okta Account After MFA Reset",
-        "sha256": "97cd8c1494717168fc997e2a29f7c928e6c0998706201fe3ff2715b05271179a",
+        "sha256": "ec566f4e3388dd1ab9134b4f1fd960d63dab606c6ad5802edbbc41f539136c3f",
         "type": "eql",
-        "version": 4
+        "version": 5
       },
       "8.14": {
         "max_allowable_version": 204,
         "rule_name": "Stolen Credentials Used to Login to Okta Account After MFA Reset",
-        "sha256": "97cd8c1494717168fc997e2a29f7c928e6c0998706201fe3ff2715b05271179a",
+        "sha256": "ec566f4e3388dd1ab9134b4f1fd960d63dab606c6ad5802edbbc41f539136c3f",
         "type": "eql",
-        "version": 105
+        "version": 106
       }
     },
     "rule_name": "Stolen Credentials Used to Login to Okta Account After MFA Reset",
-    "sha256": "fd2d0b18230dba57e262ff15ef178339f367f10a09d997ff14b5585bb959da00",
+    "sha256": "a19bb50cba9f9f404a82703239d5f7c37e59ce956e04da03adddfd9a4dfab224",
     "type": "eql",
-    "version": 205
+    "version": 206
   },
   "56557cde-d923-4b88-adee-c61b3f3b5dc3": {
     "min_stack_version": "8.14",
@@ -5382,33 +5416,33 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)",
-        "sha256": "0e87c9e449804be35d7c6b0b54a4b6dac4a0c973fdf92f2645b9f7c3ab8c20f7",
+        "sha256": "4a4e70e7f50105c48f29f32d7d234cfa9538813b06309ce72c3dcd4a7a21a3e2",
         "type": "query",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)",
-    "sha256": "1645e32bd9388cfedd1bbb52f9d608fa1f020e59df807c8c0a24d791979f2fc7",
+    "sha256": "2b4e8ce5e2579fc3644b048d0eefd8b6c9e8ae17c0eb9201191933d58be50dfa",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "565c2b44-7a21-4818-955f-8d4737967d2e": {
     "rule_name": "Potential Admin Group Account Addition",
-    "sha256": "1e416a23a57946cd76fb3a0d31a22ba04b7d13ed78b7ea1c9beb9728961216f9",
+    "sha256": "6f18cbdc2814670890459e8a1b80c7b8bfac998d71d67c250ffa5a3017a0a95e",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "565d6ca5-75ba-4c82-9b13-add25353471c": {
     "rule_name": "Dumping of Keychain Content via Security Command",
-    "sha256": "ccf09271bdf9cd7de53d339b60a06f2e48c9a81fb9907a6f3d26b086d3e524fb",
+    "sha256": "a12b24ae6304c80c777dd5b7e120916781b2e76b2f09848e292a453d76cd5056",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "5663b693-0dea-4f2e-8275-f1ae5ff2de8e": {
     "rule_name": "GCP Logging Bucket Deletion",
-    "sha256": "080210ccfb075c63c43cbbdd386dcf8857830563eb3757d61841656cf2099d2a",
+    "sha256": "50c3afa5e3c557336820b41946ef7d0889d9f7002f614b9bc7a0f6216fdb24de",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "56f2e9b5-4803-4e44-a0a4-a52dc79d57fe": {
     "min_stack_version": "8.14",
@@ -5416,15 +5450,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "PowerShell PSReflect Script",
-        "sha256": "aad7b1f375e681f444c68f70ea1f4d7e576d7026cb010039451c1d68a5511d7d",
+        "sha256": "9075bac2c658f9cd09ae5480d64a0005ed4877f273b113b12c5c9d38098e5c35",
         "type": "query",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "PowerShell PSReflect Script",
-    "sha256": "38589e5b42cc43f6e6b822a37057ab671b1596137a108e3c0f6275bbd7821ad1",
+    "sha256": "60ce649f4376763aa71d2a2bbe3126251aafabb204c1bd51614fab34b09fccd7",
     "type": "query",
-    "version": 313
+    "version": 314
   },
   "56fdfcf1-ca7c-4fd9-951d-e215ee26e404": {
     "rule_name": "Execution of an Unsigned Service",
@@ -5434,21 +5468,21 @@
   },
   "5700cb81-df44-46aa-a5d7-337798f53eb8": {
     "rule_name": "VNC (Virtual Network Computing) from the Internet",
-    "sha256": "65439f5e4fa7b0f4bbb310547d8239ea649d5818b5ac6338a7b358f2eb0c03ee",
+    "sha256": "5ee4cc1bef3bc0cbb466f51fc238d7ea3789de02607f24d664300a4cd08147f0",
     "type": "query",
-    "version": 105
+    "version": 106
   },
   "571afc56-5ed9-465d-a2a9-045f099f6e7e": {
     "rule_name": "Credential Dumping - Detected - Elastic Endgame",
-    "sha256": "8bab78d440c061852a74557b6d3192c69d78b18dd0cabb79ef54bf9ae6f27234",
+    "sha256": "cef2f25973f7650fc0b3c4e6d49eb118a5216965cb85cee1568ac3a5e26bb119",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "573f6e7a-7acf-4bcd-ad42-c4969124d3c0": {
     "rule_name": "Azure Virtual Network Device Modified or Deleted",
-    "sha256": "fe8f8cc7acb845230d488c2148d4c27351978ae3582a05be60a1d7373afa9762",
+    "sha256": "398d5eb8f8ee0c1a9ca69806e64a8879579ab03f3e2f5a29a66c0da240018ab2",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "577ec21e-56fe-4065-91d8-45eb8224fe77": {
     "min_stack_version": "8.14",
@@ -5488,22 +5522,22 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "DNS Global Query Block List Modified or Disabled",
-        "sha256": "fbf28db5104a48b0e0d2f1bab198d6d68917d37647526eb57c33227ecca28773",
+        "sha256": "7d36f22f3ea3b4008813322aadd11c5d337d890ad99892df41b2e3154c755ed8",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "DNS Global Query Block List Modified or Disabled",
-        "sha256": "6b33c63d553cab599384d2a06a3cbe2ce79ac5637431a647f3c0b0bd8930e497",
+        "sha256": "fdd70a684195301172c2093025954070437de67b7110b4c2fd82167df76f3b5d",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "DNS Global Query Block List Modified or Disabled",
-    "sha256": "566037aa998817fc0a251e782f43cec8f2037e67f0fdfe4fc54256563b8a8994",
+    "sha256": "c1df3f0030e17676949facaed1368a9f13c67cca442f5b94af0920ed85092de8",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "581add16-df76-42bb-af8e-c979bfb39a59": {
     "min_stack_version": "8.14",
@@ -5553,9 +5587,9 @@
   },
   "58ac2aa5-6718-427c-a845-5f3ac5af00ba": {
     "rule_name": "Zoom Meeting with no Passcode",
-    "sha256": "b3970e307a90b3715cd0032cccccfdf1b0a62c7e414d20462f6f5107916e4bff",
+    "sha256": "ccb0acf3cc1b30624083f57a468ae8f3d188ca69b2ae0551b5122b12e90e6b36",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "58bc134c-e8d2-4291-a552-b4b3e537c60b": {
     "rule_name": "Potential Lateral Tool Transfer via SMB Share",
@@ -5565,9 +5599,9 @@
   },
   "58c6d58b-a0d3-412d-b3b8-0981a9400607": {
     "rule_name": "Potential Privilege Escalation via InstallerFileTakeOver",
-    "sha256": "9bae02d3c566f254d62cde13db4662546fcab189c9f3296fa8c3eea79178eb13",
+    "sha256": "c2dfdcdc1b0d76b1a905b8e67a67d188594bb8b4665a8c1750ce8e92714325af",
     "type": "eql",
-    "version": 111
+    "version": 112
   },
   "5919988c-29e1-4908-83aa-1f087a838f63": {
     "rule_name": "File or Directory Deletion Command",
@@ -5577,27 +5611,27 @@
   },
   "5930658c-2107-4afc-91af-e0e55b7f7184": {
     "rule_name": "O365 Email Reported by User as Malware or Phish",
-    "sha256": "a384ae4e6ee0a0f14a297dd9980b3aae52fcba5a63e3fca63e28559480b62bef",
-    "type": "query",
-    "version": 206
-  },
-  "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed": {
-    "rule_name": "AWS CloudTrail Log Created",
-    "sha256": "04381b6679e1f47a0de7e904dda384c87aaf3b510c9aca6f2045b8f2c4014fa7",
+    "sha256": "81b57999573c8fb4a7a366594f25ae06a0af08d40dce604d87d7a8f30dd943fa",
     "type": "query",
     "version": 207
   },
+  "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed": {
+    "rule_name": "AWS CloudTrail Log Created",
+    "sha256": "57e2816be37db7fe8b97b74d890f5f1c173f9f98635f900fc0a239d93de116f9",
+    "type": "query",
+    "version": 208
+  },
   "59756272-1998-4b8c-be14-e287035c4d10": {
     "rule_name": "Unusual Linux User Discovery Activity",
-    "sha256": "ee20cd99bcb1d96c1b45a7497beed44d5f9a3ea2acd13f0bb8e35352cbf59909",
+    "sha256": "62cd203498ed5ec9c26690e7c2c202cf2cdb234c9be6a775889f5d2458744366",
     "type": "machine_learning",
-    "version": 105
+    "version": 106
   },
   "59bf26c2-bcbe-11ef-a215-f661ea17fbce": {
     "rule_name": "AWS S3 Unauthenticated Bucket Access by Rare Source",
-    "sha256": "5faad18f6e8089e38382a04e3ef367fc94f03c5bb03e1aacbdfdae133891e860",
+    "sha256": "c65dca5d2ab212399ddf5f197ae8f6b71543e67dc4c506edba0250e81a48ba75",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "5a138e2e-aec3-4240-9843-56825d0bc569": {
     "min_stack_version": "8.13",
@@ -5605,15 +5639,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "IPv4/IPv6 Forwarding Activity",
-        "sha256": "0ac95528a079d01b7adeaa69e09a6ce000a6e52cd17f4fc7984edb24bf715c66",
+        "sha256": "8662d51b058ba0aaa8beb626fa104c2c7f6ee6f1970db79c6ab2615a567e699f",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "IPv4/IPv6 Forwarding Activity",
-    "sha256": "98b7c643f9f9b010293863a5a9e79452dd6bd16f72b18e1c8c847b1baf6edfd8",
+    "sha256": "1cf2ab43dc77c7b8e03becd52f2882b3dc1844085e26351dda5f6b31bb609722",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "5a14d01d-7ac8-4545-914c-b687c2cf66b3": {
     "min_stack_version": "8.14",
@@ -5621,34 +5655,34 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface",
-        "sha256": "de3f257cc742ca2b940857157f38cb15c99e74a1a22250b9dff96d6e8a1685c4",
+        "sha256": "195101291410db100f83b2bbb0bb45a23a5d3c84f0b3cc59e3e80543531dd5e1",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface",
-        "sha256": "a58979585d4e2dba00ae2bf4cc63ae6bed5e961b9f7644c0dc3fa1cdc1f2a938",
+        "sha256": "2213291fff0bb1ba56efbcc8b9b3bbeca328b89b52cf3e419b4fb6e70936dad0",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface",
-    "sha256": "922c50914d6b49f38e49963069b5aded60978873160d1be2e5ac966b0f38d3fe",
+    "sha256": "0803f03287c0303a478d35d524621cf58ec5e09afe472fe968a33d05b1f8e025",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "5a3d5447-31c9-409a-aed1-72f9921594fd": {
     "rule_name": "Potential Reverse Shell via Java",
-    "sha256": "7679d1b0d0e253dc2747cdf1dff275208029db01cdbf4fd7e77f9070d56861a1",
+    "sha256": "9f4687f96c022e624c6f5414ecb77f6d8b9148dceb9137d3bf0bb37c294bd2e9",
     "type": "eql",
-    "version": 8
+    "version": 9
   },
   "5ab49127-b1b3-46e6-8a38-9e8512a2a363": {
     "rule_name": "ROT Encoded Python Script Execution",
-    "sha256": "c0274af6f64a052fd104039c8754ea7aa05eaadab769efc8a98bc62711b2b491",
+    "sha256": "797af136476a4575466ea7dad526fda9d5328930d8f9985a260e5e1177223225",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "5ae02ebc-a5de-4eac-afe6-c88de696477d": {
     "min_stack_version": "8.13",
@@ -5656,21 +5690,21 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Potential Chroot Container Escape via Mount",
-        "sha256": "b49bf35138ec9338b49af77beb42c3d6ec44d6901dd364fe7aac536e60dfcbfc",
+        "sha256": "bf4217022061a7456c301cffe1ab6dd6d9298a3c45e206c125c42667862de6e1",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Potential Chroot Container Escape via Mount",
-    "sha256": "22f95e8aa96442f2aaab2baa40a03a32f9a71ab839f014a32f9f57c2bf68d6f2",
+    "sha256": "efa24aa4e360509d77a32ce3f80aa988c50b5849bf0f3c2e8600efd49b6a384d",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc": {
     "rule_name": "Remote SSH Login Enabled via systemsetup Command",
-    "sha256": "b1baf6af7bac12181427143fe903673699b5df38a14f3a8617a90c981cf52058",
+    "sha256": "8a9322fcb0f59a2f5ade44ab323e0b057c6019500063a9e67db93eb954461718",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "5aee924b-6ceb-4633-980e-1bde8cdb40c5": {
     "min_stack_version": "8.14",
@@ -5697,15 +5731,15 @@
   },
   "5b03c9fb-9945-4d2f-9568-fd690fee3fba": {
     "rule_name": "Virtual Machine Fingerprinting",
-    "sha256": "bfc51d0f01ccf26b16f823ba658b02bf6e682d0262d9dfe410d1c9cb06d859c2",
+    "sha256": "6a40d4a3eb8956f0fa86900cd0f068813b708cf72355b20a006a4ae024884b63",
     "type": "query",
-    "version": 108
+    "version": 109
   },
   "5b06a27f-ad72-4499-91db-0c69667bffa5": {
     "rule_name": "SUID/SGUID Enumeration Detected",
-    "sha256": "ecb48f9b2113ef16a9cf28b12062a7336b1fc1183e11978fa97c5d28f733e894",
+    "sha256": "579398f581b46a408dd3248aa0e706c28ce608e3fcecb9296abc9d328e024c92",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "5b18eef4-842c-4b47-970f-f08d24004bde": {
     "min_stack_version": "8.13",
@@ -5713,15 +5747,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Suspicious which Enumeration",
-        "sha256": "5067ebbb2ae7642ec887f660253ec56fa569320fbf62652220280935c9bff570",
+        "sha256": "81bdb21ca450212add8a85c321bb3987998e8f5dada389fbc8a46fa1d740581c",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Suspicious which Enumeration",
-    "sha256": "73c8ca3902ddad43fb2ceb90daa245dc057f3c920067897050295d67a1394cbd",
+    "sha256": "31644856f49ffea6104635840c58566a40fbe5a81da84366f5eb33be25efe892",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "5b9eb30f-87d6-45f4-9289-2bf2024f0376": {
     "rule_name": "Potential Masquerading as Browser Process",
@@ -5735,41 +5769,41 @@
       "8.12": {
         "max_allowable_version": 213,
         "rule_name": "Suspicious PrintSpooler Service Executable File Creation",
-        "sha256": "f8b5d6b8dcd9ba7c0a8a5e3c777145a5ab964529eb766fbf5cab16a47349ead2",
+        "sha256": "35874a6b3415659603a51352ab4aafe03d8e2d816f25c4f343115687e555aa00",
         "type": "new_terms",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 313,
         "rule_name": "Suspicious PrintSpooler Service Executable File Creation",
-        "sha256": "91c753727cc93c11d0c14042e89f25f4662381aa6ed581df89352758ca0056f3",
+        "sha256": "5ca5d9dba9c3eda093b2a3b2260982c127108c3167436867c912cf29f5129f87",
         "type": "new_terms",
-        "version": 214
+        "version": 215
       }
     },
     "rule_name": "Suspicious PrintSpooler Service Executable File Creation",
-    "sha256": "aeec107590fee9b7eb50ce2c5790e91eebe4152e23c7a16c88cd8371f4e374b0",
+    "sha256": "4dcc839828bb5d7e479b5816322bbc8808ee054bc913c811cd9690d54c57ca6b",
     "type": "new_terms",
-    "version": 314
+    "version": 315
   },
   "5bda8597-69a6-4b9e-87a2-69a7c963ea83": {
     "min_stack_version": "8.13",
     "rule_name": "Boot File Copy",
-    "sha256": "30d90beef7fd3002ffb27eab0ea0dd20d3a7775ee4e6eb142d5351f9145fac50",
+    "sha256": "24d0894ed6959d5f54396c957e8dcd3de231026e473c753ef10c5c033f991857",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "5beaebc1-cc13-4bfc-9949-776f9e0dc318": {
     "rule_name": "AWS WAF Rule or Rule Group Deletion",
-    "sha256": "6c4d3ab01c67010c4dd017c06f34cc2bba3765dc79133e8d5ba8fb7ecd657aa0",
+    "sha256": "89f33201ad4d76858ce52afe371130935c8d2f202139ea266bd17c9ac2488519",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "5c351f54-4187-4ad8-abc8-29b0cfbef8b1": {
     "rule_name": "Process Capability Enumeration",
-    "sha256": "22e7a4474249251e7e0ff02b91956eefe3253c4dbffe219e41537c4fca33d8df",
+    "sha256": "b59cc8bfab61d96bcdff86bcf5c7a1b13b64354d821ae475efcf40a35b332a19",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "5c602cba-ae00-4488-845d-24de2b6d8055": {
     "min_stack_version": "8.14",
@@ -5777,15 +5811,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "PowerShell Script with Veeam Credential Access Capabilities",
-        "sha256": "c0587692912a44911b8bcee6cdac91e78ac6b0129e9fbb395e8b9c0381312ad0",
+        "sha256": "5ae470e75de9bdbb84070a55c7cfbd9143654a72f9e9193782aea6145b12fd1e",
         "type": "query",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "PowerShell Script with Veeam Credential Access Capabilities",
-    "sha256": "e76374e15f51af2dd0d683aacb95c40df7bb4ab2452ca64cab318aa20a1766a6",
+    "sha256": "d4ae42e3bddc23b1b5b75d60e725076a3baf37caeae03e0794a91fa47346aa02",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "5c6f4c58-b381-452a-8976-f1b1c6aa0def": {
     "min_stack_version": "8.14",
@@ -5799,9 +5833,9 @@
       }
     },
     "rule_name": "FirstTime Seen Account Performing DCSync",
-    "sha256": "60be180da0a4d8a02621f58482c7ddfc3b2fc4815bbd722097bef9ec5bfe45a8",
+    "sha256": "d4accae05fecc5956c2caf27bab5e9eb13b871713c8855c25c6a47bd44a0d2be",
     "type": "new_terms",
-    "version": 113
+    "version": 114
   },
   "5c81fc9d-1eae-437f-ba07-268472967013": {
     "rule_name": "Segfault Detected",
@@ -5815,27 +5849,27 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Pluggable Authentication Module (PAM) Creation in Unusual Directory",
-        "sha256": "c07bd3dc94f7395887a9d16a2c6986600519ec86ba8f4082f4c1c546be147907",
+        "sha256": "5236ec39f5b96c9f3b575a920dbd695b7473c5bafe7625e03799f60d559b28e9",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Pluggable Authentication Module (PAM) Creation in Unusual Directory",
-    "sha256": "58a78bbe94aa8e3ce22da6a4bbc47087b53a4e124ed72c30bb71e4c4ebfa89ed",
+    "sha256": "23f889cc4747d5ad5d505549b4301b18abb715f10d21b48a1c87dbd95cef2f29",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "5c895b4f-9133-4e68-9e23-59902175355c": {
     "rule_name": "Potential Meterpreter Reverse Shell",
-    "sha256": "d07f514f10110b37d711bf355d40833340fbbf7701ba0cc4db57f259713e2dba",
+    "sha256": "dac377b1d7e688c590f3961e984193d99e548ddf1fa5d9298d724d251cfb7b4b",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "5c983105-4681-46c3-9890-0c66d05e776b": {
     "rule_name": "Unusual Linux Process Discovery Activity",
-    "sha256": "f9a87ae54214bad3a060e755e979bde3234717dd912edb1867dd9bb0f3f658b1",
+    "sha256": "6699f13d1830f5c9e67d20ffe8e3c35f4cabefe9e630339c8541bdbdff752085",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0": {
     "min_stack_version": "8.13",
@@ -5843,15 +5877,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Potential Defense Evasion via PRoot",
-        "sha256": "74391c2ea26988cdbabaf1fe4da29601278aaa13c64140b557c38e53265b33e4",
+        "sha256": "5be300eea96d7d3fff01d8e2f1ce70318e82a027159669467454f10cf243e208",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Potential Defense Evasion via PRoot",
-    "sha256": "d3dc37d8bb5d0c604f5f739245d5529eada7a5b0873cbfd84c84f37337c57743",
+    "sha256": "20eb77ba6a8a8323188fa6281186aa530803e86930af2a51cb2fb2140ad57fcf",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "5cd55388-a19c-47c7-8ec4-f41656c2fded": {
     "min_stack_version": "8.14",
@@ -5859,15 +5893,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Outbound Scheduled Task Activity via PowerShell",
-        "sha256": "5ada5aa4950b558d35b6ee6b887c4c5d19357e656ab559a8be06723f99df0b80",
+        "sha256": "881e17596c2ce4e314625942adb04235a12e70f19501ddbf53391bfe02dd03f9",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Outbound Scheduled Task Activity via PowerShell",
-    "sha256": "7d3bf84b8bde799ef371d4a6327bf8f541afea0300cdbf24763d28eb8f8342b5",
+    "sha256": "9861068f16d7c13e90230fde674392101cfe9ae5e74dbda9522097093911536f",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "5cd8e1f7-0050-4afc-b2df-904e40b2f5ae": {
     "min_stack_version": "8.14",
@@ -5891,28 +5925,28 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Persistence via PowerShell profile",
-        "sha256": "63c2a0fb94471a31f7240d9055c159236c52f32dc1da1e3e4487dbf3479a6b60",
+        "sha256": "e2a9084a8e3062415cf21a33d22098b3e31cd354006e57075af67e820641af92",
         "type": "eql",
-        "version": 9
+        "version": 10
       },
       "8.13": {
         "max_allowable_version": 208,
         "rule_name": "Persistence via PowerShell profile",
-        "sha256": "bcfac59564d41ebcb539180ca3a3bf7ce87cc15eef7fe386b497fab430a67572",
+        "sha256": "0383a8c5a6705916613f80d301ca0dea35cf7ff7cb13b719320e19c6dfeaffb4",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Persistence via PowerShell profile",
-    "sha256": "f3fa333c7f1b7b2d1da2b134f2a3f535c02a04bbe1e29aea9a07f65dc3112f42",
+    "sha256": "0f950647d4f0916286902132be8dcaec3f65ee3132b998b43e7eeb93677cafe5",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "5d0265bf-dea9-41a9-92ad-48a8dcd05080": {
     "rule_name": "Persistence via Login or Logout Hook",
-    "sha256": "1c0e0922c06fa8aa81d5e8321d94552753e41e9f939f8cb35940afe5438945d8",
+    "sha256": "b8a59cdd32843855c38fac2f200184b85c2d6530489e471b8a4130406e8ec85b",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "5d1d6907-0747-4d5d-9b24-e4a18853dc0a": {
     "min_stack_version": "8.14",
@@ -5920,15 +5954,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Suspicious Execution via Scheduled Task",
-        "sha256": "8770d2c4c9b63e14c6650ff49d6189b56e44b26eb7c08a64542b185c65a01e75",
+        "sha256": "975967ec3e4989e05b906196e1492ea1f24ac1162211d54845e8c1f682036f71",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Suspicious Execution via Scheduled Task",
-    "sha256": "98c90d11775a22fd8b8841c192bba0357583dfff531656d7728cefb2a3cf68fb",
+    "sha256": "3b3ccd623ad35abe21a31e6f429265fff80ee4bb1cb27b4ca7360e556282bea8",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "5d676480-9655-4507-adc6-4eec311efff8": {
     "min_stack_version": "8.14",
@@ -5936,21 +5970,21 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Unsigned DLL loaded by DNS Service",
-        "sha256": "6cb0f50b9083f11e35a528ca1c9f073dcef46992d57b6a063637ff826dca43d7",
+        "sha256": "8f2d6fb941f3e9f2fe599164f806804b1b09b4c08131d79eb3e7ecaab5034c05",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Unsigned DLL loaded by DNS Service",
-    "sha256": "1bed4177a477d026c410cae36aa7cc8da677f5a62bab50fb6caced420d1dd57c",
+    "sha256": "0e908a21b5f00f708db56a1f494aafbe52a203ae6f332d5e4e763103aa53e03d",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "5d9f8cfc-0d03-443e-a167-2b0597ce0965": {
     "rule_name": "Suspicious Automator Workflows Execution",
-    "sha256": "8a91321d4c4824d08e1ec1d1f2db52ad985b859f4e5838169834aa4bbdfff906",
+    "sha256": "a1c17423de6e19c6f7cf178290eafc3cd6146dbbb850b2c6ac92c5826af80f6b",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "5e161522-2545-11ed-ac47-f661ea17fbce": {
     "rule_name": "Google Workspace 2SV Policy Disabled",
@@ -5964,21 +5998,21 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Memory Swap Modification",
-        "sha256": "87f23ecd1afbe1e17093f0f1d038a49132d433f0e99f842a2c1ea2070422022a",
+        "sha256": "d3233c88cf4a2b91daeca4e6247bb3758023b234d009f522b19223f87aeae20f",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Memory Swap Modification",
-    "sha256": "923afd5486608e70492a648b58298dd6b5e3a6e9dfea406822d0139d7e84a6f5",
+    "sha256": "5583dee02ed10b698537738686fdd5974f461d686e6b36f456a6eaf52a661fc2",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "5e552599-ddec-4e14-bad1-28aa42404388": {
     "rule_name": "Microsoft 365 Teams Guest Access Enabled",
-    "sha256": "92a0588bb516c3bf59cc84e1a9a07051d183c3a54df36ce698c176fe0a02d838",
+    "sha256": "3ebdea07f4ef0b08b17227bc1a2482fdf6678f10abcacd02c0a85dfb400a1501",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "5e87f165-45c2-4b80-bfa5-52822552c997": {
     "rule_name": "Potential PrintNightmare File Modification",
@@ -6018,15 +6052,15 @@
   },
   "5f3ab3ce-7b41-4168-a06a-68d2af8ebc88": {
     "rule_name": "Docker Escape via Nsenter",
-    "sha256": "11c34c854e425416671771fda4ebe364a729e7203d287c32837120c5426ec678",
+    "sha256": "453ade8392dd064ac66baaea865224304bffe2e8afac34c7811e8776d5989843",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "60884af6-f553-4a6c-af13-300047455491": {
     "rule_name": "Azure Command Execution on Virtual Machine",
-    "sha256": "7e3e549fc0541f65e9d0ee9df09e5453f76574a9d8b90a03c5b8f905ebe6ce12",
+    "sha256": "75603330eba99f8199e1a118a71eca46d7c50d35b4cd605c1dfc199a15028b4b",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "60b6b72f-0fbc-47e7-9895-9ba7627a8b50": {
     "rule_name": "Azure Service Principal Addition",
@@ -6036,9 +6070,9 @@
   },
   "60f3adec-1df9-4104-9c75-b97d9f078b25": {
     "rule_name": "Microsoft 365 Exchange DLP Policy Removed",
-    "sha256": "807f4b28328d1f7ad9211882227887a21f3d288a8ad35dd75b1e3578f37251e9",
+    "sha256": "083349bd92f7b6c0a756f5a62567cd8c5a5bc5daadf1eece6de8e8e79978a41e",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "610949a1-312f-4e04-bb55-3a79b8c95267": {
     "min_stack_version": "8.14",
@@ -6078,15 +6112,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Interactive Logon by an Unusual Process",
-        "sha256": "bf2b28b3ee264bd7593059a42fb95b93b34b79c0296e85ea353384200ca44764",
+        "sha256": "aa2c30439a09a0821ce30bb48e9a7ded35e0cd590c0acbca87390d10683bc5cc",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Interactive Logon by an Unusual Process",
-    "sha256": "1baf1fef6bba99c5ccdc2528a1cf37b50b5fa046a869241e7957bc24910a38d2",
+    "sha256": "1813675633a8a8db3f036f1276035eb83d74c80d29e7e67aa2bf1099ab057778",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "61ac3638-40a3-44b2-855a-985636ca985e": {
     "min_stack_version": "8.14",
@@ -6122,9 +6156,9 @@
       }
     },
     "rule_name": "AdminSDHolder SDProp Exclusion Added",
-    "sha256": "0025f93aa161653a794f9a26065ea5e0cc28cde56f00267df2baedba016c4e6e",
+    "sha256": "3b4775c89f9910cc69fdfc6e3ba815ed3da59f85eae5f23cfba94d923518152d",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "621e92b6-7e54-11ee-bdc0-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -6132,22 +6166,22 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Multiple Okta Sessions Detected for a Single User",
-        "sha256": "2a4625ab52d97815dbf70120074de6b41c8cfa8646f7fbdf64a43f2154a56dba",
+        "sha256": "f472608d534083bdf5f50a92951a81599a2b3dce40e413de960019aa9f7435f5",
         "type": "threshold",
-        "version": 5
+        "version": 6
       },
       "8.14": {
         "max_allowable_version": 205,
         "rule_name": "Multiple Okta Sessions Detected for a Single User",
-        "sha256": "2a4625ab52d97815dbf70120074de6b41c8cfa8646f7fbdf64a43f2154a56dba",
+        "sha256": "aee13957217142915e900a15702f1683ba54b1c488d13e92b73e3d8e866779df",
         "type": "threshold",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Multiple Okta Sessions Detected for a Single User",
-    "sha256": "4d6ac1ca8a19590fa0ac7866fe9b56931d6d7515611ebf4cd25c8ee1ecedfa95",
+    "sha256": "12e0d0b72f404e2086dcd9c36311a6eeb68c65979ce775064dd5c6ea06953106",
     "type": "threshold",
-    "version": 207
+    "version": 208
   },
   "622ecb68-fa81-4601-90b5-f8cd661e4520": {
     "min_stack_version": "8.14",
@@ -6155,15 +6189,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Incoming DCOM Lateral Movement via MSHTA",
-        "sha256": "1c55d7f1db000719100662727934048ed282c6ca81a2401c68eb6de8edb1d08e",
+        "sha256": "facf2b369187ce8da1649950be8b3e38f3c4c1ec81f490fa646827baf5d2427a",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Incoming DCOM Lateral Movement via MSHTA",
-    "sha256": "469e57d1084b2101124729bd1a24f0d0de9a3ba693867395cb5e2b2747429009",
+    "sha256": "2b2a1dca315b2ba3e10a64bdd41f6a67b6cb64924ac2ef44668a7ec80657d775",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "627374ab-7080-4e4d-8316-bef1122444af": {
     "min_stack_version": "8.13",
@@ -6171,15 +6205,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Private Key Searching Activity",
-        "sha256": "cfb8fb1ac5550969ade51696c2cce707ef17cb2ba835b59dde324128fe49a3da",
+        "sha256": "d14cd033b213dd2aa22e191e4316a3e9399efede1e2a54e6b84c28fc98e43248",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Private Key Searching Activity",
-    "sha256": "6a4cafcee7a10b376ff76157de5011d5f20df6e1ffda15016ffb5030b599d4d2",
+    "sha256": "5519c882a79e550a82c6cdf78d433feb500b6bd32ef8f72913f9df44a00f8a9f",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "62a70f6f-3c37-43df-a556-f64fa475fba2": {
     "min_stack_version": "8.14",
@@ -6193,39 +6227,46 @@
       }
     },
     "rule_name": "Account Configured with Never-Expiring Password",
-    "sha256": "d1a41572216c35257141c8fde9abe70f1cc185ba00383bd8a0a180ce1ce6cbc6",
-    "type": "query",
-    "version": 211
+    "sha256": "fbd13d6ec521fef8ffeaf94e8c126b6c3d610a7440b32fdbec53435987e3e9ea",
+    "type": "eql",
+    "version": 212
   },
   "62b68eb2-1e47-4da7-85b6-8f478db5b272": {
     "rule_name": "Potential Non-Standard Port HTTP/HTTPS connection",
-    "sha256": "5a3fd12529c9c80182c6867d42fd64119b65ce06f0106fb6c46537b9f536d9ed",
+    "sha256": "3a95ccdc273d7d2af093ab0c0445370fc790147be6d43d2a2edb2b9b3cdc82e0",
     "type": "eql",
-    "version": 5
+    "version": 6
+  },
+  "63153282-12da-415f-bad8-c60c9b36cbe3": {
+    "min_stack_version": "8.13",
+    "rule_name": "Process Backgrounded by Unusual Parent",
+    "sha256": "208219618907f9af2a97a782d360496106265946d0d6b37aa5eb4369f2bd210a",
+    "type": "new_terms",
+    "version": 1
   },
   "63431796-f813-43af-820b-492ee2efec8e": {
     "rule_name": "Network Connection Initiated by SSHD Child Process",
-    "sha256": "bf0ca3359e6f32c685d719787f6adfd48d96993c3b01c42812464e6aaed5aa1c",
+    "sha256": "9bc024ebd7d20dd7d23abc9dbe71bf043edaab5d7afc79551d0da709c4fe821e",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "63c05204-339a-11ed-a261-0242ac120002": {
     "rule_name": "Kubernetes Suspicious Assignment of Controller Service Account",
-    "sha256": "c3c4f5b5422708679b68f0f2fd71e860e9abfdc466e25b9cd35498d8a45cbdab",
+    "sha256": "53a873d39857e58ee6e4fc5b7399e895bb152e41c1ab935663837628267e4ec7",
     "type": "query",
-    "version": 6
+    "version": 7
   },
   "63c056a0-339a-11ed-a261-0242ac120002": {
     "rule_name": "Kubernetes Denied Service Account Request",
-    "sha256": "c04f7a46cbbd448139cfef70f2eaf9331faae7a4a1ab9a4a721463034e513e86",
+    "sha256": "c8d9810184ef49e7246335b18a3ee60393d89ef7ce8f918026a59c34bcc38064",
     "type": "query",
-    "version": 5
+    "version": 6
   },
   "63c057cc-339a-11ed-a261-0242ac120002": {
     "rule_name": "Kubernetes Anonymous Request Authorized",
-    "sha256": "124c7243234a6880e622f6d2f811edd502e2406e6c96ad7066a7306794ced4fd",
+    "sha256": "17099608b9a995ff056b49ffa5be61ac5b2aa1b25812fa9ca68294450e48a050",
     "type": "query",
-    "version": 6
+    "version": 7
   },
   "63e381a6-0ffe-4afb-9a26-72a59ad16d7b": {
     "rule_name": "Sensitive Registry Hive Access via RegBack",
@@ -6239,21 +6280,21 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Network Connection via Signed Binary",
-        "sha256": "a46c6b82143566c72c64c8288c549942594363613f856106a1b1e22b529caf49",
+        "sha256": "66192fcde84de1d9b0e809854015279f1016447b2e2de3d0f3f81aad88df91bf",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Network Connection via Signed Binary",
-    "sha256": "13ab27af642b6257541d2f7dd40e674512caf3615983668154c3cb69ce92212b",
+    "sha256": "dbff3c36a4ce01428dd306c519a48b7816f503173ba63ff090c31c9719748cc6",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "640f79d1-571d-4f96-a9af-1194fc8cf763": {
     "rule_name": "Dynamic Linker Creation or Modification",
-    "sha256": "17626f3f8f0d9413631123ff3710cc6bbd765919f591f8cc4cb0b3ed798fd72d",
+    "sha256": "9d1158eb547e4cbef8792d8e21f04e26ed8f8e6a4205bc87f557901520583a3d",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "647fc812-7996-4795-8869-9c4ea595fe88": {
     "rule_name": "Anomalous Process For a Linux Population",
@@ -6263,15 +6304,15 @@
   },
   "6482255d-f468-45ea-a5b3-d3a7de1331ae": {
     "rule_name": "Modification of Safari Settings via Defaults Command",
-    "sha256": "d6366ceb829546de9ee9785b9be89d03ee27409be5ce45526d3c6041f107f012",
+    "sha256": "83a660084e9cace9aebc80260a7b32dde9583c295a54c288ca8cd2bde4522611",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "64cfca9e-0f6f-4048-8251-9ec56a055e9e": {
     "rule_name": "Network Connection via Recently Compiled Executable",
-    "sha256": "c2a1edb00dafb062774f8a65b34f761d2c5332b1165d4c2282dab5acdd7baeac",
+    "sha256": "2077b595953101f3fa176295f9adac0453ae759f4adfda777ee54f9285fb893b",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "6506c9fd-229e-4722-8f0f-69be759afd2a": {
     "rule_name": "Potential PrintNightmare Exploit Registry Modification",
@@ -6285,40 +6326,40 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "MsiExec Service Child Process With Network Connection",
-        "sha256": "861bc19c8f4196effc1ddc59a6929d979c132b0e3a3507da3f10ac1d760a1287",
+        "sha256": "0dec5c209de4432366d522c8479caa203fc027282bbca7df21df60a9a9ff41e1",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "MsiExec Service Child Process With Network Connection",
-        "sha256": "41602b6a702f894fa85aeda894b432bf97541e7a789da640b09d1a6ccb020920",
+        "sha256": "fae229cedfaca7b7e8f9a7e40a573cc0933889bf6fd0a9add01469c2f12bd0bd",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "MsiExec Service Child Process With Network Connection",
-    "sha256": "f777f01e40e9050b0c782526949a439d855433b0f63892411d709ce8cda391d4",
+    "sha256": "159c5871496b2240dc1edfc09db683fb7932c924589e736eb32c5a80fd21b0a7",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "65f9bccd-510b-40df-8263-334f03174fed": {
     "rule_name": "Kubernetes Exposed Service Created With Type NodePort",
-    "sha256": "06a18e9f45ffe718b0156f37a7f5dc289078a2410a0e6ecb968b500a0e55378e",
+    "sha256": "5ba81546094d936ec84995fbcb3e17bf792328c2426d692c1d219cb256fba423",
     "type": "query",
-    "version": 203
+    "version": 204
   },
   "661545b4-1a90-4f45-85ce-2ebd7c6a15d0": {
     "rule_name": "Attempt to Mount SMB Share via Command Line",
-    "sha256": "2c9e3ab0668460f3f7e260f9353b575c300c84e6f8cded54fc5d21d659f4dbc4",
+    "sha256": "6883edba26e4283cdfdd6ae341ed445cd67e51d20dc15f1fe106514a29c07af3",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "6641a5af-fb7e-487a-adc4-9e6503365318": {
     "rule_name": "Suspicious Termination of ESXI Process",
-    "sha256": "fded063447d8a8cf285be279a1620dacabff131d93f8fe4836a029e9fedf3ce2",
+    "sha256": "12e2cdafd4870927e64b1a906bbd4a927ea681570396c184a54f119486371411",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "6649e656-6f85-11ef-8876-f661ea17fbcc": {
     "min_stack_version": "8.15",
@@ -6326,22 +6367,22 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials",
-        "sha256": "e69ee03fc010f4a8437a4f96b609e58a06e6818ab1fd78adaae4882647086576",
+        "sha256": "45313bcc54d11c7433f8c8ef41f60e3119084e324e71751db6bb9fb549a3f1b4",
         "type": "new_terms",
-        "version": 4
+        "version": 5
       },
       "8.14": {
         "max_allowable_version": 204,
         "rule_name": "Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials",
-        "sha256": "e69ee03fc010f4a8437a4f96b609e58a06e6818ab1fd78adaae4882647086576",
+        "sha256": "45313bcc54d11c7433f8c8ef41f60e3119084e324e71751db6bb9fb549a3f1b4",
         "type": "new_terms",
-        "version": 105
+        "version": 106
       }
     },
     "rule_name": "Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials",
-    "sha256": "adcbaa2beb059aabf96136315cfbe4630927b47551e9f53b583a61d7090ba20d",
+    "sha256": "b8bb1b1e0023c2ce2967ad5ecc17c016a9de356e9f27d2e9f33c5ba979e7801b",
     "type": "new_terms",
-    "version": 205
+    "version": 206
   },
   "665e7a4f-c58e-4fc6-bc83-87a7572670ac": {
     "min_stack_version": "8.14",
@@ -6349,27 +6390,27 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "WebServer Access Logs Deleted",
-        "sha256": "3d487bb5d79f8850a52e52a4d8158c8d8fd68de886f1709be2af9495356e8977",
+        "sha256": "3d41e0a751de0eefc517ae323b3602930bdfa24fbf61b7c15235e4be117511ac",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "WebServer Access Logs Deleted",
-    "sha256": "615a81cd545877582b84f8a6524858b3762c49019fa6fc3286e441330c854938",
+    "sha256": "c437c24eaca8d8d4b1fbd92c21ca0f8dd61115f3a64e0c02f1e23aa0e428060f",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d": {
     "rule_name": "Potential Successful Linux FTP Brute Force Attack Detected",
-    "sha256": "9727c97648fb4b3afac9d4f9c9f0004fc5c2c23794cdd3be99f8df2b6ba1192a",
+    "sha256": "f8282a2d5173fd7e6fde9595c6efa24f5ebe48767db9981ec5a6cadffcfcf341",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "66883649-f908-4a5b-a1e0-54090a1d3a32": {
     "rule_name": "Connection to Commonly Abused Web Services",
-    "sha256": "6ee19e30f1b9b03cb860b685a9b64b35926db4749f7f4bec889b9061a34dd99f",
+    "sha256": "676676fdba05827386bf901a05e1f8335bbe5042bc52bc54c688eb0aac55b715",
     "type": "eql",
-    "version": 116
+    "version": 117
   },
   "66c058f3-99f4-4d18-952b-43348f2577a0": {
     "min_stack_version": "8.13",
@@ -6377,21 +6418,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Linux Process Hooking via GDB",
-        "sha256": "fbf357ed1d47b111ab6c612f8c15fd075755ac177461906e07824d7a0df4061d",
+        "sha256": "d6069d2128de9e65240d1c2a03f27f397f632fbdb78102892e58b51e395c942a",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Linux Process Hooking via GDB",
-    "sha256": "233c3166926ca81a15eeadc2bbe25b0f37ced7d272398ae6ba062b5f21883786",
+    "sha256": "102f289cddaa0bfdaa48642008df6ac4c7ffe2be9cc0d5ab335ec0647d841c6d",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "66da12b1-ac83-40eb-814c-07ed1d82b7b9": {
     "rule_name": "Suspicious macOS MS Office Child Process",
-    "sha256": "a39e945c3402e4c0c2dbb298ac6967a111eed708c37dc104c0883a65040b4115",
+    "sha256": "e35261396a28f58844455d18ffd0bcc2c385ca3960845c6db9f87949bc561fb3",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "670b3b5a-35e5-42db-bd36-6c5b9b4b7313": {
     "min_stack_version": "8.14",
@@ -6399,15 +6440,15 @@
       "8.12": {
         "max_allowable_version": 112,
         "rule_name": "Modification of the msPKIAccountCredentials",
-        "sha256": "d53d5a4467e47eb48356c3b13a7d5a888133b68942c45901923d5d26b6a21804",
+        "sha256": "71980b7e4a7ca43713bfa72cd0160821533b13c24e3fa1d0e645a42eec4f8512",
         "type": "query",
-        "version": 13
+        "version": 14
       }
     },
     "rule_name": "Modification of the msPKIAccountCredentials",
-    "sha256": "dc7f9e08e370facf03fd788985647ead45419455fbd6e63b7c489088770b941b",
+    "sha256": "1b9b6777a50eef6af6496d2bc9338d04c6b74efbbc726b1cae58177d40ed8b92",
     "type": "query",
-    "version": 113
+    "version": 114
   },
   "6731fbf2-8f28-49ed-9ab9-9a918ceb5a45": {
     "min_stack_version": "8.15",
@@ -6415,28 +6456,28 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Modify an Okta Policy",
-        "sha256": "b6e97191c4de2f2e5ddb2ad2426d48f084ef3a9096a0593590dd4bf268ef7a48",
+        "sha256": "5f3b2cab91a23497765bc0fae4150faf15cabcee773619d90db0cd3edbdb1473",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Modify an Okta Policy",
-        "sha256": "b6e97191c4de2f2e5ddb2ad2426d48f084ef3a9096a0593590dd4bf268ef7a48",
+        "sha256": "5f3b2cab91a23497765bc0fae4150faf15cabcee773619d90db0cd3edbdb1473",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Modify an Okta Policy",
-    "sha256": "391ca8b8d0dd19a954d1ac1c6117a4872d96d26fecde5c6fae0235674ac4c876",
+    "sha256": "79a56d12f5cfae0778882f6215f3767e744601b2d0f0183fa71a191bc5d9a8c4",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "675239ea-c1bc-4467-a6d3-b9e2cc7f676d": {
     "rule_name": "O365 Mailbox Audit Logging Bypass",
-    "sha256": "a61d567175526ad5bc735b093f276d0725a0ca9784d8b72754091e0b9abf70bb",
+    "sha256": "f899b24ce14bb0d0e1c223537cd020b2b65c7b71ad97b87fd5359b89e6bd2e2b",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7": {
     "min_stack_version": "8.15",
@@ -6444,22 +6485,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Revoke Okta API Token",
-        "sha256": "0c69c152fc76613c96c79e36913708ea34f396735cc588e6ad49a07839524a93",
+        "sha256": "2beaa220e872f7c47a050dd650ebe4576eafc89a94944115406a4f6b6692a213",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Revoke Okta API Token",
-        "sha256": "0c69c152fc76613c96c79e36913708ea34f396735cc588e6ad49a07839524a93",
+        "sha256": "2beaa220e872f7c47a050dd650ebe4576eafc89a94944115406a4f6b6692a213",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Revoke Okta API Token",
-    "sha256": "ebbf273668b9ef832b26d92e659fded91a08edff772f6a8634ed0197355161f7",
+    "sha256": "33e8c27c30a851ee7f9d49ed14bb20f1cfb5d370320db326fbfffb9c7b855b63",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "67a9beba-830d-4035-bfe8-40b7e28f8ac4": {
     "rule_name": "SMTP to the Internet",
@@ -6485,28 +6526,28 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Image File Execution Options Injection",
-        "sha256": "4cd0be97857d8107806320934a41077bc479799bc584f29bf9c272ef1159fdf3",
+        "sha256": "8107c66fd0a677b8966bf0f40409dfdac75050d7a2372a8e4ba10ce0350e6dfd",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Image File Execution Options Injection",
-        "sha256": "9cd61cbd2e186a7e79c84c63453170d959f8a17ba7f17226d7b751d3eb3401a0",
+        "sha256": "2eb29b66dbef8063acbd04479aaeb1f14fc4d5f7235afe9076fdfc86d199e837",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Image File Execution Options Injection",
-    "sha256": "a0e0e9db739a9599f432f5b67c38f79f2d78548a4048ada364cc2a77c63ad808",
+    "sha256": "bebbfc9c058cfc51931d5709b857995da179d43ad8e786073c42d4d74c29ef69",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "684554fc-0777-47ce-8c9b-3d01f198d7f8": {
     "rule_name": "New or Modified Federation Domain",
-    "sha256": "63bfcc3ca67c6279f1ed85c444ec4e840c389f3695e4228ed07f322caf108344",
+    "sha256": "0c327149e5c49e9161bd8a1ef2fb8bbe117febb4c86c9efcaab8a6dc5890205a",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "6885d2ae-e008-4762-b98a-e8e1cd3a81e9": {
     "min_stack_version": "8.15",
@@ -6514,22 +6555,22 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Okta ThreatInsight Threat Suspected Promotion",
-        "sha256": "82e79c7b28c004e1294491aede3c75647ae912425ed24c651c009748c8d7cd6f",
+        "sha256": "465ed6fbfaa4576c8e9945c4d9ae53d4c2bcee360bb998f6c0ba5454d2c5a4bd",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Okta ThreatInsight Threat Suspected Promotion",
-        "sha256": "82e79c7b28c004e1294491aede3c75647ae912425ed24c651c009748c8d7cd6f",
+        "sha256": "465ed6fbfaa4576c8e9945c4d9ae53d4c2bcee360bb998f6c0ba5454d2c5a4bd",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Okta ThreatInsight Threat Suspected Promotion",
-    "sha256": "1f980273037b0848fed3861a25a250eff82adc719350a67dc34aaa61565776ac",
+    "sha256": "e40176c9634f6d0f324b5be9bf2cfae0370f3d8fc01188d10e54e5684d5fbbaf",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "68921d85-d0dc-48b3-865f-43291ca2c4f2": {
     "min_stack_version": "8.14",
@@ -6537,22 +6578,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Persistence via TelemetryController Scheduled Task Hijack",
-        "sha256": "aea25737ded0865363c221c0d1752131a0e908cbb4968ff2138d90d22cb790f1",
+        "sha256": "d89ab2b28fdd4a4d0ad8ce943d5b320e1978c3ccde5d83d44424b7aa9e1bea55",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Persistence via TelemetryController Scheduled Task Hijack",
-        "sha256": "5ea5116cd208e91c51260783d73f21acff4cc3285956fefc376e9fae3941f1b9",
+        "sha256": "6c476da86e9b4676c87675514ef346fe09280a8911de64c826ab5696fc9a515c",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Persistence via TelemetryController Scheduled Task Hijack",
-    "sha256": "ae80e6eef7f02f152d24f72778eb22b6f998fffe08710ced5a60d17513f2ba50",
+    "sha256": "eb1bb445ec3e2abbd15d674c1b44e5304446e52f281eb18ca65cb039745c82de",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "68994a6c-c7ba-4e82-b476-26a26877adf6": {
     "rule_name": "Google Workspace Admin Role Assigned to a User",
@@ -6566,15 +6607,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Scheduled Task Created by a Windows Script",
-        "sha256": "4bd38dec94cb3868fe998ecf73e90de54d119a585ab9bed8788b9ddd7f43fc07",
+        "sha256": "a55f600e7c4e20a4be4404040ef2bc40bd6288c5aa54fc3a6d52c192f117858e",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Scheduled Task Created by a Windows Script",
-    "sha256": "bb5ce1fe0201d211c3e0ee4e797372019294920771fb9be33e2e03799c925f41",
+    "sha256": "c0988d5971ae4b85ecac42dfbe57eb1514ddc1c13df5f2bba07ca1f2097e2414",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "68a7a5a5-a2fc-4a76-ba9f-26849de881b4": {
     "rule_name": "AWS CloudWatch Log Group Deletion",
@@ -6588,15 +6629,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Suspicious Access to LDAP Attributes",
-        "sha256": "10e88814957853e67c86294608c1f7ca56213481a2da75dd1c2ef998722a8bef",
+        "sha256": "5af182ae30ce25b660aec32433ead1ec5bb2caa3ebb06fc72801ac367d19014a",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Suspicious Access to LDAP Attributes",
-    "sha256": "ea3607c104e47097033fed5ea9538819d7ee0e258c4956660fe6bdb792e9e9c4",
+    "sha256": "e7daf2e718a482222bdf0efce8b58bd0b54b5ad6697d3b9c492962fd802e79a8",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "68c5c9d1-38e5-48bb-b1b2-8b5951d39738": {
     "rule_name": "AWS RDS DB Snapshot Created",
@@ -6610,28 +6651,28 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "UAC Bypass via ICMLuaUtil Elevated COM Interface",
-        "sha256": "e54698612562724862eabf289b6a0256473aa6af882b84aa9a4fdc520b15c22e",
+        "sha256": "88f491fbc91172a9ce530e464d3e41d098720ae427782544b68895129cdc1564",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "UAC Bypass via ICMLuaUtil Elevated COM Interface",
-    "sha256": "d9f1796c6d6ad026fc2376b376520d5553dcbd8c64035bb1e86132a90634d94c",
+    "sha256": "dd1cccfa31ef19b5a08923452387349ef94bd64771d07f0bea725ec4a9d462f8",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "6951f15e-533c-4a60-8014-a3c3ab851a1b": {
     "rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion",
-    "sha256": "6c3939d29a97cd2645ecc292c9f864da41ba0b3d159eec992c7ef6dec115d08e",
+    "sha256": "9111baa04124fb4545052164f1f94445a22b38269c10ddf9433bccd3112f7b0b",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "696015ef-718e-40ff-ac4a-cc2ba88dbeeb": {
     "min_stack_version": "8.13",
     "rule_name": "AWS IAM User Created Access Keys For Another User",
-    "sha256": "c0b79735104a736c418ffcbe21e0292334ad5d5ed9c425c75d5d0aaad52463f0",
+    "sha256": "6f69dc6e309b86b281bd3f02594a03d86ba15d5835011a2b37a7ce21f3da291d",
     "type": "esql",
-    "version": 5
+    "version": 6
   },
   "699e9fdb-b77c-4c01-995c-1c15019b9c43": {
     "rule_name": "Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match",
@@ -6641,9 +6682,9 @@
   },
   "69c116bb-d86f-48b0-857d-3648511a6cac": {
     "rule_name": "Suspicious rc.local Error Message",
-    "sha256": "5ca0e055dc47c8c359d83d3c42388f2d1da1c8bb7fd5b309f29e81d5e4d767d5",
+    "sha256": "bd61c67f25dedf7bbc88efd6e7088a4f24faa27595c5ec46bfcbdfef30126b78",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "69c251fb-a5d6-4035-b5ec-40438bd829ff": {
     "min_stack_version": "8.14",
@@ -6670,9 +6711,9 @@
   },
   "69c420e8-6c9e-4d28-86c0-8a2be2d1e78c": {
     "rule_name": "AWS IAM Password Recovery Requested",
-    "sha256": "a1e54060fd73ea81b4a91323553b6cdec9bd5fb0b973ef8201983c73b45ac3df",
+    "sha256": "e2ba77f3b79dada7823d3ab325dc40c902b56e2272d29bc671c218bf23de24ff",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "6a058ed6-4e9f-49f3-8f8e-f32165ae7ebf": {
     "min_stack_version": "8.13",
@@ -6680,21 +6721,21 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Attempt to Disable Auditd Service",
-        "sha256": "18dfc5c1f6dcffb90d7eccf1b9512ec335538d410a838cd95c25f0ba6788fc7f",
+        "sha256": "f5fa9bfd7d9d2f03fb2e6f1b264a7b0f0f433bfb3953f27bed2afda53a7af098",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Attempt to Disable Auditd Service",
-    "sha256": "825e810e08bb39ba58fd1dc50b36b28f4128e5448e6061670a62b7274acc3d4a",
+    "sha256": "a21ae8ad2d9a9aa7f634479e7b2fdea05a56714d0e14c6541044895377b4f628",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "6a309864-fc3f-11ee-b8cc-f661ea17fbce": {
     "rule_name": "EC2 AMI Shared with Another Account",
-    "sha256": "0c4ef4f51a8579747372ea43f8369add1855a2c4ca49c0059a91aca3c86b15e1",
+    "sha256": "7f27abffb5aef9aadc163768a1f49184de75aebae83c4a7addfa275d9395699a",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7": {
     "min_stack_version": "8.14",
@@ -6702,22 +6743,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Unusual Service Host Child Process - Childless Service",
-        "sha256": "0cbf30f69775dd636ba9c9be86e859682567566370db71ea6b1ebb0b4d69b38d",
+        "sha256": "5f2f1310bff01d3a4c1ca2605ab01c632f85b21d4078a06cb88c4ffeabc174ff",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Unusual Service Host Child Process - Childless Service",
-        "sha256": "a5aca0cae7c3d4e2af72e551b196aa734185edb840e64a44250875f56954f40e",
+        "sha256": "0b7fffd5409c0d916c6b441f0f6eb2c95550d8c5c9d74192d312b7ec442372ac",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Unusual Service Host Child Process - Childless Service",
-    "sha256": "43459eeea6bab6c7fd87826c312985fcadb070763b879b2c8918b3cec2435895",
+    "sha256": "f463a7fe6e3b83f613bbd5fe19c3341fc1281b264a8b32289a081c9e9f5748cf",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "6aace640-e631-4870-ba8e-5fdda09325db": {
     "min_stack_version": "8.14",
@@ -6748,21 +6789,21 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Suspicious Utility Launched via ProxyChains",
-        "sha256": "d905f66dbe947bfcc9537eb0ce37abd9f10bf4effcffc43e454399feec107fb2",
+        "sha256": "1c1d57466f2540ce62774922d5711359a9650bd523baf98fa3d13d5c17151881",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Suspicious Utility Launched via ProxyChains",
-    "sha256": "8bc0cdc7893a5a1bbedcaaed4829fcf58e1a1c074dba0e0572f917408f4012f5",
+    "sha256": "4b44cff5ea71dfe44a694925ca874673be82adc62e7000b867108002baa8c6ba",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "6b84d470-9036-4cc0-a27c-6d90bbfe81ab": {
     "rule_name": "Sensitive Files Compression",
-    "sha256": "a50308d629258169646a68897f01fed70056c172b984b4d7b643f78da9835e50",
+    "sha256": "09e49424ce202fe6c5b9e7f31510da79059a0617231c4c0022d2c1825ff55f8c",
     "type": "new_terms",
-    "version": 208
+    "version": 209
   },
   "6bed021a-0afb-461c-acbe-ffdb9574d3f3": {
     "min_stack_version": "8.14",
@@ -6770,21 +6811,21 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Remote Computer Account DnsHostName Update",
-        "sha256": "a51928cc4f489accb73c5623006f11d187ddfced85856c1753810c11a3e6ad96",
+        "sha256": "35a97fde08022de5eb9913eb1b86dc35df3e225ffdf4871c7880402ab13a1c20",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Remote Computer Account DnsHostName Update",
-    "sha256": "81dd8799d02ef1ea7d54b9def9a1ab5cddb29910c2a88f978b310fc8b0b4b232",
+    "sha256": "60d1fc76b949a4e86b9d41bd1ed2f51acc26f54957efb24581f61db6c674ab23",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "6c6bb7ea-0636-44ca-b541-201478ef6b50": {
     "rule_name": "Container Management Utility Run Inside A Container",
-    "sha256": "34ba8d894c34042f9a4c326daee9871fc209a1e209058b9f6a0f8ad30eeec04d",
+    "sha256": "d66c939dc799f05fd9549a603ff1d567af4287f8a2e3c0cde5dac918e7575c8e",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "6cd1779c-560f-4b68-a8f1-11009b27fe63": {
     "min_stack_version": "8.14",
@@ -6792,22 +6833,22 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Microsoft Exchange Server UM Writing Suspicious Files",
-        "sha256": "304d7c35a3c501afafb6d576d39db8a71ffa761de1d2e4ea5cf2ef4937b103ca",
+        "sha256": "545b3d224a0f1f8ebeb0d9f6ca6077c60c57b650d6a3daa51b4a8b30de55da39",
         "type": "eql",
-        "version": 108
+        "version": 109
       },
       "8.13": {
         "max_allowable_version": 307,
         "rule_name": "Microsoft Exchange Server UM Writing Suspicious Files",
-        "sha256": "5c11225cdbbc4109678a5ed167332604297fd7074668973d0b0112b3b4052f3a",
+        "sha256": "1b469660f4b28888121b5610c6034c3b0a309f63debe06bd347750f423362cf6",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Microsoft Exchange Server UM Writing Suspicious Files",
-    "sha256": "2fb47f8769b5103eed7d0e994a27d88daa89b306a570f96a16b4a7143462ea24",
+    "sha256": "7d551332f1288a1e8d53bccfab142a72143c5e61a950b05be6f4f8711ba883c5",
     "type": "eql",
-    "version": 308
+    "version": 309
   },
   "6cea88e4-6ce2-4238-9981-a54c140d6336": {
     "min_stack_version": "8.13",
@@ -6837,21 +6878,21 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Unusual Process For a Windows Host",
-        "sha256": "4223306f5dfb909d0740513fea9760aef024d21d749079f1c925795c4595c203",
+        "sha256": "a84737464ef6658f7587d12e88f77356e079d797986616813ffb6be47e2abaa0",
         "type": "machine_learning",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Unusual Process For a Windows Host",
-    "sha256": "76043082e1635afa431a0b6ffd9156292fcec2cb34e12c1d3d5f8a4ac354c8da",
+    "sha256": "557a4432fcdb67fea0e8dd2558d19664cf507405b6db1317a0c399e9808e851d",
     "type": "machine_learning",
-    "version": 211
+    "version": 212
   },
   "6d8685a1-94fa-4ef7-83de-59302e7c4ca8": {
     "rule_name": "Potential Privilege Escalation via CVE-2023-4911",
-    "sha256": "43e59c39d821bf39fd6c407a1be82ae2dc2413f7e5cdf21020ca39f4579609c0",
+    "sha256": "f9612a6680c21d0e7472c260b412d0ce245e770722ae4ce351d2724843c22512",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "6ded0996-7d4b-40f2-bf4a-6913e7591795": {
     "min_stack_version": "8.13",
@@ -6859,15 +6900,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Root Certificate Installation",
-        "sha256": "823b635b9abe083d089b09bad1fedea72c47d6079538298c3c4059448d5226f2",
+        "sha256": "f8f51e4211d34c59185c437d929b82051162d84c2c026d0a311fd0d6f40f2099",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Root Certificate Installation",
-    "sha256": "7b3d5c33a80f686358b9a2c1e87a460372c73e2745f919fb3ea2bd8bf4a3ddb5",
+    "sha256": "f253848012c90e8fdcf02df03d40dbb169248ea5c7555e85d439610392aa81ee",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "6e1a2cc4-d260-11ed-8829-f661ea17fbcc": {
     "min_stack_version": "8.14",
@@ -6887,9 +6928,9 @@
   },
   "6e2355cc-c60a-4d92-a80c-e54a45ad2400": {
     "rule_name": "Loadable Kernel Module Configuration File Creation",
-    "sha256": "c252a18bf2a68359e1d94df169c9571410f418945f1b4a916cbba7bbc94330c3",
+    "sha256": "55651a72478c93e332ffd43ceed7bb57e098fd6549e20ff56ce66ede80a49a75",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "6e40d56f-5c0e-4ac6-aece-bee96645b172": {
     "min_stack_version": "8.14",
@@ -6897,15 +6938,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Anomalous Process For a Windows Population",
-        "sha256": "e37d7455b40bc535bfe594dc80d1c349bd5dc6dc8b29ea9f6188efc2c897e623",
+        "sha256": "aa536cbc660cc56dffc7bd3cbb4098aacc6c96df9edb4d4dbe8f33414448b4d3",
         "type": "machine_learning",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Anomalous Process For a Windows Population",
-    "sha256": "849904e5601ed2b7ca539b15e1b20c3d5fd3a966683bc5a5f0cfa7101f0edcd9",
+    "sha256": "f51d97afdd1733e5fc284af1e741adc641483e82eab7f5fefd10f0447b2654d8",
     "type": "machine_learning",
-    "version": 208
+    "version": 209
   },
   "6e9130a5-9be6-48e5-943a-9628bfc74b18": {
     "min_stack_version": "8.14",
@@ -6913,21 +6954,21 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "AdminSDHolder Backdoor",
-        "sha256": "e93289cdea358a09e2f778fc7c8e54c33ba01ad48013526945a7614333f52abe",
+        "sha256": "f665de1ecacdaa7b1c6b0556304063dac3048aada63e8f6ef7a725068e85f087",
         "type": "query",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "AdminSDHolder Backdoor",
-    "sha256": "d92aec3ae515b2f1ef5ead2567d90bf9ed286c98404ada51b490d78121809360",
+    "sha256": "eae617d40bb78ff247049dfa080cc2aa3aa6f67036c79af83b3d0c573bb1375e",
     "type": "query",
-    "version": 210
+    "version": 211
   },
   "6e9b351e-a531-4bdc-b73e-7034d6eed7ff": {
     "rule_name": "Enumeration of Users or Groups via Built-in Commands",
-    "sha256": "3eb0d320290f508310e7c0efbd51d6f2caa9acc4ca1879e192e0cc53658e62bd",
+    "sha256": "3603dc2b2c4d67886879719f5bf7a3028418d0fd6b68942c48a0266e237f5200",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "6ea41894-66c3-4df7-ad6b-2c5074eb3df8": {
     "min_stack_version": "8.14",
@@ -6935,15 +6976,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Potential Windows Error Manager Masquerading",
-        "sha256": "cf3d387a14b5aca9831a6255aa43fa4f3dfabf5b2660333a9750792f6a8acb75",
+        "sha256": "736e277394bca054547364d6d99541019679fc36129d52d20115c635cea06701",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Potential Windows Error Manager Masquerading",
-    "sha256": "e7158ede633bc5e943fe69d3f0dd3ca7dbbb2dcd7c6be7221419dbeb34619d36",
+    "sha256": "8c0b8e6ae4907a14420c8dc8d06917470f29f360f9604118f6220115e981bef3",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "6ea55c81-e2ba-42f2-a134-bccf857ba922": {
     "min_stack_version": "8.14",
@@ -6973,15 +7014,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Potential Linux Tunneling and/or Port Forwarding",
-        "sha256": "e7974fdba41cd2ce4d8ff22447cfab64cec739f3dd5bc0ab0749e92fc578bcf8",
+        "sha256": "eb944b67560451bef538d988be2f0fcfd42f4a6dce1a2f67fc23ef34d93692e8",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Potential Linux Tunneling and/or Port Forwarding",
-    "sha256": "a44f454d7d3b4ac3bda2f2ddfe43c1eb63f445a52c8cc6c7bb56d32440122ae2",
+    "sha256": "a2bb01debfece4938dd4811b68b388aad80362fd4005573222fab19ba5b3f6da",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "6f024bde-7085-489b-8250-5957efdf1caf": {
     "min_stack_version": "8.14",
@@ -6989,15 +7030,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Active Directory Group Modification by SYSTEM",
-        "sha256": "2ee2291d359018227fac96405ae5bd6ac5dba317d4dc3822fa5bd4382a4dddce",
+        "sha256": "03eb5f7517e61382f1036b5beee21a7d1de836f457cada365be4b8aa39f93045",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Active Directory Group Modification by SYSTEM",
-    "sha256": "3a007cf6213892afdb51e38c653b7fbb54d64d355bfe16ae31a77fa323fd5fbd",
+    "sha256": "5cf116ca583a54c21dd2db7e27f62fa234832620236dd9cf062d0599afa18a12",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "6f1500bc-62d7-4eb9-8601-7485e87da2f4": {
     "rule_name": "SSH (Secure Shell) to the Internet",
@@ -7011,22 +7052,22 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "First Occurrence of Okta User Session Started via Proxy",
-        "sha256": "83e0d8f3803e360f309ed8e89f6b91964a5cc4b6b2f0fd21638ded2c5341312d",
+        "sha256": "8e24f0277992e974a8ec25803576d40f21206d6466ecaa82e2df16fab17d5dd8",
         "type": "new_terms",
-        "version": 4
+        "version": 5
       },
       "8.14": {
         "max_allowable_version": 204,
         "rule_name": "First Occurrence of Okta User Session Started via Proxy",
-        "sha256": "83e0d8f3803e360f309ed8e89f6b91964a5cc4b6b2f0fd21638ded2c5341312d",
+        "sha256": "8e24f0277992e974a8ec25803576d40f21206d6466ecaa82e2df16fab17d5dd8",
         "type": "new_terms",
-        "version": 105
+        "version": 106
       }
     },
     "rule_name": "First Occurrence of Okta User Session Started via Proxy",
-    "sha256": "7563691fd12cf3117704e5a587b34b6e55fca8fa5c50b684ee99bb65466e4ec9",
+    "sha256": "4b4aaaf8565e177b55da43b3b76e40c256d8df646f804b5548be8f9f4eb95a02",
     "type": "new_terms",
-    "version": 205
+    "version": 206
   },
   "6f435062-b7fc-4af9-acea-5b1ead65c5a5": {
     "rule_name": "Google Workspace Role Modified",
@@ -7070,27 +7111,27 @@
   },
   "70d12c9c-0dbd-4a1a-bc44-1467502c9cf6": {
     "rule_name": "Persistence via WMI Standard Registry Provider",
-    "sha256": "48ce070e2534c85222ae42380aff08e9cf1051209120195a41abb438dd4f8f6e",
+    "sha256": "fe89abe29a8070ab4e00e31a6d1cafde62515321d21198ba780381a9cc87d9b5",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "70fa1af4-27fd-4f26-bd03-50b6af6b9e24": {
     "rule_name": "Attempt to Unload Elastic Endpoint Security Kernel Extension",
-    "sha256": "0ac39c7e21a70ea619a342065d004f5c51d563df631af84fa09a327437843b47",
+    "sha256": "6d5f8124605ee8d89f23173accb268a0822ca4c9d19c6ee69a82b72a054b8c85",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "7164081a-3930-11ed-a261-0242ac120002": {
     "rule_name": "Kubernetes Container Created with Excessive Linux Capabilities",
-    "sha256": "32963011dca38553023a0d151758f181bed528bee5ecb5b09ac7e98db6994910",
+    "sha256": "cc0ed08e75b10ef23c81e0eaaeaa4a105adead987b36e625e56b5d3fd95293af",
     "type": "query",
-    "version": 5
+    "version": 6
   },
   "717f82c2-7741-4f9b-85b8-d06aeb853f4f": {
     "rule_name": "Modification of Dynamic Linker Preload Shared Object",
-    "sha256": "593012691955c843d367110658df0c195a220829f73a237e8fadc2d4b0ce1b40",
+    "sha256": "11a00101c170955ef44f1ca300cced85620dfde179c9eed8484b753c960993b4",
     "type": "new_terms",
-    "version": 209
+    "version": 210
   },
   "71bccb61-e19b-452f-b104-79a60e546a95": {
     "min_stack_version": "8.14",
@@ -7098,22 +7139,22 @@
       "8.12": {
         "max_allowable_version": 214,
         "rule_name": "Unusual File Creation - Alternate Data Stream",
-        "sha256": "b88514bbe2cf6ea8319648c67d83c00801179f31734024fd4661549db9e00297",
+        "sha256": "021ab9fdaf96cad949b46c2810f09637e27d34d4870bb4544afe5e33d4fcc8fa",
         "type": "eql",
-        "version": 115
+        "version": 116
       },
       "8.13": {
         "max_allowable_version": 314,
         "rule_name": "Unusual File Creation - Alternate Data Stream",
-        "sha256": "3602a1e97b87858224410b312b908c03fd8de29c7043c6e494f1f906e12bcc30",
+        "sha256": "b28951fe4ef7053b478f08929474a4220e85d70c52a9d83f2779447c8b6a5cfd",
         "type": "eql",
-        "version": 215
+        "version": 216
       }
     },
     "rule_name": "Unusual File Creation - Alternate Data Stream",
-    "sha256": "265742cf965a3ba843e506c2a3b295f9cbd5d86e7cd45f85a3135b441230d12e",
+    "sha256": "25b753cd927ee68be264ce3804a09298ae399947fa04077161f80d8f6db87aec",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "71c5cb27-eca5-4151-bb47-64bc3f883270": {
     "min_stack_version": "8.14",
@@ -7121,40 +7162,40 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Suspicious RDP ActiveX Client Loaded",
-        "sha256": "64895d38f16c2e624a0463473d0bd2e81114b05911dc5179734a38c2df5c25c8",
+        "sha256": "4465fa5b7551e881e3e5b66b1cfae96e4f8459191b87e2266b1fc1998c26d690",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Suspicious RDP ActiveX Client Loaded",
-    "sha256": "8225645357459c0d58f7893ad549d29d2962f1d7223312aab7feb5c8b918fc68",
+    "sha256": "d39c0a65fabb51bbd9bbf21cda120d03b4b1891934c8d8298addd7d3585b1ccb",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "71d6a53d-abbd-40df-afee-c21fff6aafb0": {
     "rule_name": "Suspicious Passwd File Event Action",
-    "sha256": "e030929c0ce21a679a3931586b3e70cecc18c849100b3ae52bc4374ca17cbcb2",
+    "sha256": "9c5e49e4ec3d86b7a5b7018df29cbbaafcaa6bc37f325409687ef18528d09109",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "71de53ea-ff3b-11ee-b572-f661ea17fbce": {
     "rule_name": "AWS IAM Roles Anywhere Trust Anchor Created with External CA",
-    "sha256": "221735c970fc3e380f11afa20a31274e578aab37486d9b912fe880f215412ddb",
+    "sha256": "53f2d959afe1859d602b087186c2f25fd816ce59109d230336260a9d4c9c2985",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "721999d0-7ab2-44bf-b328-6e63367b9b29": {
     "rule_name": "Microsoft 365 Potential ransomware activity",
-    "sha256": "c4aa9e181be0c938309c1841f3a5de34116bfe2a8a734e1a92fd928af5ef644f",
+    "sha256": "eeedb6e75b8369f569e27869c6d1cfcc66b89f71b4869f6357e49a43538c980e",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "725a048a-88c5-4fc7-8677-a44fc0031822": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Bedrock Detected Multiple Validation Exception Errors by a Single User",
-    "sha256": "34978ee634354ab60ca9b666477fc311458de3badb024f148a5005ee0469187b",
+    "sha256": "f61560b78b79c873453bce1b3947231b6df1c967d0f2a49efefd56bbfb7bfc59",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "729aa18d-06a6-41c7-b175-b65b739b1181": {
     "min_stack_version": "8.15",
@@ -7162,22 +7203,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Reset MFA Factors for an Okta User Account",
-        "sha256": "fd9dd19e7456e3e02e208354daf6b7002b2a66a65557246ea14db8ef4f247cb2",
+        "sha256": "ac791f5dd84722e6c346e3b3a523b739bbce0ddb484f53d49ed5d1a2ebfe7c7b",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Reset MFA Factors for an Okta User Account",
-        "sha256": "fd9dd19e7456e3e02e208354daf6b7002b2a66a65557246ea14db8ef4f247cb2",
+        "sha256": "ac791f5dd84722e6c346e3b3a523b739bbce0ddb484f53d49ed5d1a2ebfe7c7b",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Reset MFA Factors for an Okta User Account",
-    "sha256": "7df6d7af1f3b05fb54ceeb51357f79b43fe4a413cda240a9e75414376bf20cff",
+    "sha256": "9a377a031cd4fb9cb9842837169396944442098d99de7fb295b107e286c332f6",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "72d33577-f155-457d-aad3-379f9b750c97": {
     "rule_name": "Linux Restricted Shell Breakout via env Shell Evasion",
@@ -7187,9 +7228,9 @@
   },
   "72ed9140-fe9d-4a34-a026-75b50e484b17": {
     "rule_name": "Unusual Discovery Signal Alert with Unusual Process Executable",
-    "sha256": "b904f25bf5bb414b7b11d0a216395926f40e0ee77abebc5f9b7d19b0e35837d9",
+    "sha256": "4f3545b509cbd0e36f1170017de36ef566801ca5376fc194fef70bac179466cf",
     "type": "new_terms",
-    "version": 2
+    "version": 3
   },
   "730ed57d-ae0f-444f-af50-78708b57edd5": {
     "min_stack_version": "8.14",
@@ -7197,34 +7238,34 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Suspicious JetBrains TeamCity Child Process",
-        "sha256": "54016ee23f49287a4fae596a255b45db62a996943f8881ff1dfb1fd2fb8920e7",
+        "sha256": "14c220c965f94f3d24b674b86ed86d9a0e093a00d8bb6fc8eb670488981b443a",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Suspicious JetBrains TeamCity Child Process",
-        "sha256": "e855ed53b4cfc63e2e39c9229565a1c01d7d48221d8070d431e8dc9e876c8f50",
+        "sha256": "f6fa075f0e990cc2ced9697647d10fa16903bdde80c50a403c2f4bc7b78d7a0b",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Suspicious JetBrains TeamCity Child Process",
-    "sha256": "ae1341f2955bd09f391d9e1c7a700bda4d7f98485c0639ce3a9296fd402d7f36",
+    "sha256": "e129818b4075375d23aede5312cbcac6b1a4b64ce749202fd8a924cdb2ed5a06",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "7318affb-bfe8-4d50-a425-f617833be160": {
     "rule_name": "Potential Execution of rc.local Script",
-    "sha256": "a1de5406513b29e7517ce6db0a932eed198d6f6646dde0fa92bfd7cc13817aa2",
+    "sha256": "b962ad63b2d98409b515c4dd3a06e95db517c9a7d1b13f171924c19dbaab563e",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "734239fe-eda8-48c0-bca8-9e3dafd81a88": {
     "rule_name": "Curl SOCKS Proxy Activity from Unusual Parent",
-    "sha256": "335243f27a9e9ed1e3642e492e90d9884c17019a2822331a668c6e48b82c46c4",
+    "sha256": "c1f5f6023527e8ad1b084703495bc9a930c88144a67ab419027b598476b0565c",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "7405ddf1-6c8e-41ce-818f-48bea6bcaed8": {
     "min_stack_version": "8.14",
@@ -7232,21 +7273,21 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Potential Modification of Accessibility Binaries",
-        "sha256": "d92a7d07cb5e81322f02fb2a7166dbdd70da750fa76141da1b95cb31663d9448",
+        "sha256": "491014d84ab03e206e7acd9755d0269b2830a9b3f9c44913c29682c433c740a6",
         "type": "eql",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "Potential Modification of Accessibility Binaries",
-    "sha256": "c31f8fce3143f7e8eb7fcff3e3855ec68728dbb708d60e35ebc951c8dea7b0a5",
+    "sha256": "46384078f361759cefe252f2ab0c88a0782b3c678d19dbdf8f572efaf67b2044",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1": {
     "rule_name": "Modification of Environment Variable via Unsigned or Untrusted Parent",
-    "sha256": "b170681fb44115e54ae79d975287efafd1d43ef7e8ee33af103b33ab76025f0e",
+    "sha256": "44bbbdabf96190f26bace4b98f5c51ae42d1a21d7d1da27237875fa98e94a949",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "745b0119-0560-43ba-860a-7235dd8cee8d": {
     "rule_name": "Unusual Hour for a User to Logon",
@@ -7256,16 +7297,16 @@
   },
   "746edc4c-c54c-49c6-97a1-651223819448": {
     "rule_name": "Unusual DNS Activity",
-    "sha256": "be2743603bcbf86cc96a4bdfd8c5de3f4377cc7621eeafe530eac2db9e6342c7",
+    "sha256": "181dc50d849f55bfcf9764f49f182fed0798673d7fa5fbf72be7656432884240",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "74f45152-9aee-11ef-b0a5-f661ea17fbcd": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Discovery API Calls via CLI from a Single Resource",
-    "sha256": "e302282bacf904630c492f9029228d942da4a53e8c775f0a4d050c1adc149db8",
+    "sha256": "f5789d775fa4739d37c91b2704142e6834659dfa48c0b2678871113ce335b642",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "7592c127-89fb-4209-a8f6-f9944dfd7e02": {
     "rule_name": "Suspicious Sysctl File Event",
@@ -7281,21 +7322,21 @@
   },
   "75ee75d8-c180-481c-ba88-ee50129a6aef": {
     "rule_name": "Web Application Suspicious Activity: Unauthorized Method",
-    "sha256": "6888bde4c516f00a56257eb9f46531d38dbadb83d316387c5e20af3390580961",
+    "sha256": "35c6e99bb87ba74e8ad015a7294177cb02da7be90c3c3eaeafcfc7be552d06f8",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "76152ca1-71d0-4003-9e37-0983e12832da": {
     "rule_name": "Potential Privilege Escalation via Sudoers File Modification",
-    "sha256": "22a8ad00011d5f164b7afb9036e0c5c08d16762e2128190811ec8aafe4886bd4",
+    "sha256": "6af358d3be4d9bb00ef30bfd0dbcf86a28d3137bb9860f1f4798f16b397ca98e",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "764c8437-a581-4537-8060-1fdb0e92c92d": {
     "rule_name": "Kubernetes Pod Created With HostIPC",
-    "sha256": "5ddd8e0de022dc243009f61fe4aed4fd7812fd7d7ce4ff362bb536a2e0dcc1e9",
+    "sha256": "e909dade063ff13866c5e0f93e3c21f803087e12ab2fec4064af1a3dfa872729",
     "type": "query",
-    "version": 204
+    "version": 205
   },
   "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66": {
     "min_stack_version": "8.14",
@@ -7303,15 +7344,15 @@
       "8.12": {
         "max_allowable_version": 111,
         "rule_name": "Access to a Sensitive LDAP Attribute",
-        "sha256": "77281c68463fbc2c835a7a2749c534aa6aec79a75e0597d4199b96137ca5e191",
+        "sha256": "e27879646a752098196f7a4c79196676252e70f55aa7d52e91c8571fcf426996",
         "type": "eql",
-        "version": 12
+        "version": 13
       }
     },
     "rule_name": "Access to a Sensitive LDAP Attribute",
-    "sha256": "548fe255b858588807657801d2412f86bb23f3f7be4ad873dc10a2106a76466c",
+    "sha256": "53ab74d6acf45ef59942b5dd19e0d71f5ca14ae4de1da8c6090b4507887d6e22",
     "type": "eql",
-    "version": 112
+    "version": 113
   },
   "766d3f91-3f12-448c-b65f-20123e9e9e8c": {
     "min_stack_version": "8.13",
@@ -7319,15 +7360,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Creation of Hidden Shared Object File",
-        "sha256": "a747be0c57d2283c6230586562f1c075efb7f2962fafced613f3b2c9fb64b8fa",
+        "sha256": "d821f3e5a0bf1e2dedce1bdaf15fe58785f4e47e81a99103fd0c35cb62e5fbf2",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Creation of Hidden Shared Object File",
-    "sha256": "7d8aba7675bdfd4210d9d2d6fb545a6626a13ccccaee4a669650fb3a6381aaac",
+    "sha256": "4ca005023766d02d784784bb7849d0cc16327545a1864fcca200f297ab249851",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "76ddb638-abf7-42d5-be22-4a70b0bf7241": {
     "min_stack_version": "8.14",
@@ -7335,21 +7376,21 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Privilege Escalation via Rogue Named Pipe Impersonation",
-        "sha256": "77deaf0de198677613cb4ea5ded34296802b16789afb9856cbe3114220f9e4fb",
+        "sha256": "d7ae7c609b2c09df86e03eb23c9f3d9c19a114f3e9e69d99121828e0555ea7ff",
         "type": "eql",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Privilege Escalation via Rogue Named Pipe Impersonation",
-    "sha256": "49a20927f23290c2e144d1b65851802c17c754cff9a811996be6493bd052aa8e",
+    "sha256": "79ae7e59e1d03bbcfec778070f91b178ec05f43c08636a10bbffb05ee2bca01a",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "76e4d92b-61c1-4a95-ab61-5fd94179a1ee": {
     "rule_name": "Potential Reverse Shell via Suspicious Child Process",
-    "sha256": "6ac453ec6132c64b8a4ca261bc2a4effcf46f9bae6fcc34c97984064110e2953",
+    "sha256": "84f537c4a2c1c856bfe6d666e3571345b696959542bcca59883abd23143ece1e",
     "type": "eql",
-    "version": 9
+    "version": 10
   },
   "76fd43b7-3480-4dd9-8ad7-8bd36bfad92f": {
     "min_stack_version": "8.14",
@@ -7380,46 +7421,46 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Enumeration Command Spawned via WMIPrvSE",
-        "sha256": "817ef65a6a910511dbe215f836ed060a2efe5a05e206abf2224a2480ce861487",
+        "sha256": "d62e2b76d88602e0cdbf18894a79c5eb6e97d94b79daf465cf55f42a2afa7bb4",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Enumeration Command Spawned via WMIPrvSE",
-        "sha256": "2b7e8fa40dba01ec3ca76881d26777d3de3ace0c62af4427698b3bd594bd7195",
+        "sha256": "31b16b50f6ddada62eb767b0e6eb1ff02c6a155e2618729dbc807defff6abe0a",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Enumeration Command Spawned via WMIPrvSE",
-    "sha256": "d72d3f14698c4424226b130a2b715c698d3064d3c24a739a0927e48acb0f6aa8",
+    "sha256": "82829ceebd92fbe5abb27cc5e4f5139731a0b337c7f1a8e09ed51ba9d883cc63",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "774f5e28-7b75-4a58-b94e-41bf060fdd86": {
     "rule_name": "User Added as Owner for Azure Application",
-    "sha256": "b88d2f1b89f2bbf51454db3706d1461b08147f31841aea42ee15726e4632fa26",
+    "sha256": "ade0c6d9a4d9740cdb0024f7c02cc8b73775f63d9be285e4692d87bf29938f72",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "7787362c-90ff-4b1a-b313-8808b1020e64": {
     "rule_name": "UID Elevation from Previously Unknown Executable",
-    "sha256": "20a7e5fcb8be7660f1a17f80c4e882a8fc95e82c19a75ad9f1a27620b30bec30",
+    "sha256": "4c034f3a9c42c12be6b1a00041754822d517d75f23ddab914c20222cab8ebc8b",
     "type": "new_terms",
-    "version": 4
+    "version": 5
   },
   "77a3c3df-8ec4-4da4-b758-878f551dee69": {
     "rule_name": "Adversary Behavior - Detected - Elastic Endgame",
-    "sha256": "0ec924f52296fef94948482d51b8d533eee0455bd3bce573fa522ee3d1c9997d",
+    "sha256": "11fdb1469f92140db4557f4b11369477cd9bf511578238a7b6db0f4a8535243f",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "781f8746-2180-4691-890c-4c96d11ca91d": {
     "rule_name": "Potential Network Sweep Detected",
-    "sha256": "9121a1422f15efedecd947633f481a8974363778374dfdb1bdcce1b188167fbe",
+    "sha256": "2cd6f77377a3d577ab8065dba895a7e2180b5a2c9e63cf70c3c343a2e869befb",
     "type": "threshold",
-    "version": 8
+    "version": 9
   },
   "78390eb5-c838-4c1d-8240-69dd7397cfb7": {
     "min_stack_version": "8.13",
@@ -7427,15 +7468,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Yum/DNF Plugin Status Discovery",
-        "sha256": "23a40162c5772a1d921549e7d5a4282e9d4641cc2e228e211d0b185242db9e4a",
+        "sha256": "edc1dcf2de6b0222d78f62e7eac490f5069a3917f49022d78a3b84b59739ac14",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Yum/DNF Plugin Status Discovery",
-    "sha256": "af6cc4cbc5fc5b1750d6673473cc5143ed51bc71ded94a44bef658cd72bc3c90",
+    "sha256": "18285a5b5c95fc7dda5307e71045134c595f4fc27ce61967134e85c88eb12f35",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "785a404b-75aa-4ffd-8be5-3334a5a544dd": {
     "rule_name": "Application Added to Google Workspace Domain",
@@ -7461,22 +7502,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Suspicious ScreenConnect Client Child Process",
-        "sha256": "cd3cb9cd7b2638583883de2da1aec04b010b4d8dc850d4e9344f2016ef1f0446",
+        "sha256": "0005a9a8a6ef5e1175a1455632c00ea760e3a9af4094ad1ac870f68df926d254",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 304,
         "rule_name": "Suspicious ScreenConnect Client Child Process",
-        "sha256": "bcbc70fad2d9c71913c432c46861cb8ff153465af7f9f11ab464014680f13996",
+        "sha256": "3ce0e176a839d12ad331e3842627d3025bbd3ab4ab14d6bd3cc4b7647b783d93",
         "type": "eql",
-        "version": 206
+        "version": 207
       }
     },
     "rule_name": "Suspicious ScreenConnect Client Child Process",
-    "sha256": "b4eea876e31435d0c73ac8768c4954d50f6d10e4862c73652ad1fa9d0faa4464",
+    "sha256": "d898e75beef6831e445cc1fc945041edc9b598e291f5ad76dc7bbe7b040eb79c",
     "type": "eql",
-    "version": 307
+    "version": 308
   },
   "78e9b5d5-7c07-40a7-a591-3dbbf464c386": {
     "rule_name": "Suspicious File Renamed via SMB",
@@ -7486,9 +7527,9 @@
   },
   "78ef0c95-9dc2-40ac-a8da-5deb6293a14e": {
     "rule_name": "Unsigned DLL Loaded by Svchost",
-    "sha256": "bb615c82f76f783f0f58151931932eec4f8b1bab35a8600d646c237df38dcb1f",
+    "sha256": "74064ff365e610605f23b1e89523fbb13694d5231cd3738b21ab8cf30c6d0e2c",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "79124edf-30a8-4d48-95c4-11522cad94b1": {
     "rule_name": "File Compressed or Archived into Common Format by Unsigned Process",
@@ -7498,9 +7539,16 @@
   },
   "792dd7a6-7e00-4a0a-8a9a-a7c24720b5ec": {
     "rule_name": "Azure Key Vault Modified",
-    "sha256": "79a68677542c96b2d8a804e552e8de37560ab6f599a24f9b828d0b1dbbee1a87",
+    "sha256": "26a1c9c9ec61e57e11380743c01f25a54a74cb7f580dde50a1a6d9d43e4f537e",
     "type": "query",
-    "version": 103
+    "version": 104
+  },
+  "79543b00-28a5-4461-81ac-644c4dc4012f": {
+    "min_stack_version": "8.15",
+    "rule_name": "Execution of a Downloaded Windows Script",
+    "sha256": "bd592841bf0b6ad530aa3d406b9a9eab1967356532a3378b75aa5fbb032ce9ea",
+    "type": "eql",
+    "version": 1
   },
   "7957f3b9-f590-4062-b9f9-003c32bfc7d6": {
     "min_stack_version": "8.13",
@@ -7508,15 +7556,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "SSL Certificate Deletion",
-        "sha256": "89f19de3195f7c7c74cdc64eec4457b9424ec304f8316da04481f0bae74b06ac",
+        "sha256": "7c7dddf409d27c4336808578a23adad99b63a0ffdc3ca7a3651f429905241271",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "SSL Certificate Deletion",
-    "sha256": "c081611ae197d81de6a8f032e4e35d9559ed5aa2edde95336b05822f6143e42f",
+    "sha256": "7e7cc3077f9f831c4c0bf8d8d0cbdb3ab9244f904d9ecc9698a4a1790edb925d",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "79ce2c96-72f7-44f9-88ef-60fa1ac2ce47": {
     "rule_name": "Potential Masquerading as System32 Executable",
@@ -7530,22 +7578,22 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Potential File Transfer via Certreq",
-        "sha256": "0fa34695e7e58ab411a32781540d80e8b93e9a6162cc9ceaa18a072942d6e319",
+        "sha256": "0ab2916bfd0a5de67b88a693cf85292e73b61538b72dbdc008f37e561b662f86",
         "type": "eql",
-        "version": 9
+        "version": 10
       },
       "8.13": {
         "max_allowable_version": 208,
         "rule_name": "Potential File Transfer via Certreq",
-        "sha256": "c7346c7c1df15029b05df11871734739ec4818f53fd9684c2a583eb85d432fff",
+        "sha256": "f6cb3500aef0219e60d7a68529a59b0a83d53dc2a4be380f92e62fd0223d44b4",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Potential File Transfer via Certreq",
-    "sha256": "317afcd5484f4d5ed77732c52136d63141c3af83abc8cc130d698fd7da4ef84c",
+    "sha256": "e1897e626658e3fe3b447488817112191c5a960deaee23c8b957ef58ee977d91",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "79f97b31-480e-4e63-a7f4-ede42bf2c6de": {
     "min_stack_version": "8.14",
@@ -7559,9 +7607,9 @@
       }
     },
     "rule_name": "Potential Shadow Credentials added to AD Object",
-    "sha256": "fcf721e497f059801651f6332bbdc66878edeac4195692fa7e6e402fbabf0fb1",
+    "sha256": "391c7298682fb3726536a7f552ccf9f49fd3d8d83acaf1ca3ba74e49aa91590a",
     "type": "query",
-    "version": 212
+    "version": 213
   },
   "7a137d76-ce3d-48e2-947d-2747796a78c0": {
     "rule_name": "Network Sniffing via Tcpdump",
@@ -7571,21 +7619,21 @@
   },
   "7a5cc9a8-5ea3-11ef-beec-f661ea17fbce": {
     "rule_name": "First Occurrence of STS GetFederationToken Request by User",
-    "sha256": "97ed856d2841e0782bc46e870d33be5ca0ae8b6df0b3ff8f168f828213f57081",
+    "sha256": "3e8f2ecf0b50b7db1d4294ac9f9a788f8bf8790151183901e7829cca9aea5f20",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8": {
     "rule_name": "Potential Privilege Escalation through Writable Docker Socket",
-    "sha256": "59ad5257e309d3192fd55374ef9be4e2d1d4ce96fe0c5e6c568e86d22e05f9a2",
+    "sha256": "f59cd7ace12ad2dc5977115a2a36eafbd45b5f549085525dd8a9e4a84885f089",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "7afc6cc9-8800-4c7f-be6b-b688d2dea248": {
     "rule_name": "Potential Execution via XZBackdoor",
-    "sha256": "b0577394863a57fc35c75a1748f35f6df69d1e0ae476ef4230fbdcd28d3dc564",
+    "sha256": "5757f1a3f917b887d146a792807c7a05c1495134c028e8a489a70611899aa636",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "7b08314d-47a0-4b71-ae4e-16544176924f": {
     "rule_name": "File and Directory Discovery",
@@ -7595,9 +7643,9 @@
   },
   "7b3da11a-60a2-412e-8aa7-011e1eb9ed47": {
     "rule_name": "AWS ElastiCache Security Group Created",
-    "sha256": "eef0353fa501c11cf2bcd5a6676496b4500dd9131341d9cf1578d8a9d51234f4",
+    "sha256": "1ba40cb9f4c5c384f4d6b52a76eab02c45e14d33eb930cccf3fb1c329c7455f2",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "7b8bfc26-81d2-435e-965c-d722ee397ef1": {
     "min_stack_version": "8.14",
@@ -7621,15 +7669,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "SELinux Configuration Creation or Renaming",
-        "sha256": "a858e1300af56137b5117d927e962a8daec649ea7ab5b36f42d2b8c21c72fb40",
+        "sha256": "7b361ea07b92064cb854e35573c5988af529ce6fb75a264cdd27ff53b0963e28",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "SELinux Configuration Creation or Renaming",
-    "sha256": "fb599d47e089dce25c3906b8a4fb854daf47b44c10decf2c631dea195e9ff4dc",
+    "sha256": "5760c0ff5525a18ed54b21f9e5b8b7b19658ed8831398454d1df210be1bbe591",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "7ba58110-ae13-439b-8192-357b0fcfa9d7": {
     "min_stack_version": "8.14",
@@ -7637,27 +7685,27 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Suspicious LSASS Access via MalSecLogon",
-        "sha256": "fa0f15538180301dcc99fb3677d8ac7ad2d789d612e23c816f0908956028b3c1",
+        "sha256": "9abb27e289a572393ecc8c26044e5a71196cc1d77d152f84fbee7138251de7de",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Suspicious LSASS Access via MalSecLogon",
-    "sha256": "0bcdd2692369252815bb0b5c45cdfcebaea56683de999dfad868be1f725d9ddd",
+    "sha256": "bb2e07eec501f5e296c694526b219607dca9e18bad1a4d862fd1cab9bac5fe08",
     "type": "eql",
-    "version": 308
+    "version": 309
   },
   "7bcbb3ac-e533-41ad-a612-d6c3bf666aba": {
     "rule_name": "Tampering of Shell Command-Line History",
-    "sha256": "b29563e9adeb94b3d771f3e0f0316518415fb4312e33347e187c39ba28647529",
+    "sha256": "886f6f210debfa8b2263107d6bb45787db17443c3f09f62bb792e44159dfdcd0",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "7c2e1297-7664-42bc-af11-6d5d35220b6b": {
     "rule_name": "APT Package Manager Configuration File Creation",
-    "sha256": "c15e188ea1ce6f3177c41bfe4cb9a692bfcdc3416f1af28263ebc1a14ca9404a",
+    "sha256": "5640fd704ed05c227cd8de85371a84f00b0f3086b3a976bd99359b15b0b4d4ea",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "7caa8e60-2df0-11ed-b814-f661ea17fbce": {
     "rule_name": "Google Workspace Bitlocker Setting Disabled",
@@ -7671,27 +7719,27 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Git Hook Child Process",
-        "sha256": "78176482702f10120da2da5c9a3fe712cccd4145cf69ed8b5c4276ecdcd6c052",
+        "sha256": "cbfd0389fa0ca95a4de245b02e374ee3f3a3981798ed207f5f5ceff7808d654b",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Git Hook Child Process",
-    "sha256": "bdd3376f6872ff5b5e3f17abeea43a6619585b2c7100c4a5626889edbabbc1a5",
+    "sha256": "3aeeab0a9f9e1baa8c36a0d3aca397ac0be75278ca1a51b60022819bf9ea8cde",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "7ceb2216-47dd-4e64-9433-cddc99727623": {
     "rule_name": "GCP Service Account Creation",
-    "sha256": "0c8a23dace5a96a836f6a55bbc9dc2e64550d584c98257f3b7dbbaaf0d79805c",
+    "sha256": "30dc79af79c7ffd88c47ce8902032f7d4088dcc82f73f4da0070e14257270520",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "7d091a76-0737-11ef-8469-f661ea17fbcc": {
     "rule_name": "AWS Lambda Layer Added to Existing Function",
-    "sha256": "2b5beb7d7435862fd58aef36fbe1c663e0c9dd064e09b122cce712360569c1da",
+    "sha256": "1382999f7d36996f9608126c6608707d9d695dcd3298755443448a1d81c27ead",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "7d2c38d7-ede7-4bdf-b140-445906e6c540": {
     "rule_name": "Tor Activity to the Internet",
@@ -7705,21 +7753,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "SSH Key Generated via ssh-keygen",
-        "sha256": "02a3fbd847f6e988ae119d30af0b3b2c0c31611ed3b77372aa9eb99e8c5bb9cc",
+        "sha256": "7841db675589b43a0132206eb7b239ca46f3ac97ad9193dcf04937159707d691",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "SSH Key Generated via ssh-keygen",
-    "sha256": "34dce1cb53174696ef9ea5a28676eccf92ecb0de0dc7a010aeaecf9c02a2b2c2",
+    "sha256": "5a08a86502f4db05eca4b25e854f8f9be1f852325a962075dea70815aacf6764",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "7dfaaa17-425c-4fe7-bd36-83705fde7c2b": {
     "rule_name": "Suspicious Kworker UID Elevation",
-    "sha256": "1073dde211174d3099a9b8a21931bf6531d2343d6b44d98c0ceabeecc3f29e8a",
+    "sha256": "f0d040485bd01c51e2c8f158dd600fb222395c139e0268bbbcfde6b0c4be3bc0",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "7e23dfef-da2c-4d64-b11d-5f285b638853": {
     "min_stack_version": "8.14",
@@ -7727,22 +7775,29 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Microsoft Management Console File from Unusual Path",
-        "sha256": "74712d6b5a8f373b5bae6e8f885811bb6146ae69ede42dd304c6b79b7be83e91",
+        "sha256": "f4f3005ebf031857782967a3872088cf11afc078151a683045d3bf756aa415c0",
         "type": "eql",
-        "version": 4
+        "version": 5
       },
       "8.13": {
         "max_allowable_version": 304,
         "rule_name": "Microsoft Management Console File from Unusual Path",
-        "sha256": "66858a324d0462bd232554434241130f2856843cf22ef73c579c09e3f6e39043",
+        "sha256": "da4714c9dcfb5d07b5b39b1939ecbfc5b46b7da8d7d77a91c9093ee2ee6e18e1",
         "type": "eql",
-        "version": 206
+        "version": 207
       }
     },
     "rule_name": "Microsoft Management Console File from Unusual Path",
-    "sha256": "332111db4905fbf977cb9ea156d2aa394347669370073cd3430efc581d4c41eb",
+    "sha256": "647288a0f887d8f1f0552ecfef80652333f04873e5f925195d218507a369b28e",
     "type": "eql",
-    "version": 307
+    "version": 308
+  },
+  "7e763fd1-228a-4d43-be88-3ffc14cd7de1": {
+    "min_stack_version": "8.14",
+    "rule_name": "File with Right-to-Left Override Character (RTLO) Created/Executed",
+    "sha256": "e03b56ad3cc6e1d81845996b6bf137225573011b20ba352bde3cfbb18e4479f6",
+    "type": "eql",
+    "version": 1
   },
   "7efca3ad-a348-43b2-b544-c93a78a0ef92": {
     "min_stack_version": "8.13",
@@ -7750,15 +7805,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Security File Access via Common Utilities",
-        "sha256": "35fc8b548fcc1523cdea4fa29865704d65b15be3c7601e2a1f778dae2d006575",
+        "sha256": "46ed777838914f516739b0d329e16d62457fc60aedd877440c7cc4022d7ed059",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Security File Access via Common Utilities",
-    "sha256": "977a2e7491fde0d4fa3a5f2c80a9e93d7c2e5e0aed313fa99a0ec8328bb8b405",
+    "sha256": "3b40fd7e087f2c301a1f5742e48c632df6fe05921c88d4cdcaf67053bcc5975e",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "7f370d54-c0eb-4270-ac5a-9a6020585dc6": {
     "min_stack_version": "8.14",
@@ -7766,15 +7821,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Suspicious WMIC XSL Script Execution",
-        "sha256": "d375afba7884212b8fe34d5179603d5a9a7a16f14ec76a18f89032b8ca01d5e2",
+        "sha256": "1fcee1562ccb772f6a7729303e250ead257201a219aa8ffee182b66f784076d3",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Suspicious WMIC XSL Script Execution",
-    "sha256": "95ee9038faef018973ee81cb960175831ba7c20826685ba790ba0f6926232d5d",
+    "sha256": "a12e4767a30ca28c3ddc986cf3c77848cd65ddfce15fd96b7577dab2afff5122",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db": {
     "rule_name": "Discovery of Internet Capabilities via Built-in Tools",
@@ -7784,16 +7839,16 @@
   },
   "7fb500fa-8e24-4bd1-9480-2a819352602c": {
     "rule_name": "Systemd Timer Created",
-    "sha256": "1e46fd812061270a2231dca8ec5a7ffbddd0a53997cfb62e0d457cac8e0a45d5",
+    "sha256": "d28a5fbf12cd038860603dad3a3f927b893dc2a624963063025cbec73932a4e9",
     "type": "eql",
-    "version": 15
+    "version": 16
   },
   "7fda9bb2-fd28-11ee-85f9-f661ea17fbce": {
     "min_stack_version": "8.13",
     "rule_name": "Potential AWS S3 Bucket Ransomware Note Uploaded",
-    "sha256": "3e4f1413412bd00822190208d7e8be98fe32aa44ccde5044c2aa42fb5a0be8ff",
+    "sha256": "c074c4066439731cdb1ca074f41712d8139ba7383e854e9990c3f5fef99a6a9e",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "80084fa9-8677-4453-8680-b891d3c0c778": {
     "rule_name": "Enumeration of Kernel Modules via Proc",
@@ -7813,21 +7868,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential PowerShell Obfuscated Script",
-        "sha256": "3750bd0f420e04cc5b48056c7e39fda3d29f6f4d5427f19dfbae2a2d94dbb8b5",
+        "sha256": "1106414c1ef42b911e2c96ae0a545a86614b9a568aa9742419c22b0a71a0e879",
         "type": "query",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Potential PowerShell Obfuscated Script",
-    "sha256": "b0bfa7d73d6ccd6142283e63031f550eb9abbf5a4becfb93c6e5c1340752f2e1",
+    "sha256": "f81754824afd09978cc7c486a795db468b2056bf7fad5883848582f85a47c031",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "804a7ac8-fc00-11ee-924b-f661ea17fbce": {
     "rule_name": "SSM Session Started to EC2 Instance",
-    "sha256": "1810d2feab3a3ab42bfb40d5b25dba1fdfff834237355e59824fb8d89879f0dc",
+    "sha256": "d0cfe0f7d2abfcd56dc76d693aba0e8ff89281385360ae75a90446721d5e85c3",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "808291d3-e918-4a3a-86cd-73052a0c9bdc": {
     "min_stack_version": "8.14",
@@ -7853,15 +7908,15 @@
   },
   "80c52164-c82a-402c-9964-852533d58be1": {
     "rule_name": "Process Injection - Detected - Elastic Endgame",
-    "sha256": "42f01902665c666c45de8cafd9cc39c80ab4e28cf87c1e13caab844668cb70be",
+    "sha256": "e29105d1b78b1286a5636c653ea518672e193131ac622f0f3ee2de7f1d5e5528",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "814d96c7-2068-42aa-ba8e-fe0ddd565e2e": {
     "rule_name": "Unusual Remote File Extension",
-    "sha256": "d33a4fa7f5db48036701cd4df4e4586b2218d47f930a796097379a4757023e30",
+    "sha256": "f79f2ede08c18655e62fd70d2fdd42a914f43a74abd5019f7356324fbcd96f92",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "818e23e6-2094-4f0e-8c01-22d30f3506c6": {
     "min_stack_version": "8.14",
@@ -7898,15 +7953,15 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "PowerShell Suspicious Payload Encoded and Compressed",
-        "sha256": "fb000841d858dfe2aa8256f76db575885b1bc4d004bce5256e3746ebd4f09dc5",
+        "sha256": "efc3d78e44e73f61be6817f00d4df5af584ce5e02e96ca5fb45a45d84d771116",
         "type": "query",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "PowerShell Suspicious Payload Encoded and Compressed",
-    "sha256": "320a555df4db198a83d99c9c148c34b4bea3d27beec4d6824ea25b077dfdd561",
+    "sha256": "446a5437935aff86d9b2c78df79189e0201a991a36436313898a59f7706245e6",
     "type": "query",
-    "version": 314
+    "version": 315
   },
   "81ff45f8-f8c2-4e28-992e-5a0e8d98e0fe": {
     "min_stack_version": "8.14",
@@ -7914,46 +7969,46 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Temporarily Scheduled Task Creation",
-        "sha256": "4162c0f3ecc6a4c881309a1c579888218ab3995f564f72409e538076f2e26c78",
+        "sha256": "6bf952805cab991d5963490e557576ee982dbb3d351e9a2b4b2a18092b5980c4",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "Temporarily Scheduled Task Creation",
-    "sha256": "b1820c87c951dea5911f8205052ea225bd0591292ca0283895f1242d165ff6c6",
+    "sha256": "e4459ed8785c0a590bfca408bc7e0bf79a7101cffb3c56690bac0f7cebb948fd",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "827f8d8f-4117-4ae4-b551-f56d54b9da6b": {
     "rule_name": "Apple Scripting Execution with Administrator Privileges",
-    "sha256": "e0f594ae73315999d039f6afdb74b17b186b2daeab2d37cf12f364225219128a",
+    "sha256": "663d1f8ba0fee571a5dcfb323c0f2b66e1b356104fda2cb7d213cd33a51c6f65",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "82f842c2-7c36-438c-b562-5afe54ab11f4": {
     "rule_name": "Suspicious Path Invocation from Command Line",
-    "sha256": "ea85fe009c0baa447a0bfb2014f8b45d2f3ad35fb65a92097ef9e74c24bc5c78",
+    "sha256": "c728415c613b2f36c5c323bb7c97a17891786e1986c6e4c9ea1b69e3d1500099",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "834ee026-f9f9-4ec7-b5e0-7fbfe84765f4": {
     "min_stack_version": "8.13",
     "rule_name": "Manual Dracut Execution",
-    "sha256": "293ca3a55dbbb8dfb51898fd8a165e50c1da1faf40482950e3af6498314478f7",
+    "sha256": "7aacc11b5e41f9a6ee5bb11cc2825d1361cd44bcf69a8fb3d6599be1e9e65c8f",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "835c0622-114e-40b5-a346-f843ea5d01f1": {
     "rule_name": "Potential Linux Local Account Brute Force Detected",
-    "sha256": "135901066ac707836fa9dc5d72517b43f80c3f43f8afdbcd0793ccd7e271f79b",
+    "sha256": "ed8904ed52554b72e3d4db4b4954ce47beef9e99a0ce76a3106d1cf6c0e89123",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "83a1931d-8136-46fc-b7b9-2db4f639e014": {
     "rule_name": "Azure Kubernetes Pods Deleted",
-    "sha256": "8c0f9a8ac544e84262204d80e667c90f7e1a0be582cea5152e2d44926f4e72a9",
+    "sha256": "b04ed2cc0d2afeab9a1e5ce21f7ffe90acbd75940c93166660e2d41abaa39070",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "83b2c6e5-e0b2-42d7-8542-8f3af86a1acb": {
     "rule_name": "Linux Restricted Shell Breakout via the mysql command",
@@ -7967,22 +8022,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Suspicious Windows Powershell Arguments",
-        "sha256": "67fac684b46bd0e1e592ed5fb64523fe9b1b6c8bbf695fa5a8c2ca93c45ebeff",
+        "sha256": "81ca7480b1ca8ad4fd6c7cdddfb2622e9b14641cb9b0b612e22d6bca9e329179",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Suspicious Windows Powershell Arguments",
-        "sha256": "13d53b19535acefeb9018df99a3327de628c8cefdf886e9453b33d0f128fb058",
+        "sha256": "13fd6f48996c900fb7a162c04e7b0e7ea52bd9bb0cf837a4edfb19ebb6c3e8c4",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Suspicious Windows Powershell Arguments",
-    "sha256": "13d45d27cdabc4d4143ebc5cccab8fff6f0a87c28bdb2f258d0dab66423371d2",
+    "sha256": "8f162f40f9630207e21d4ce6a4025ddefcdfc01ac59158bc49c0ef854c20450c",
     "type": "eql",
-    "version": 202
+    "version": 203
   },
   "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f": {
     "min_stack_version": "8.13",
@@ -7990,21 +8045,21 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Attempt to Disable IPTables or Firewall",
-        "sha256": "24507f9fc5eac786e69d16e7a9759e5502f06ae39ca2b0c3baee080c29aed691",
+        "sha256": "6662212297b3975808144113e634d7165b30280989ae8729d7cd570603f52193",
         "type": "eql",
-        "version": 9
+        "version": 10
       }
     },
     "rule_name": "Attempt to Disable IPTables or Firewall",
-    "sha256": "883808e835acb845d8ff5cbd80647149a7076f8dea14f01e0b45b5927f744cc2",
+    "sha256": "6ffa831c31c4b214a52ff08f056a860da877e2c2a926988622839bc3111d7185",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "8446517c-f789-11ee-8ad0-f661ea17fbce": {
     "rule_name": "AWS EC2 Admin Credential Fetch via Assumed Role",
-    "sha256": "7527cb6d613f3cbebb763fc8b4da705569785eb0d5f20552483a9ac4e03c34e9",
+    "sha256": "01513b5293f4ae3276aacd57b67b38b4957f57cb9447cfc9e4f4e580411b6677",
     "type": "new_terms",
-    "version": 3
+    "version": 4
   },
   "846fe13f-6772-4c83-bd39-9d16d4ad1a81": {
     "min_stack_version": "8.14",
@@ -8024,9 +8079,9 @@
   },
   "84755a05-78c8-4430-8681-89cd6c857d71": {
     "rule_name": "At Job Created or Modified",
-    "sha256": "a987f893268d128252316712332f0deeb89dbfad27ee9595059745bcfc9cfb1e",
+    "sha256": "b00d2ec654af8f1f110f648f4094160b9ef9e812d8eb7980b94e0879c40ad211",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "84d1f8db-207f-45ab-a578-921d91c23eb2": {
     "min_stack_version": "8.13",
@@ -8034,15 +8089,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential Upgrade of Non-interactive Shell",
-        "sha256": "c13baf680022d32581c0780e31d4ade6009c93d1be12624a3d30060da764f759",
+        "sha256": "5add5265cea65ff564e6f374b8d963ea6af326fbed8d8d0b3ad11829c55033e6",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Potential Upgrade of Non-interactive Shell",
-    "sha256": "5164b099f1ea1a21b7b6e07b5f4d72e0e2d15a8ec2d03744d57b3590e96b6d0c",
+    "sha256": "151e0853d12af096c8290858df71ee81fd2ed9a318fca88206295da8a3cb6646",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "84da2554-e12a-11ec-b896-f661ea17fbcd": {
     "min_stack_version": "8.14",
@@ -8074,28 +8129,28 @@
   },
   "8623535c-1e17-44e1-aa97-7a0699c3037d": {
     "rule_name": "AWS EC2 Network Access Control List Deletion",
-    "sha256": "4f9d972be95e23e9ad2c127a00b66165c3f6c1105dcfef9a0e85a70d2d22b006",
+    "sha256": "8c5a7758239101b15cc23eb4fb35a783f8e692ad99783c3801a074cdcd98e637",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "863cdf31-7fd3-41cf-a185-681237ea277b": {
     "rule_name": "AWS RDS Security Group Deletion",
-    "sha256": "3815b7cf0e4aeef5cd0350a18c0f8a1f751b8c21d728875a7268a075a70e2ad9",
+    "sha256": "03916533d138f82d6ba43073f971d26e8c8fc154a5722bfb56b1bec42cb8f26f",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "867616ec-41e5-4edc-ada2-ab13ab45de8a": {
     "rule_name": "AWS IAM Group Deletion",
-    "sha256": "b52937ff4f6af1e5ccf8b52bf8d378468fdac5dfd53a8b3217833c005c5fa781",
+    "sha256": "aee9d293bce7b42db112f783b52ca95f4c163851cb39f56542873a0caeb9f9af",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "86aa8579-1526-4dff-97cd-3635eb0e0545": {
     "min_stack_version": "8.13",
     "rule_name": "NetworkManager Dispatcher Script Creation",
-    "sha256": "cb638e8f75b4b1f3fec56d06aa0146d0f3870081db365cff4e0d2244b03f423a",
+    "sha256": "183f75eab447dce4523d4f25e514acf26cfbdf05b137fd5a3fd9eb1b968d86ee",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "86c3157c-a951-4a4f-989b-2f0d0f1f9518": {
     "rule_name": "Potential Linux Reverse Connection through Port Knocking",
@@ -8127,15 +8182,15 @@
   },
   "873b5452-074e-11ef-852e-f661ea17fbcc": {
     "rule_name": "AWS EC2 Instance Connect SSH Public Key Uploaded",
-    "sha256": "3d33ca4d8cc8f50f00c2a6b7388013c9b1484a65207ad7bdc9dd221460387ad9",
+    "sha256": "d1b4160bab5ee676bf3eab50efcb4bff6b9ca03017813d404ac83b5d429c6e77",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "87594192-4539-4bc4-8543-23bc3d5bd2b4": {
     "rule_name": "AWS EventBridge Rule Disabled or Deleted",
-    "sha256": "2a49cf8319bd2a5a16d2286014217d41ffe4680b5e7a367b131ebf7124853339",
+    "sha256": "5cb776ec175c443858372adf34644ecc3edc4f4123ab3f91796ab08fa8d0d162",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "87ec6396-9ac4-4706-bcf0-2ebb22002f43": {
     "rule_name": "FTP (File Transfer Protocol) Activity to the Internet",
@@ -8145,27 +8200,27 @@
   },
   "884e87cc-c67b-4c90-a4ed-e1e24a940c82": {
     "rule_name": "Linux Clipboard Activity Detected",
-    "sha256": "948181ba2921e5e5ff2e950f272a9fa9cb5797927da206fc67100db0641746f3",
+    "sha256": "ca936e7322accdce60e6973d70b3e164506cb6fb04d87bbe28ee8f64c9eecff5",
     "type": "new_terms",
-    "version": 5
+    "version": 6
   },
   "88671231-6626-4e1b-abb7-6e361a171fbb": {
     "rule_name": "Microsoft 365 Global Administrator Role Assigned",
-    "sha256": "1bc2ee513c9a3702d258107ccaa36ce6f728f37804a83afe41ec0386f3386f66",
+    "sha256": "23ada8e36279e7e1d4e063b07f108194166709b11de778959bc24e7eff2a55c4",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "88817a33-60d3-411f-ba79-7c905d865b2a": {
     "rule_name": "Sublime Plugin or Application Script Modification",
-    "sha256": "c982030d976d5caa598abb973577eca20c6a5f49e0f0b746d31b814e3aada81e",
+    "sha256": "99a91041952f318c45cf4a8f2aa5ea27a2b4d57079dd6844d7ccdb85e88c708f",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "88fdcb8c-60e5-46ee-9206-2663adf1b1ce": {
     "rule_name": "Potential Sudo Hijacking",
-    "sha256": "48ef2dcad2d1f95fb5e7cd7f890d36ba444b2c045b00f18db67a56565a8fb776",
+    "sha256": "67beebb88fd866d0c58a2785de107b2bf8f925d18bbbdd790906734f21a39f7b",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "891cb88e-441a-4c3e-be2d-120d99fe7b0d": {
     "min_stack_version": "8.14",
@@ -8173,15 +8228,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Suspicious WMI Image Load from MS Office",
-        "sha256": "ce3fa8639f8be47fdbd516d085eb1359d5c76c41cc11e38b92a58495b3340443",
+        "sha256": "8809aba8865764ab7fa1c657c37778c6657378dc4f2cfb4c6127be5e794149ed",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Suspicious WMI Image Load from MS Office",
-    "sha256": "23ea84a839f5ac5677f5dcd1bd511e1a590fb3a73e3bf7922f0ac80814489841",
+    "sha256": "53a213d8996a7876b24f56a45cbd4b7f95f660de24ee6058b95deef9899d84c9",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "894326d2-56c0-4342-b553-4abfaf421b5b": {
     "min_stack_version": "8.14",
@@ -8189,15 +8244,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential WPAD Spoofing via DNS Record Creation",
-        "sha256": "7c29cdef0a6ebeafbe4e910b112d583288fc53752af7e0be673133e731c7b6ed",
+        "sha256": "9bd93a579ae1a7bbd18dedf1ae6dad6e63793a9512980fd85c8ae941687b452d",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Potential WPAD Spoofing via DNS Record Creation",
-    "sha256": "f41675c0e6c71d8ffce61638873343c099dd76784a16afca7fc2bf6896b4ea63",
+    "sha256": "81c8f8ed0970f15203496f9c2987f89c5c57a24edfbffac2587aeb52629ec0ce",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "89583d1b-3c2e-4606-8b74-0a9fd2248e88": {
     "rule_name": "Linux Restricted Shell Breakout via the vi command",
@@ -8211,15 +8266,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Kerberos Traffic from Unusual Process",
-        "sha256": "2013e3e6c582953aa80b60a4839fd4a71480f61227c7c5eea6a58e6835031b50",
+        "sha256": "7120f5e967222b6743edb0bc495b3453b4d26dc1f63088bff68607f6220e8b59",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Kerberos Traffic from Unusual Process",
-    "sha256": "ca38aa28a331bbae9391539b45d46648d9465bbf8261f1320789c780faf60c37",
+    "sha256": "14dc4752088817761b090bd9e818c960db21258c4ce1aff3ce6e86dbe199d127",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696": {
     "min_stack_version": "8.14",
@@ -8227,27 +8282,27 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Command Prompt Network Connection",
-        "sha256": "85227491b3d44bf45d31d60e2dd5bfe543b04cc13549ad5abd43164d69fbe271",
+        "sha256": "95c1cb5499a597411e4e3b7103680f9d8fb49cf5fc8cb6f354b9483142545adc",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Command Prompt Network Connection",
-    "sha256": "20e49f8b0cc9cd52d6a4e8878d070cae67b09b9f66c1d604d4d844a1a31a48c1",
+    "sha256": "f36e46aabd03a9e82d6e55f6c98dcd0a0f0ae620cd00b0ba0f21e7518a759e2d",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "89fa6cb7-6b53-4de2-b604-648488841ab8": {
     "rule_name": "Persistence via DirectoryService Plugin Modification",
-    "sha256": "7e7bfe7e3320055b9e14c1193bb2f5ecf812a4611d29fb12f0f07137bb6dd03b",
+    "sha256": "4eeb21145663f19873a7b259f2aedd9a858885571f911ca166304d52bf4a49d0",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "8a024633-c444-45c0-a4fe-78128d8c1ab6": {
     "rule_name": "Suspicious Symbolic Link Created",
-    "sha256": "e6768a2a66d26ab7605de86680ec11417c10c845603ad67d0b5768837751b40f",
+    "sha256": "222d4530ad568937c4a1e40fefcfd3cc4761ff0cbf227edae0193e631274505e",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "8a0fbd26-867f-11ee-947c-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -8255,22 +8310,22 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Potential Okta MFA Bombing via Push Notifications",
-        "sha256": "058b07f279981af8faa8daebc191b1c9c562d8f901a11b43f11f53a152c36031",
+        "sha256": "0a419be8ba1ef4b746cee1fe87e2a2459a10566938e2b5114a985c15c294088a",
         "type": "eql",
-        "version": 6
+        "version": 7
       },
       "8.14": {
         "max_allowable_version": 206,
         "rule_name": "Potential Okta MFA Bombing via Push Notifications",
-        "sha256": "058b07f279981af8faa8daebc191b1c9c562d8f901a11b43f11f53a152c36031",
+        "sha256": "0a419be8ba1ef4b746cee1fe87e2a2459a10566938e2b5114a985c15c294088a",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Potential Okta MFA Bombing via Push Notifications",
-    "sha256": "0b71b3bc220b822bcf49d55aaf5b6e785379cd4a77023a808ba154f6233e0a7d",
+    "sha256": "d84240158ef05b04877fc81e2d2f50edb882cd77a53b137f7598c54e84ca5879",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "8a0fd93a-7df8-410d-8808-4cc5e340f2b9": {
     "min_stack_version": "8.13",
@@ -8290,9 +8345,9 @@
   },
   "8a1b0278-0f9a-487d-96bd-d4833298e87a": {
     "rule_name": "SUID/SGID Bit Set",
-    "sha256": "3709b15d60903268e4e30eba20dc1d89c099e0aa71b45dcff996484296a8c994",
+    "sha256": "79396b5a9e555f97305570bb4e88f328ca55471768c325f8cbfdec62e20c30e5",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "8a1d4831-3ce6-4859-9891-28931fa6101d": {
     "min_stack_version": "8.14",
@@ -8300,15 +8355,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Suspicious Execution from a Mounted Device",
-        "sha256": "78673e3f95e690470a888733b99665c1ceb566b839d08ffa96c74f670db2afb3",
+        "sha256": "cd861b1c03ef17e10978c9c1e342be58e0362cd9eef31c85cb7b40568cf5fa52",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Suspicious Execution from a Mounted Device",
-    "sha256": "2b1670c842dd4482f2d66f4b20ad288dba295639673efae366e467a0b4347eac",
+    "sha256": "ddcebc2310acf9c6471b9345d63edcd418123b3e163cca09175bc75defd47755",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "8a5c1e5f-ad63-481e-b53a-ef959230f7f1": {
     "min_stack_version": "8.15",
@@ -8316,22 +8371,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Deactivate an Okta Network Zone",
-        "sha256": "c78e844b887965fd68d2c04803f41f76a3a9fac485e964ab32eb920ff59c394c",
+        "sha256": "8206b3e0f7284ae1caf2453d9befae81b545dea65fad93c30bf6b827be016118",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Deactivate an Okta Network Zone",
-        "sha256": "c78e844b887965fd68d2c04803f41f76a3a9fac485e964ab32eb920ff59c394c",
+        "sha256": "8206b3e0f7284ae1caf2453d9befae81b545dea65fad93c30bf6b827be016118",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Deactivate an Okta Network Zone",
-    "sha256": "3d7de8f86edaeb3db241b7eb724790d7411ef73463ccc7cfed7ede991cf9d3e3",
+    "sha256": "47bcd8271a1bc8780152afe19fa834ab97946e9cba47bcb65d819e92b6625fba",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "8acb7614-1d92-4359-bfcf-478b6d9de150": {
     "rule_name": "Deprecated - Suspicious JAVA Child Process",
@@ -8345,15 +8400,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential Sudo Privilege Escalation via CVE-2019-14287",
-        "sha256": "9f1d8eb4a1676be7fbf66706cbd1e8a9eec262049a93bfc3e771c3d33033f140",
+        "sha256": "2753a4670d4217cc050e838bf5a7f4843db23df0caa83fc1017d346297e4922f",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential Sudo Privilege Escalation via CVE-2019-14287",
-    "sha256": "9a0a3365ed112536df8300b00672c2dd8ef6fac49e7deadb783f732a60a102ee",
+    "sha256": "61b0dd506782ed3d2c0be8ec13e04db7aa0b88f80d4e4900bec06089bba27de4",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "8b2b3a62-a598-4293-bc14-3d5fa22bb98f": {
     "min_stack_version": "8.14",
@@ -8361,22 +8416,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Executable File Creation with Multiple Extensions",
-        "sha256": "bd7eef4c8a972ad7be423197abf484709d19760edfa1a3d0bf09725dcfed57d0",
+        "sha256": "79486f56c33d6afd1cec4fbf8dc404d0f0e9fc38b19572051d537f800d601ed5",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Executable File Creation with Multiple Extensions",
-        "sha256": "a5ba27def82c8a23b306fc36f9fc4d034de167102926baab02506d958ae44b71",
+        "sha256": "8706ffd6a46a7cdbd2b6400c609ec39bf1f1bf833ecccf2d71a38a9316b96ccd",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Executable File Creation with Multiple Extensions",
-    "sha256": "bb22de8a34a7d93efe239f27bf92b15ba453c32860882728ed8eba1e57eba71d",
+    "sha256": "c15790a8f71b15dd684b959f65fa22034a2fafcf821c26c0a2771f727b0c088d",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "8b4f0816-6a65-4630-86a6-c21c179c0d09": {
     "min_stack_version": "8.14",
@@ -8403,15 +8458,15 @@
   },
   "8b64d36a-1307-4b2e-a77b-a0027e4d27c8": {
     "rule_name": "Azure Kubernetes Events Deleted",
-    "sha256": "8a4def186433798cec337c4f9e6b8b1ac62a38ad3789dd570670d22444e74fb9",
+    "sha256": "38bdbda8e1ba1c0aff2f02b3f46c2fc694a92e6a4dfc7244cc948c3e38dfc8ef",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "8c1bdde8-4204-45c0-9e0c-c85ca3902488": {
     "rule_name": "RDP (Remote Desktop Protocol) from the Internet",
-    "sha256": "6659d5d4a4edaff5a8ca68cbfaf2a04c0158a37d500c6e10acc18c930935370f",
+    "sha256": "084b9ec33eedc1699c7dd2f8b5c81771300c6f944ca3fe5c5cfb7039b474cf43",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45": {
     "min_stack_version": "8.14",
@@ -8438,27 +8493,27 @@
   },
   "8c81e506-6e82-4884-9b9a-75d3d252f967": {
     "rule_name": "Potential SharpRDP Behavior",
-    "sha256": "187f18c4d04b8449ae3e946d3e2dfe18c3a5cd4a22ac2f5a20319294fef4e588",
+    "sha256": "dd976a4b62d0afc39c2d7af53056e456bfe88f3261cde76fa6df84e4948cafd0",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "8cb4f625-7743-4dfb-ae1b-ad92be9df7bd": {
     "rule_name": "Ransomware - Detected - Elastic Endgame",
-    "sha256": "b84c5e839efdbf68fe7169726ffe8ce015b356dfe0ea25b276db55b22b85d8f2",
+    "sha256": "cf387e78a1d52b36974bd4933ef7d56730af702385f9a128c2d39cdbfe1334e7",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "8cb84371-d053-4f4f-bce0-c74990e28f28": {
     "rule_name": "Potential Successful SSH Brute Force Attack",
-    "sha256": "eb0397acce03ec5fcb5a10ba7467e1b55e0f73f4a401dfe97878133f487f4483",
+    "sha256": "fb77d08bdc9f8ec6a12b4b74458cdc27ffcecee0c8497e4268cd82cc72685eef",
     "type": "eql",
-    "version": 11
+    "version": 12
   },
   "8cc72fa3-70ae-4ea1-bee2-8e6aaf3c1fcf": {
     "rule_name": "RPM Package Installed by Unusual Parent Process",
-    "sha256": "9868139ca7255c94edd8b10c7750af9f9be3e501bb386dce4f46e240eca21bc2",
+    "sha256": "528868f65a9cb81c8c4c131dd0d3f9550a95750bf358c31cf275b4585365bead",
     "type": "new_terms",
-    "version": 2
+    "version": 3
   },
   "8d366588-cbd6-43ba-95b4-0971c3f906e5": {
     "rule_name": "File with Suspicious Extension Downloaded",
@@ -8468,9 +8523,9 @@
   },
   "8d3d0794-c776-476b-8674-ee2e685f6470": {
     "rule_name": "Suspicious Interactive Shell Spawned From Inside A Container",
-    "sha256": "98d9856fbf5ecafe5dad0a89fd9c9d5281e1c02fee5b91a84b352c727f87441e",
+    "sha256": "bee7fd95d7e5e74fcf59ac4cc197777031c190f90b069ddcbe97bbb18762e92c",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9": {
     "min_stack_version": "8.13",
@@ -8478,21 +8533,21 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Potential Privilege Escalation via PKEXEC",
-        "sha256": "a9c592609916001eeb489115d3ab416659f25485e68e33061d9b0e8903972698",
+        "sha256": "b3457a5fe20b9065c1d9ebd5a8629e04c5ec7633c1976306c1002925a7819bac",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Potential Privilege Escalation via PKEXEC",
-    "sha256": "925c7e7ba202c46a58ef9ddf0845eb693f850d8f085c9c701af731a73d7dca0b",
+    "sha256": "bffefdf6a83bf3a802805b5c6129038b3804ed28da89fb014230a8483be07d8a",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "8ddab73b-3d15-4e5d-9413-47f05553c1d7": {
     "rule_name": "Azure Automation Runbook Deleted",
-    "sha256": "6c88b863fccfcdd4aa41e1c790530f97914dc652a10e9121e26a28194746179c",
+    "sha256": "b8c3f70d8170292a5f9e3cacb2cee9106f06c4c8f11a83ade3fec287cbf5aa0d",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "8e2485b6-a74f-411b-bf7f-38b819f3a846": {
     "min_stack_version": "8.14",
@@ -8500,22 +8555,22 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential WSUS Abuse for Lateral Movement",
-        "sha256": "6df7ece3cdab24f89e189532be69d11605eb972d6f81b444017c7202ba4024a3",
+        "sha256": "0271ec3b7dbac27363d1768f6fb6633b1ab0c6eaf0382a21336ca11b2cc1f0b1",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 203,
         "rule_name": "Potential WSUS Abuse for Lateral Movement",
-        "sha256": "3e2c0816b6054ee90afac447a89f0dbd2c8657badf12aedab3b4c1f371c1d799",
+        "sha256": "1cef3e85f9ce38dcb49c69b0cde38dc80d5d7fe5c048432052116587f371866d",
         "type": "eql",
-        "version": 104
+        "version": 105
       }
     },
     "rule_name": "Potential WSUS Abuse for Lateral Movement",
-    "sha256": "6f20b8e3e7b5786f7b0cc4ec248f9c11431df6e0ee30decc8a98078423a583cf",
+    "sha256": "3827103da350a27cb215e645399cf8761a45bbe50c525c2876fa8bcad9570533",
     "type": "eql",
-    "version": 205
+    "version": 206
   },
   "8e39f54e-910b-4adb-a87e-494fbba5fb65": {
     "rule_name": "Potential Outgoing RDP Connection by Unusual Process",
@@ -8545,21 +8600,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential ADIDNS Poisoning via Wildcard Record Creation",
-        "sha256": "69eda3393bec929f1158fe872d2aac7cd1fb162a851c342ba041fa666a8a09b7",
+        "sha256": "d9d7ef5d8a35b0d509f6c52f7e95a8741f5ffc80c671295bcb5b24651ae9e8b4",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Potential ADIDNS Poisoning via Wildcard Record Creation",
-    "sha256": "53543595176dfe8267e4ad2d5a70fdf91eaa2919aa81daf806a9d56daf0fd67a",
+    "sha256": "4a2ba32e4ade2dda214d50545bdffa1d1d97099b107e173b18969c0cc6b4fc31",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "8f3e91c7-d791-4704-80a1-42c160d7aa27": {
     "rule_name": "Potential Port Monitor or Print Processor Registration Abuse",
-    "sha256": "2593df86374cf3250f718b43d01f4e492da7574bdf8bc54867aad7fc465a8f60",
+    "sha256": "d66c39f3899393daf54a7c7c7bda79a52b0733a1e71b07e84a34707b1f8806bb",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "8f919d4b-a5af-47ca-a594-6be59cd924a4": {
     "min_stack_version": "8.14",
@@ -8567,21 +8622,21 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows",
-        "sha256": "feec1ce2bdf4dbddf251d9f16a07f5123eb30116c1ee43415fafe3390499db68",
+        "sha256": "fcce93128b54c854991bf62a7016a112b1eae5e6fa8d95fc7f0ce183c1695e49",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows",
-    "sha256": "8e6310e520c4ac17999de81799f5ab21b14bad01162d9cc5aa9bd5a8acd914c8",
+    "sha256": "c4aa90522a7d5aa3b88d0036b85d17990ea683e84e7567bc8c9393ae0bc21e42",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "8fb75dda-c47a-4e34-8ecd-34facf7aad13": {
     "rule_name": "GCP Service Account Deletion",
-    "sha256": "3c8184358856969e1362e374b7c72a678a3df1dc9ae082111b0ba80d01a44dcb",
+    "sha256": "2f1fff6789d5ceaa58f36f5b239347b6b2b5b222f513b7cc186e20a943add449",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "8fed8450-847e-43bd-874c-3bbf0cd425f3": {
     "rule_name": "Linux Restricted Shell Breakout via  apt/apt-get Changelog Escape",
@@ -8595,21 +8650,21 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Hping Process Activity",
-        "sha256": "59016f24c9fb4a9e0120058222b3dccfbc94b5d0316a6762207a6eb3fc312a0c",
+        "sha256": "58160571062e081d702d11bf00b07b9ca2dc75b7463e22d6eb58eb8c00ac7ae2",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Hping Process Activity",
-    "sha256": "ecea8fb1997a8b5e997b809e522afb4a39b60365f534b0cc14be6897d0df2907",
+    "sha256": "a60128d77de2c0eca6003d227982fc4c5c80c8c95e0da69ba91713797060a25d",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "9055ece6-2689-4224-a0e0-b04881e1f8ad": {
     "rule_name": "AWS Deletion of RDS Instance or Cluster",
-    "sha256": "123109fe70f635c2d9a5bae3df07789309b38a6d09b1d892aa2df1bdba5ad241",
+    "sha256": "ca9ec7ec6260dfb4afd6121acdc3f0f01cf82233de4bd473e0a4832ea5cca846",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "907a26f5-3eb6-4338-a70e-6c375c1cde8a": {
     "min_stack_version": "8.13",
@@ -8617,21 +8672,21 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Simple HTTP Web Server Creation",
-        "sha256": "616c2c8d1ae0e869534ba6f3f7f497bdd72792f46de42e6c51d6bebcf3eebd99",
+        "sha256": "4717868c8d8d29e5d6f9a575a34fa4d179d67b8a82e17f838845ba5c125ee114",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Simple HTTP Web Server Creation",
-    "sha256": "a8ecdc54a3793f8b6800533929726fab9b3f467cd74293c788c45f4706fcf60a",
+    "sha256": "df11460970a3eeb111f933ea0c48401c916e8f2f9ba35b1c8595a215b624242d",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "9092cd6c-650f-4fa3-8a8a-28256c7489c9": {
     "rule_name": "Keychain Password Retrieval via Command Line",
-    "sha256": "d0daaa99eff7d2f0f8a96916e7c4220209cc9015faebc9be56268cf601ac36b3",
+    "sha256": "e2adf962cb1b1cfaa01850f2abc72f2b56fb3c131551c98f605640ab10025952",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "909bf7c8-d371-11ef-bcc3-f661ea17fbcd": {
     "rule_name": "Excessive AWS S3 Object Encryption with SSE-C",
@@ -8669,33 +8724,33 @@
   },
   "9180ffdf-f3d0-4db3-bf66-7a14bcff71b8": {
     "rule_name": "GCP Virtual Private Cloud Route Creation",
-    "sha256": "ef3f13ea53f5eeca327dcdcd4a456b5375942dc90208cc6bced56c5c208eeb79",
+    "sha256": "139452a8b12f147a4c17f5b13922c44d88f841f111f7b4b06d4aebfd151c7061",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "91d04cd4-47a9-4334-ab14-084abe274d49": {
     "rule_name": "AWS WAF Access Control List Deletion",
-    "sha256": "7bcb7719e201f748986a026ff97c52bfce72b11730f1c15a39516be29c7fe7a1",
+    "sha256": "eadf846c26261704cc3fd68f5b83bf44f04f3b41d1c3b6392df97969cd66a749",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "91f02f01-969f-4167-8d77-07827ac4cee0": {
     "rule_name": "Unusual Web User Agent",
-    "sha256": "2acbdd0a26677cad2bb141876358cb764775e21d0e209f84d883f66ed4cc509c",
+    "sha256": "c52af5241e23b6ee752b9dc026a28a1aec7357c7f102ee305ad6447d3ea619b4",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "91f02f01-969f-4167-8f55-07827ac3acc9": {
     "rule_name": "Unusual Web Request",
-    "sha256": "974cc349d144864b4b2c7bf8228f2ef15c5942087c8d3b0c220d50909b0b8f71",
+    "sha256": "594a91f74bae3a825e91e973e29f5c443e2bdedb09b4e759c751c5a25aa63b43",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "91f02f01-969f-4167-8f66-07827ac3bdd9": {
     "rule_name": "DNS Tunneling",
-    "sha256": "97758f8c16d53ae0d9fd710f22e21664a5e7ac786569e132352b563c0fec69cb",
+    "sha256": "1460c1764afdd458a0891c83634804634714ece5f9e22aac3ad9c6bb91cd4351",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "929223b4-fba3-4a1c-a943-ec4716ad23ec": {
     "min_stack_version": "8.13",
@@ -8703,15 +8758,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "GitHub UEBA - Multiple Alerts from a GitHub Account",
-        "sha256": "dfae7535f5caafed8358bc16a68a6a501122ec05eae29c1f291da2416cad5ca9",
+        "sha256": "e05cc04048543a016fd0b4cfe4f9c7ef35ce1777a691f3305b103b16989fb6eb",
         "type": "threshold",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "GitHub UEBA - Multiple Alerts from a GitHub Account",
-    "sha256": "dfae7535f5caafed8358bc16a68a6a501122ec05eae29c1f291da2416cad5ca9",
+    "sha256": "e05cc04048543a016fd0b4cfe4f9c7ef35ce1777a691f3305b103b16989fb6eb",
     "type": "threshold",
-    "version": 101
+    "version": 102
   },
   "92984446-aefb-4d5e-ad12-598042ca80ba": {
     "min_stack_version": "8.14",
@@ -8735,15 +8790,15 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "A scheduled task was created",
-        "sha256": "51fc451b7a928144398a72653372d93f57fc18535dfb3a3667e6e7c3ec10f052",
+        "sha256": "d6747d1290f1796ed4e4f87144b3b8399615d65f1fc3916ffb33b2060b900a5b",
         "type": "eql",
-        "version": 9
+        "version": 10
       }
     },
     "rule_name": "A scheduled task was created",
-    "sha256": "e5b5be0c7d172af228b2b4d7673159c5732796739b2ca948c4486b38d6b867ac",
+    "sha256": "38d6ea55b4bc9a334bcda8a6cf1640203f0bb3b12a67a82301f1af5765c75412",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "92d3a04e-6487-4b62-892d-70e640a590dc": {
     "min_stack_version": "8.14",
@@ -8751,27 +8806,27 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential Evasion via Windows Filtering Platform",
-        "sha256": "4c1a9ea8c710b1e04ca1f0f4c3ded936d6b02249faca0a7424388c37e4c3782e",
+        "sha256": "fa28cefe9751d4a0325f5ebbe3ea32294ce408c668b871efac8d0eb508456468",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential Evasion via Windows Filtering Platform",
-    "sha256": "7ac59a9ca2f1b45c91bacb9ec313fd3e400a28a06751a9175f3262892e0f96fa",
+    "sha256": "1e99903005310727ca5c0bc4cc21adb68f7c312b54bc690ac668324fec1d34fd",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "93075852-b0f5-4b8b-89c3-a226efae5726": {
     "rule_name": "AWS STS Role Assumption by Service",
-    "sha256": "098648b0ec9a99626b4b9cacd20f79f9028f13d93cda5ddb8c02d9394c758353",
+    "sha256": "dcc381b0ea011aaffc99fa2552210fb9bd8cfae3fcd9a246033831836d4f5f3b",
     "type": "new_terms",
-    "version": 209
+    "version": 210
   },
   "931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4": {
     "rule_name": "Sudoers File Modification",
-    "sha256": "750c2d617d020e994dadb92ce3e0b585d16bbdc097fb24a656bb3e2f95ccae14",
+    "sha256": "c31135dc17960a856d35663ed054d09eab76047d10a86f30f4cf5b8ec1a7abe0",
     "type": "new_terms",
-    "version": 205
+    "version": 206
   },
   "9395fd2c-9947-4472-86ef-4aceb2f7e872": {
     "rule_name": "AWS VPC Flow Logs Deletion",
@@ -8785,15 +8840,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Suspicious SolarWinds Child Process",
-        "sha256": "6f65d57f4b54ada16ae7a6bf781a64d84a83409df693cadbcf9a736633154606",
+        "sha256": "2ff5b58315d4aee44cd2bcec8d5026cc4e7770e3bb4d906ca2489e2385babf3f",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Suspicious SolarWinds Child Process",
-    "sha256": "7363bf0ec1ba1d14c0e88b63d2dd0597d01dc13ab80fcd01d0ca58e10e232b4e",
+    "sha256": "55c655f3c81ec5fc6d674e2429a40bd0ea00235f4ce1935765a26941a143cde9",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "93c1ce76-494c-4f01-8167-35edfb52f7b1": {
     "min_stack_version": "8.14",
@@ -8801,22 +8856,22 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Encoded Executable Stored in the Registry",
-        "sha256": "f95c49826eef33b30e01391a89c37ed1375e8b0a6057adbe2925f8e4f9d7f4c4",
+        "sha256": "de92e4d989f9d5610e757c673fbdc4c456231b4ef81e7f4504698b6c264f9962",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 410,
         "rule_name": "Encoded Executable Stored in the Registry",
-        "sha256": "b5558abe7fd77b3214d07c369401260d1c211b91845eb37e5f92266ebf92ef54",
+        "sha256": "d85365573dabbdc204f56fef122dd591e689ffd34004f20d74d2c47e2aa4ec5b",
         "type": "eql",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Encoded Executable Stored in the Registry",
-    "sha256": "af45080cf231cdc384e6d85e2ccc178fd5b9cc69c739e04396373babe9b31ae5",
+    "sha256": "35de6ffd8fbe84e6ab25ad60ed8b87c3a2cc1e96bff7daa9699c9e6123acbcc9",
     "type": "eql",
-    "version": 411
+    "version": 412
   },
   "93e63c3e-4154-4fc6-9f86-b411e0987bbf": {
     "rule_name": "Google Workspace Admin Role Deletion",
@@ -8826,9 +8881,9 @@
   },
   "93f47b6f-5728-4004-ba00-625083b3dcb0": {
     "rule_name": "Modification of Standard Authentication Module or Configuration",
-    "sha256": "1e01d9186d48db4667fa030761b3f63e12f70737f7fb423eb05d385ad1e6db30",
+    "sha256": "2915057dbeddaff7f8345d24e40dd53ec41319b7192a27d93e593ef5eee6a45c",
     "type": "new_terms",
-    "version": 204
+    "version": 205
   },
   "94418745-529f-4259-8d25-a713a6feb6ae": {
     "min_stack_version": "8.13",
@@ -8836,15 +8891,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Executable Bit Set for Potential Persistence Script",
-        "sha256": "74aed1e2b14f06f985dcdda41a9373194206e0d5b6136dc5af2c15f72a430fc0",
+        "sha256": "16145a1b22661ff2e88c9e1ba07836862628630beefcda649d52f876480530d4",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Executable Bit Set for Potential Persistence Script",
-    "sha256": "bc41244d94cc85db15513c451863fe2ca0b0a9340c5b8686813eee0609b3917e",
+    "sha256": "b5f2d2b732ed56124dc1f618c8aaa4a1b035b3af81246aca47b16d675c5888f0",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "947827c6-9ed6-4dec-903e-c856c86e72f3": {
     "rule_name": "Creation of Kernel Module",
@@ -8858,22 +8913,22 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Group Policy Discovery via Microsoft GPResult Utility",
-        "sha256": "92f99ada650ca1643ca9d74eeb044541cd01943858f78c837320f22b52db65d1",
+        "sha256": "4fa63aacb71764801fa191bd2326696f937bd85aa84baa0883b51ec2b967b3b8",
         "type": "eql",
-        "version": 10
+        "version": 11
       },
       "8.13": {
         "max_allowable_version": 208,
         "rule_name": "Group Policy Discovery via Microsoft GPResult Utility",
-        "sha256": "5d504991acb458ceeb163edfc30f03c2b639725ce90470439bd1854d0c508ea5",
+        "sha256": "1d785de785b00340684b4e0f441211c357cf2ee299f22b28f3bb5e2a3bdf1784",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Group Policy Discovery via Microsoft GPResult Utility",
-    "sha256": "5ac9902c4013c4a43232005924bbd2e3ea5837f3b1fb46536414e31a990e9dfb",
+    "sha256": "10a993dd4620cab6a35f2dfbdfb89ca009ba18a7c60e6e10c93bc8954cacb6bd",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "94e734c0-2cda-11ef-84e1-f661ea17fbce": {
     "min_stack_version": "8.15",
@@ -8881,22 +8936,22 @@
       "8.13": {
         "max_allowable_version": 102,
         "rule_name": "Multiple Okta User Authentication Events with Client Address",
-        "sha256": "15d93711d02522f4cc0cb04625d1b2a3213f4b14abf4e42b9b10f1f7fbdcb380",
+        "sha256": "81219dd2b471c66d9005d11edc88ba7fb5ab4f7f886b8417e1d3dab37f366606",
         "type": "esql",
-        "version": 3
+        "version": 4
       },
       "8.14": {
         "max_allowable_version": 202,
         "rule_name": "Multiple Okta User Authentication Events with Client Address",
-        "sha256": "15d93711d02522f4cc0cb04625d1b2a3213f4b14abf4e42b9b10f1f7fbdcb380",
+        "sha256": "81219dd2b471c66d9005d11edc88ba7fb5ab4f7f886b8417e1d3dab37f366606",
         "type": "esql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Multiple Okta User Authentication Events with Client Address",
-    "sha256": "15d93711d02522f4cc0cb04625d1b2a3213f4b14abf4e42b9b10f1f7fbdcb380",
+    "sha256": "81219dd2b471c66d9005d11edc88ba7fb5ab4f7f886b8417e1d3dab37f366606",
     "type": "esql",
-    "version": 203
+    "version": 204
   },
   "9510add4-3392-11ed-bd01-f661ea17fbce": {
     "rule_name": "Google Workspace Custom Gmail Route Created or Modified",
@@ -8910,22 +8965,22 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential PowerShell Pass-the-Hash/Relay Script",
-        "sha256": "094d5839307d9e9f979d87f04da382a99499e6932f5c04d08583d33439593897",
+        "sha256": "30e9709aa596d9469d905ec6593683478b4eeb9a2d40edb724b0c2e5f1ba6bd2",
         "type": "query",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential PowerShell Pass-the-Hash/Relay Script",
-    "sha256": "6ec2f6a7128677f6221950458047a3b8e1280a63bea437a60b9c6da72c55d746",
+    "sha256": "d44b1b9ef878285d8dd07da49ecf77844b4892d271d1ebd4ac6631939dd3857e",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "952c92af-d67f-4f01-8a9c-725efefa7e07": {
     "min_stack_version": "8.13",
     "rule_name": "D-Bus Service Created",
-    "sha256": "f153afa77c393c47714f3400013c4ee67412920ecc93b851d389d74b5f049040",
+    "sha256": "f49342d2753a20175c2dbbc0a575357ee2a7bbc665af3267b73778f6270b6bcc",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "954ee7c8-5437-49ae-b2d6-2960883898e9": {
     "min_stack_version": "8.14",
@@ -8965,34 +9020,34 @@
       "8.13": {
         "max_allowable_version": 102,
         "rule_name": "Multiple Okta User Authentication Events with Same Device Token Hash",
-        "sha256": "96b9820b5e4c84ca9db4bfedf6a6ed4f52d60865ad849274c922a4f9218be379",
+        "sha256": "a085a6ef8490d83757962f54f7be99b6c5ef0cec9446e6dc1eb1f17ce5848d85",
         "type": "esql",
-        "version": 3
+        "version": 4
       },
       "8.14": {
         "max_allowable_version": 202,
         "rule_name": "Multiple Okta User Authentication Events with Same Device Token Hash",
-        "sha256": "96b9820b5e4c84ca9db4bfedf6a6ed4f52d60865ad849274c922a4f9218be379",
+        "sha256": "a085a6ef8490d83757962f54f7be99b6c5ef0cec9446e6dc1eb1f17ce5848d85",
         "type": "esql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Multiple Okta User Authentication Events with Same Device Token Hash",
-    "sha256": "96b9820b5e4c84ca9db4bfedf6a6ed4f52d60865ad849274c922a4f9218be379",
+    "sha256": "a085a6ef8490d83757962f54f7be99b6c5ef0cec9446e6dc1eb1f17ce5848d85",
     "type": "esql",
-    "version": 203
+    "version": 204
   },
   "962a71ae-aac9-11ef-9348-f661ea17fbce": {
     "rule_name": "AWS STS AssumeRoot by Rare User and Member Account",
-    "sha256": "85feced66a2d2b2c88a257f2aa26916b9bff95d08871035e142b35191149d8cd",
+    "sha256": "433032becb5c8020450493b9158692e4e8e93ce81f820b25705231f2942dd2bc",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "9661ed8b-001c-40dc-a777-0983b7b0c91a": {
     "rule_name": "Sensitive Keys Or Passwords Searched For Inside A Container",
-    "sha256": "54b3d3c9b093b147b2a9544592815de34c26f37b971ca155743f92fafcd674b9",
+    "sha256": "79d1b7004319abbd6311a32bb7e63bdb9edf25beaba2503a2bb7fe596b63048a",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "968ccab9-da51-4a87-9ce2-d3c9782fd759": {
     "min_stack_version": "8.13",
@@ -9000,15 +9055,15 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "File made Immutable by Chattr",
-        "sha256": "554e2d9f8e0757200b05413ef711c554856e94d6e704b08e57b934f69a26ba7c",
+        "sha256": "61a885e5fd8caa58db1e46f7ac46a9212cb60f45987a57654e44fccf0044273d",
         "type": "eql",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "File made Immutable by Chattr",
-    "sha256": "86e3735f45437f53bd1261a8da6628e3dfcb6825b335f3447c39923c2c38690a",
+    "sha256": "2cccc89db8fd4c8b5997d76d60b9d16e04ad9016804c886fefb7be5155c551e4",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "96b9f4ea-0e8c-435b-8d53-2096e75fcac5": {
     "min_stack_version": "8.15",
@@ -9016,34 +9071,34 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Attempt to Create Okta API Token",
-        "sha256": "f4de9d3ab038aa89e893c49c11b5d115923ae5c2bf45c488fd4538636cc5a17d",
+        "sha256": "8b9151616759ad5ef0331c84d359b1fac9dd5625d8bccc8ccfc29b6edec463ec",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Attempt to Create Okta API Token",
-        "sha256": "f4de9d3ab038aa89e893c49c11b5d115923ae5c2bf45c488fd4538636cc5a17d",
+        "sha256": "8b9151616759ad5ef0331c84d359b1fac9dd5625d8bccc8ccfc29b6edec463ec",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Attempt to Create Okta API Token",
-    "sha256": "2cdb992ac7d1102df02c4ebc8d329dc538c2e5c9c67ca727b0e130a3ad873b19",
+    "sha256": "72dc3ad1b6b20812a65c1e7f6cc607abd7f61572f341de9e3914d9355437b4e5",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "96d11d31-9a79-480f-8401-da28b194608f": {
     "rule_name": "Message-of-the-Day (MOTD) File Creation",
-    "sha256": "dee0fa159010c2aba6be29979a0ca7a24423ce4b2897d3bde2f635ddff3fe6c8",
+    "sha256": "d242e9b768158e113d5b497903704bcf3417ee47dc9240caed8322566a25a388",
     "type": "eql",
-    "version": 12
+    "version": 13
   },
   "96e90768-c3b7-4df6-b5d9-6237f8bc36a8": {
     "rule_name": "Access to Keychain Credentials Directories",
-    "sha256": "a4bde834d3628dca2daee592ed3741c7ccd55a25840f58603fdccb98e7368d63",
+    "sha256": "a58b0877159c33e555ae1f66edde525a759a987fcc04a91aabbd2a35aa5cd863",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "97020e61-e591-4191-8a3b-2861a2b887cd": {
     "min_stack_version": "8.14",
@@ -9051,46 +9106,46 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "SeDebugPrivilege Enabled by a Suspicious Process",
-        "sha256": "59ac20ddf0ad6c973682600530ec32145c00eecd4dadbd7760ff440d6eaee57c",
+        "sha256": "61c1a4427e02b605bc3f9c668f45b6c876d901b271b04e6d5ab681b96370ef3c",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "SeDebugPrivilege Enabled by a Suspicious Process",
-    "sha256": "d04ceea45c0ac0f1155e702d8add70dc3c753a765f23720895f180232c65a4a4",
+    "sha256": "a3103e7a211a1b85248f488f250216ebfa31f23d029f49d87340c7c74ebbf34a",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "9705b458-689a-4ec6-afe8-b4648d090612": {
     "min_stack_version": "8.13",
     "rule_name": "Unusual D-Bus Daemon Child Process",
-    "sha256": "fbbfbd97ebae57de46748c99eeddc873d89daf60f1b8c8f95b9c1a99420d1285",
+    "sha256": "047f6e5a12bc33a0db9822bfcc4d9532eb5bb20f261dc8d5d0a6b9d335db1175",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "97314185-2568-4561-ae81-f3e480e5e695": {
     "rule_name": "Microsoft 365 Exchange Anti-Phish Rule Modification",
-    "sha256": "9c1981f0822634de6f020d5301b100c703d19724dd486e288398596ff23b18e6",
+    "sha256": "996edcf7b84f597c5b917b95706acfa718b8b78ac0fbaaa24a1c9a164374d32b",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "97359fd8-757d-4b1d-9af1-ef29e4a8680e": {
     "rule_name": "GCP Storage Bucket Configuration Modification",
-    "sha256": "8898fb2725e12947da9bb2c12a300e9093f6eef9c309b3ff30af48d018501dd6",
+    "sha256": "a68596e0c8c08057fe0d449a485c3024b5c19a131d0f8e73a91070d52b2aa5e3",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "97697a52-4a76-4f0a-aa4f-25c178aae6eb": {
     "rule_name": "File System Debugger Launched Inside a Privileged Container",
-    "sha256": "8b70f35aa7a70d475832890edfe725b921a6d72b0a57011af9fb02e3d81525b9",
+    "sha256": "38153858d0ad809d23edde22212b8e76f0e17a2813aeb4b4b8144dd46c1dc699",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "979729e7-0c52-4c4c-b71e-88103304a79f": {
     "rule_name": "AWS IAM SAML Provider Updated",
-    "sha256": "4ef7bf5e39de2d55f436f611e2de8f1d905d1ea116d8ff8000753ceb8d2663fc",
+    "sha256": "15acaee88ae03f37d33254f0274ae68eeef32455fc96461fe20aefd88e49b24d",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7": {
     "min_stack_version": "8.15",
@@ -9098,22 +9153,22 @@
       "8.12": {
         "max_allowable_version": 311,
         "rule_name": "Potentially Successful MFA Bombing via Push Notifications",
-        "sha256": "8a7ee34a8a996304a6a02fb42164407adaa2ec59ef82c157e9237d869562a7ee",
+        "sha256": "c3895c292a7d6d01c0202991f5bd5c8286f59782f74ce2d31d2e5154428be6e1",
         "type": "eql",
-        "version": 212
+        "version": 213
       },
       "8.14": {
         "max_allowable_version": 412,
         "rule_name": "Potentially Successful MFA Bombing via Push Notifications",
-        "sha256": "8a7ee34a8a996304a6a02fb42164407adaa2ec59ef82c157e9237d869562a7ee",
+        "sha256": "c3895c292a7d6d01c0202991f5bd5c8286f59782f74ce2d31d2e5154428be6e1",
         "type": "eql",
-        "version": 313
+        "version": 314
       }
     },
     "rule_name": "Potentially Successful MFA Bombing via Push Notifications",
-    "sha256": "008509519ef384a0fe13547767628714a007b44d9504b72e47cd06f58eda5286",
+    "sha256": "31c83a49dd77cb7c92b81b820392ab0edaff0810927f55cfe52754a54a43a48a",
     "type": "eql",
-    "version": 413
+    "version": 414
   },
   "97aba1ef-6034-4bd3-8c1a-1e0996b27afa": {
     "min_stack_version": "8.14",
@@ -9121,22 +9176,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Suspicious Zoom Child Process",
-        "sha256": "5f50216e837aebb5103936a65d7bb07f9ef153d873db29761cc5fe034c150aea",
+        "sha256": "9de7f3413eaf33a9a4c7ff77a174eab1cc42d1f3c3f4327567efe65ce7c7db7d",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 413,
         "rule_name": "Suspicious Zoom Child Process",
-        "sha256": "60e026edebd1c4bcfd0580ec04e257e406ecedb6ace76131d14a9bbcad9535ee",
+        "sha256": "d2b8083ef96d8b40fa12bfc2f2ef8433f49b06144264a9bb5cf5d805f26f34e3",
         "type": "eql",
-        "version": 315
+        "version": 316
       }
     },
     "rule_name": "Suspicious Zoom Child Process",
-    "sha256": "3db79975854f188574aa5d5aec5b4fe1e5375be640e0ac15fa02437975ef0d7e",
+    "sha256": "75a2acd6fec4e5e9aa275a9b8af68eb1de804913337ede2bfbcd0420422bc0ff",
     "type": "eql",
-    "version": 416
+    "version": 417
   },
   "97da359b-2b61-4a40-b2e4-8fc48cf7a294": {
     "rule_name": "Linux Restricted Shell Breakout via the ssh command",
@@ -9146,9 +9201,9 @@
   },
   "97db8b42-69d8-4bf3-9fd4-c69a1d895d68": {
     "rule_name": "Suspicious Renaming of ESXI Files",
-    "sha256": "134cc7f77ddd008b061f698e64cd7b3c5fc67db9adca8e3ecc35436d6136bc39",
+    "sha256": "4ca383b998699336db64bc99ee8c2a7b52c0fe6e2e57a2a424262b1656f15539",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "97f22dab-84e8-409d-955e-dacd1d31670b": {
     "rule_name": "Base64 Encoding/Decoding Activity",
@@ -9158,21 +9213,21 @@
   },
   "97fc44d3-8dae-4019-ae83-298c3015600f": {
     "rule_name": "Startup or Run Key Registry Modification",
-    "sha256": "d8b7b25e2fefe1dc94dd57ee87b2dd576cc089e5d7a78dcb91f493b33e925285",
+    "sha256": "814a1903fe60035acd9815188db701fecb3cd77f622205487cbb5dcdd5895034",
     "type": "eql",
-    "version": 113
+    "version": 114
   },
   "980b70a0-c820-11ed-8799-f661ea17fbcc": {
     "rule_name": "Google Workspace Drive Encryption Key(s) Accessed from Anonymous User",
-    "sha256": "13bb60d5c1f5306bc12b67f81f15a38dc8238c2cd154896536269d9668d075cc",
+    "sha256": "9af59876aae930d88fa37449a4e391434ac253a1a3a68a7f19aa8142681af396",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "9822c5a1-1494-42de-b197-487197bb540c": {
     "rule_name": "Git Hook Egress Network Connection",
-    "sha256": "8e57b1dbf16d5746922b8edafe41713555a95bb09c7bc1b9f9f63a00bd5c3724",
+    "sha256": "c07414c56696bd71465558933f65566b033635cd7cf42419eb70a7695eddf4ac",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "986361cd-3dac-47fe-afa1-5c5dd89f2fb4": {
     "min_stack_version": "8.13",
@@ -9180,15 +9235,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Suspicious Execution from Foomatic-rip or Cupsd Parent",
-        "sha256": "9921b21414e5f26b0a92efb35b3aa687685d77a03473e8f2f74e4eb5def0f2c7",
+        "sha256": "71605f19bbfc7c7d7b38c3c938e25db98327f11a8597bfc3707c0b7936fc407f",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Suspicious Execution from Foomatic-rip or Cupsd Parent",
-    "sha256": "bf30f1636a07e74463574f49efab7d6e8b0cb58dfdcbc00486a72ea8388c3439",
+    "sha256": "0c916283ee1f0d1637c62ca43d6d9d0ecedc506d586db6f76fbb4760f241bca3",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "98843d35-645e-4e66-9d6a-5049acd96ce1": {
     "min_stack_version": "8.14",
@@ -9208,15 +9263,15 @@
   },
   "9890ee61-d061-403d-9bf6-64934c51f638": {
     "rule_name": "GCP IAM Service Account Key Deletion",
-    "sha256": "f6e73ab78ecb9bdcafce24cf4de95c3ad91c3b9f84ebde53d8a1184c1145cbff",
+    "sha256": "2df4707335bb89c170cda8fb27a189ca2e1da3b0a558637041354bc560f3c934",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "98995807-5b09-4e37-8a54-5cae5dc932d7": {
     "rule_name": "Microsoft 365 Exchange Management Group Role Assignment",
-    "sha256": "e5669429abd5547d912048bcc97739ccf3bfa45d4d74e324d1ab2bfd2076322c",
+    "sha256": "193707cacca422693c80b0f220dc512aceef3c53ab09b92a266c678eb5066f0a",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "98fd7407-0bd5-5817-cda0-3fcc33113a56": {
     "rule_name": "AWS EC2 Snapshot Activity",
@@ -9226,15 +9281,15 @@
   },
   "990838aa-a953-4f3e-b3cb-6ddf7584de9e": {
     "rule_name": "Process Injection - Prevented - Elastic Endgame",
-    "sha256": "a02da9b5d7a30fe8e11ecdc06e8302ca4077986141d830dffc5a3ea2af2180fa",
+    "sha256": "635f24d3547bdf9acf3c89fcf9ca0a208ab9c5728c280fb1ef000066cf7d0b15",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "99239e7d-b0d4-46e3-8609-acafcf99f68c": {
     "rule_name": "MacOS Installer Package Spawns Network Event",
-    "sha256": "a13a4be8fd4f869d6387397192b1e56e6ff008c345ae84e5fafd4a4d28697584",
+    "sha256": "d58c1f45d74532cc49086f3fc2b1694098a7286463f0cea3fe7512d6b681a085",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "994e40aa-8c85-43de-825e-15f665375ee8": {
     "min_stack_version": "8.14",
@@ -9242,15 +9297,15 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score",
-        "sha256": "295b6b5f0bcc7c346200669736ff41d92683604648d0d0c729da6030e1edd0c3",
+        "sha256": "f9bab10027d4eaff5c7cadc5613cfdfe2caf71917f01c2298779b3693e458905",
         "type": "eql",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score",
-    "sha256": "85e5f6ced29ac3d6e31d6e1f4a7c0b4f2599e27e53092e952773acedced38cf5",
+    "sha256": "aff8ce3c97b8657b94418ecea700cdbd08933e40dae51fc4cac6978e212ebbae",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "9960432d-9b26-409f-972b-839a959e79e2": {
     "min_stack_version": "8.14",
@@ -9258,15 +9313,15 @@
       "8.12": {
         "max_allowable_version": 309,
         "rule_name": "Potential Credential Access via LSASS Memory Dump",
-        "sha256": "ef4ab01243093fb107143c9c879d95c94d0a15e29c620d322d4436d62edd5db3",
+        "sha256": "d1a480f7832f8712d06096eb7dd3d5ff5ebd8c57a23ccb530abd85f8523c12ad",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Potential Credential Access via LSASS Memory Dump",
-    "sha256": "4bf6f2a660c85fd28a35ddf6782205584eb0a142d6df00a0777a759911565330",
+    "sha256": "c655401d4db3c1c8925fad88f4c58efa5897f96092a4eb5e5f39f19ee391aa73",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "999565a2-fc52-4d72-91e4-ba6712c0377e": {
     "min_stack_version": "8.13",
@@ -9274,15 +9329,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Access Control List Modification via setfacl",
-        "sha256": "56c8562c3f638627b4748c065a8c8c771c5192aeeafeb828cb96f7150784c66f",
+        "sha256": "59b417d5b2a03bba13ec5f3948f8dea5787846aa669acafde0f1edf8f4c9179b",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Access Control List Modification via setfacl",
-    "sha256": "5fabd6c9b8a348ecdbb6ccf61bd29115e1088e89d594036cb436531de8418315",
+    "sha256": "fd3dc1350984a9b8467d555f148ef21d43fb04f913791ca642896a5a39069f55",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "99c2b626-de44-4322-b1f9-157ca408c17e": {
     "min_stack_version": "8.13",
@@ -9290,15 +9345,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Web Server Spawned via Python",
-        "sha256": "34fe21a4d673170b9d5de7326cc8f18a359a13a6b97d49085d89e96cf0f9952a",
+        "sha256": "590abb2de8685e9ba6ac1bb26b5ba6e6799b404bca1b24fed7d7e3c37f8f4452",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Web Server Spawned via Python",
-    "sha256": "20fb46e1ca6890605aa87f9c08a2190c217b23b3759cc7eca032edf59af64ec3",
+    "sha256": "177d077650fa0b0c0a8d232ffd7f502d9de98c9d95e244261e6accf6e9f047bd",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "99dcf974-6587-4f65-9252-d866a3fdfd9c": {
     "rule_name": "Spike in Failed Logon Events",
@@ -9309,9 +9364,9 @@
   "9a1a2dae-0b5f-4c3d-8305-a268d404c306": {
     "min_stack_version": "8.12",
     "rule_name": "Endpoint Security (Elastic Defend)",
-    "sha256": "a4dde703652ee6884fe682bb32efc9fe966aaa7df53bca5436de63d993527889",
+    "sha256": "fe3e81fc1a5dd73c6932676c7b09d087a3b3848733fa74eb5a2b18f068972549",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "9a3884d0-282d-45ea-86ce-b9c81100f026": {
     "rule_name": "Unsigned BITS Service Client Process",
@@ -9321,9 +9376,9 @@
   },
   "9a3a3689-8ed1-4cdb-83fb-9506db54c61f": {
     "rule_name": "Potential Shadow File Read via Command Line Utilities",
-    "sha256": "aa9fc82aa5324a0f942d1115e319178f8cb830f3e6d3a881a1859865b3768db5",
+    "sha256": "957303ee184b536fc22f9671dbb2ed19527c497f148615b01ab438db8d2d1748",
     "type": "new_terms",
-    "version": 209
+    "version": 210
   },
   "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b": {
     "min_stack_version": "8.14",
@@ -9331,22 +9386,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Suspicious Explorer Child Process",
-        "sha256": "73643376218cb6a9dc9c17dcbc0e1e2a68c19dba4b20e180663b4a7c2a5953b7",
+        "sha256": "dd9f2215be389c33f7a237f9116f9ebfcdc92de051c6babfea314a2664c84bd0",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Suspicious Explorer Child Process",
-        "sha256": "8911b89e1d09588deb7e5a942983225efff7df52cca7afc92f98f0875de1c7e2",
+        "sha256": "a2a0a26741e33b91efa6e94308f5e4734607222ce87fffcf03ad1682e63fe624",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Suspicious Explorer Child Process",
-    "sha256": "155a1370c4fc3154277e3947dd506fb75a99bd378727d59485c4e1947de04ecc",
+    "sha256": "e26c452a699c5910201336b89c6df67ad2e167129b2cad1f19a687282dc07362",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "9aa0e1f6-52ce-42e1-abb3-09657cee2698": {
     "min_stack_version": "8.14",
@@ -9354,29 +9409,29 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Scheduled Tasks AT Command Enabled",
-        "sha256": "51c952240fcbd97d71e3989752daabd44ef67ec404062d9ac0aa77ec5eefbd88",
+        "sha256": "a89728e7de28de1f41f89eae6884b7434dbd8f948cd682f6a0621a4cd7027067",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Scheduled Tasks AT Command Enabled",
-        "sha256": "f3167a9539280f0deb3103a26e2dad2bc7f971e05e60885f5a533db2ba730fa2",
+        "sha256": "bb878ddab8423add89b2fa6d67e8fb17d61aea08318d7adcc5f16859511228ec",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Scheduled Tasks AT Command Enabled",
-    "sha256": "6c0f3e8a857f02183dd2476acbc51cd2417ad39b9a38013caea85872f6c0495f",
+    "sha256": "bb1dc73390bf4205bc5518949d88f85a8ab64938716323d47e6c8a36817c07a2",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "9aa4be8d-5828-417d-9f54-7cd304571b24": {
     "min_stack_version": "8.13",
     "rule_name": "AWS IAM AdministratorAccess Policy Attached to User",
-    "sha256": "19bb01d2bfc28053a0a6ef4bba3cc428e187d1c71998e94cabcc80b2b15ef822",
+    "sha256": "5261d7a8d3df0f503139f70be2c16478f9da435dcb45315321b70c9f0136c973",
     "type": "esql",
-    "version": 4
+    "version": 5
   },
   "9b343b62-d173-4cfd-bd8b-e6379f964ca4": {
     "min_stack_version": "8.13",
@@ -9384,15 +9439,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "GitHub Owner Role Granted To User",
-        "sha256": "a4b8ee93d7e52d2b59d4df47a27d69a9e5fba2c405d327006dddd367e0aedf2c",
+        "sha256": "161fe9bc03f0a9bd845c1f1a27a75b057d54285240798bac0af9d268896a8ec6",
         "type": "eql",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "GitHub Owner Role Granted To User",
-    "sha256": "558e67c243e29f42d2e6f835e01185da82c48dc95e4322d0b21ab5addfe04e68",
+    "sha256": "17b30931a90a1e2a268c89b8ca1c50d33a9ad847cf40b03526748115fa47df6f",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c": {
     "min_stack_version": "8.14",
@@ -9400,28 +9455,28 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Persistence via WMI Event Subscription",
-        "sha256": "f84d0750e79c7e23c031d4418102d9813c8bf40cf0c1c297bb68b2e68ecd6662",
+        "sha256": "034dbbe0e465dbc6001136495954743ac55334e869c7c26cc9a626641ff6aa1b",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "Persistence via WMI Event Subscription",
-        "sha256": "890f3569bcc29ef77a9be476b20376ebe51917937cb2bde1ca196f0698b6c9ff",
+        "sha256": "0912aa1b6bc991c999aa95627f0b21c7a306638eb24927bdceb97a8ff3299250",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Persistence via WMI Event Subscription",
-    "sha256": "894cde78d489d010f90f6c225dc210803634f3e1d380a685cea35bd4605694ef",
+    "sha256": "a374edbd21cdd1d173a65c55d3d972a408a56b5c6350100b0dac8c36141ab105",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "9b80cb26-9966-44b5-abbf-764fbdbc3586": {
     "rule_name": "Privilege Escalation via CAP_SETUID/SETGID Capabilities",
-    "sha256": "818ec7b5077ef339d297c377bd56ef3592dbf978c6f01eab575e082d7ec31f59",
+    "sha256": "cb064b54fbccc8e07affaf57e4d14856f67f6918ff0c44205cd1c23aa4dcf427",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "9c260313-c811-4ec8-ab89-8f6530e0246c": {
     "min_stack_version": "8.14",
@@ -9441,9 +9496,9 @@
   },
   "9c5b2382-19d2-4b5d-8f14-9e1631a3acdb": {
     "rule_name": "Unusual Interactive Shell Launched from System User",
-    "sha256": "b203af3a5e4914073b4c50ace39c1cd98fff18e024f1810b36679a1ae394cf3a",
+    "sha256": "b351f332d2ee0c37576188cba134e30d7fc288887cfb5247b494162043ce2343",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "9c865691-5599-447a-bac9-b3f2df5f9a9d": {
     "min_stack_version": "8.14",
@@ -9451,21 +9506,21 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Remote Scheduled Task Creation via RPC",
-        "sha256": "247721b2ad4e7f9a94e9bbd1effaef53279a2504856ed04ae48b17a46729cccb",
+        "sha256": "3e15a597d73ad4a145c44b02a7b7c7cd1825b1cd4c5a3278a1c07008434f6a08",
         "type": "eql",
-        "version": 9
+        "version": 10
       }
     },
     "rule_name": "Remote Scheduled Task Creation via RPC",
-    "sha256": "9860fa33ea3768742f597c39c25196697991a88b7dc7cf668e73827b1da60387",
+    "sha256": "dc1a5b32175347af1afd41737265cbb2862a8c64a10583b52fa85a49f73f1afa",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "9c951837-7d13-4b0c-be7a-f346623c8795": {
     "rule_name": "Potential Enumeration via Active Directory Web Service",
-    "sha256": "8e3c38ce419b110b9a63f544e1faf01b054304e08d40cb4e20a08b87e0ef44c1",
+    "sha256": "a5aa8f87141efb58c5a9fc040430072979a81838fc6185b652fc5d08cae05ac5",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "9ccf3ce0-0057-440a-91f5-870c6ad39093": {
     "min_stack_version": "8.14",
@@ -9473,22 +9528,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Command Shell Activity Started via RunDLL32",
-        "sha256": "c9b88b1d61f94153253dffb64b83381cc6f37396d6969056f29e0e983d7f0057",
+        "sha256": "97790052feabd6d8d92049481818933f920d5128b459958b23b4f454788e1926",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Command Shell Activity Started via RunDLL32",
-        "sha256": "382fed94a5329814298bb2fe0283ed3c63d2c0ff9293e69efad3950dfe08121e",
+        "sha256": "b70867b53f9047d648a74ee785fbfb344461397ac17e24dfb7d85c50b80bd906",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Command Shell Activity Started via RunDLL32",
-    "sha256": "71bbd98aa70c506906a99a90cb6f320ba14cfe6276decafe44eb330c1a9e7428",
+    "sha256": "d16970d52f5665857e15296e8ce24758baf698ceafc64a1ac5355b5c221c2692",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "9cf7a0ae-2404-11ed-ae7d-f661ea17fbce": {
     "rule_name": "Google Workspace User Group Access Modified to Allow External Access",
@@ -9508,15 +9563,15 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "Microsoft Build Engine Started by a Script Process",
-        "sha256": "927ea94b2491233b45213f4d45a252a511d8929778022d54b8ce9c55b572508c",
+        "sha256": "c6feee8b5f84305767251a5980243998d9d4ba2743ad9874895791e3fa10e948",
         "type": "new_terms",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Microsoft Build Engine Started by a Script Process",
-    "sha256": "37eced0f6fbe00d0d4f72c4340aafc08a0e4649d41713d82af3cbe9cdec35360",
+    "sha256": "8781554bff624a0faedf21aec63a088525699563be1aa50547303cc3af235151",
     "type": "new_terms",
-    "version": 311
+    "version": 312
   },
   "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3": {
     "min_stack_version": "8.14",
@@ -9524,22 +9579,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Microsoft Build Engine Started by a System Process",
-        "sha256": "dbaff78cc444435417a8dc117e92fac3f383f660e8ec2efc3882be4df7be8641",
+        "sha256": "bfab358531d2fb7cfa9b7a47b1508d37b00322f539ac43fa61530596a4eb2466",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Microsoft Build Engine Started by a System Process",
-        "sha256": "1a76f0bbf93f2e947cf44f3a49de094b9821895129e1861a2e6f30b6af1e9ea1",
+        "sha256": "29e49c1b420b1f8b800a4ac388b31b3bdbd3de5b3d1bd4a25b3655c2879ec8ed",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Microsoft Build Engine Started by a System Process",
-    "sha256": "b231de2975d9c748c61f7f29bd2b82eff7dc7eeb84a3b7e15858428d7acce811",
+    "sha256": "3462d5554238a5314c72b9c3f0c56611fd6c922c4c7ee065d1ffc95969e14966",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4": {
     "min_stack_version": "8.14",
@@ -9547,15 +9602,15 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Microsoft Build Engine Using an Alternate Name",
-        "sha256": "a49d6fb17cca15bf6ca569b7a9ed627b4ac76c4508e50fca28a4a267dc420ad4",
+        "sha256": "1658b389087bc7cd6ee91ffc89a1714168b562dd44451d4c4d6f72702036b9a4",
         "type": "eql",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Microsoft Build Engine Using an Alternate Name",
-    "sha256": "e5c954ed07e9fd47ada5f8b7e54e8b4a9dbd25bee53943caa9897ffba3703f10",
+    "sha256": "ba5fd2330dd1b6032d2553050acd7351a5e7cd9c1f74152c0fc5a78d0732b6ae",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5": {
     "min_stack_version": "8.14",
@@ -9563,15 +9618,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Potential Credential Access via Trusted Developer Utility",
-        "sha256": "b1e378c91ed40734538a8f0ef48435f4f5e8446ac71e923e12737fe89f84b8c5",
+        "sha256": "0bb18ca3b493310ba23b616de3d39cfba94773b53140eafec03abd781a5897c2",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Potential Credential Access via Trusted Developer Utility",
-    "sha256": "402957a0efead0143ad51d2e826e9107da5aef344e559d2c85478257a3aa15b0",
+    "sha256": "aef7f15ace1ec416d8e85249577e2301f49840b905843d141189269d3f904f75",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6": {
     "min_stack_version": "8.14",
@@ -9579,15 +9634,15 @@
       "8.12": {
         "max_allowable_version": 313,
         "rule_name": "Microsoft Build Engine Started an Unusual Process",
-        "sha256": "357cfd30e6d72e8067b8fd85480960fc82ed8f8735df37e327c18110e32d637e",
+        "sha256": "e084fdc2aeb3587b28f10bf09ec2903a8523537a67b3b1538f46727a736d16f8",
         "type": "new_terms",
-        "version": 214
+        "version": 215
       }
     },
     "rule_name": "Microsoft Build Engine Started an Unusual Process",
-    "sha256": "11b4fc95052ff2e6c25c718c92d10ff5bfcc0c4e6b2dfce4802d5ff828416772",
+    "sha256": "35156b3e9740e59353d84856c46b8780be71d93b456573600a2f5093cea01698",
     "type": "new_terms",
-    "version": 314
+    "version": 315
   },
   "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9": {
     "min_stack_version": "8.14",
@@ -9595,33 +9650,33 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Process Injection by the Microsoft Build Engine",
-        "sha256": "eb466a234b50a51692e4c5678572f202d8d11c886c5676f92df089866b6613dc",
+        "sha256": "6e08e0961e8712e3fa798614ceba20842f1fd9e78569f3efb5b0236bd2ffaadf",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Process Injection by the Microsoft Build Engine",
-    "sha256": "cb223017b8d3219787c5490b16190472e106e9b56b2efb8d0d5e50af116f48d0",
+    "sha256": "926469208de2cc16311faa56f835813cb0da62cf3ee0ff79366e3c2572a11edf",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "9d19ece6-c20e-481a-90c5-ccca596537de": {
     "rule_name": "LaunchDaemon Creation or Modification and Immediate Loading",
-    "sha256": "7320bfb081717b130f02dbd9cf9b41a6d9df14eeb6eadaa18a986b64c7a798f8",
+    "sha256": "ee6fd1c193ca3176b28e1944ae22027cdbe34e8151a5571d2c9571ae0970960a",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "9d302377-d226-4e12-b54c-1906b5aec4f6": {
     "rule_name": "Unusual Linux Process Calling the Metadata Service",
-    "sha256": "1c176b99688c3dfffb29f7fd942a5db17890c0e4c8507595266a7ef192f0698c",
+    "sha256": "4ce9e353cd70a52c2d7d94beb8a05952a35ff6c117689d5ce2d9a7da5af011aa",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "9efb3f79-b77b-466a-9fa0-3645d22d1e7f": {
     "rule_name": "AWS RDS DB Instance Made Public",
-    "sha256": "d5b10fa1230219482d9260c9b3abc29a378aad24325e84d344be2fa223a72b04",
+    "sha256": "aad06c86f00fc49143d2b0b6c0f3b27380ed7eff0b3cf20193f5338fc2ea0a9f",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "9f1c4ca3-44b5-481d-ba42-32dc215a2769": {
     "min_stack_version": "8.13",
@@ -9629,15 +9684,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Potential Protocol Tunneling via EarthWorm",
-        "sha256": "0acdc01e1894806e1b2e1a96df91a299f0324172f6e08fa06b75cb6244675079",
+        "sha256": "3e4eea02a43d60f58a4be4bea2a88713ba7724676b52851025572c1bbe451d5d",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Potential Protocol Tunneling via EarthWorm",
-    "sha256": "ba184af85327ab0b30d44303e6f197aa3633bf956b71268bfb4c1cdb7ff0e0a0",
+    "sha256": "e49d72b63706bac64f750445fb8273899588eb0881286ee1c15f8cbf3d4b495f",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "9f962927-1a4f-45f3-a57b-287f2c7029c1": {
     "min_stack_version": "8.14",
@@ -9651,21 +9706,21 @@
       }
     },
     "rule_name": "Potential Credential Access via DCSync",
-    "sha256": "42787461cd6ccfd67f8830817f8a5a08ce5c23299a470a46c9b4f09e6db3d307",
+    "sha256": "c827437febd6573bc72e13eee68be8b34803f97343b531bf5a4ac64899989cc7",
     "type": "eql",
-    "version": 215
+    "version": 216
   },
   "9f9a2a82-93a8-4b1a-8778-1780895626d4": {
     "rule_name": "File Permission Modification in Writable Directory",
-    "sha256": "9c5b42e9d0ce3be94bd99e088bd928d5dd6f6dc750cf9a67b5cb20c6067bdd0b",
+    "sha256": "5d7f431713626a4dcd90230cc90a452231a2f4f09ce222c8f023205f6921b8b3",
     "type": "new_terms",
-    "version": 211
+    "version": 212
   },
   "a00681e3-9ed6-447c-ab2c-be648821c622": {
     "rule_name": "First Time Seen AWS Secret Value Accessed in Secrets Manager",
-    "sha256": "0c2d0945e3f41272d93b2c57b804fd2de409098f64d87e59387ed6edc5f29da9",
+    "sha256": "7b2b92f74b503fc18cf5ef70b93536fbb877f88952c072c944b062b3f8f647f7",
     "type": "new_terms",
-    "version": 312
+    "version": 313
   },
   "a02cb68e-7c93-48d1-93b2-2c39023308eb": {
     "min_stack_version": "8.14",
@@ -9673,27 +9728,27 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "A scheduled task was updated",
-        "sha256": "c135f8efdd7137ef937b19eb29aa4a88640d556690f529620d1c24f6c391ec3f",
+        "sha256": "73081f6875d6de77e1cfc1de7cd27bbd885b7f016546a3e004f06be2c614c254",
         "type": "eql",
-        "version": 9
+        "version": 10
       }
     },
     "rule_name": "A scheduled task was updated",
-    "sha256": "749ba895080051e4aa8e4a2df55b64ca9fb5e99c35767bb1f288e9c07842211f",
+    "sha256": "b4abe619c6873dbbf537a259fb41b785fd39c973534f78af8f41347c1f9a6834",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "a0ddb77b-0318-41f0-91e4-8c1b5528834f": {
     "rule_name": "Potential Privilege Escalation via Python cap_setuid",
-    "sha256": "9771d73d6839772917b03b85707c361b758e7dd2ca3ae4daa997d9f3494564a3",
+    "sha256": "4fb0c2f13b78a878839b6ca5deae3f3256aad7e97fd364c5e60139f495f526ad",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "a10d3d9d-0f65-48f1-8b25-af175e2594f5": {
     "rule_name": "GCP Pub/Sub Topic Creation",
-    "sha256": "d1f3342fcfc31b466666d2653d511406c8d7118d669a1c5a031be8300152cc93",
+    "sha256": "2192b6dc1346c8016c7f7e18d0e4def61f38a7359cb4c665235f7c7a35d81646",
     "type": "query",
-    "version": 105
+    "version": 106
   },
   "a13167f1-eec2-4015-9631-1fee60406dcf": {
     "min_stack_version": "8.14",
@@ -9701,15 +9756,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "InstallUtil Process Making Network Connections",
-        "sha256": "f8829b614b96a55bdf35e84d28329b3efdbd1d18224ab1987b6e6dc5aabea65f",
+        "sha256": "009c0f45c6d544d656f91b1a17dc4ca36d2fa5cda90732b95d8cc0840b82684f",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "InstallUtil Process Making Network Connections",
-    "sha256": "539e9bec28c5ba2b0d44bd1a2c646f203f6b4a07abe0fff58707c93fe20a2684",
+    "sha256": "3826d8c2ea0005de5c96f492c5dd896a58db738ff754a638c848dacf6514d220",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "a1329140-8de3-4445-9f87-908fb6d824f4": {
     "min_stack_version": "8.13",
@@ -9717,15 +9772,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "File Deletion via Shred",
-        "sha256": "7cceb36ddd019047252c9fdd913eef7af8d679620d610af2da4243906b976b48",
+        "sha256": "cb4768e9cc77383814b6bf126bda3c193dae302c4d755159f2ce1e4079e49733",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "File Deletion via Shred",
-    "sha256": "3d589003c93cc87bb316a3627d284b1a283da55956d2cc4761debccb078a0b8c",
+    "sha256": "88cad104e97ca755480aafaa4a712b418afbe8b9eab3dc5b3a7f41b78982ad6a",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "a16612dd-b30e-4d41-86a0-ebe70974ec00": {
     "min_stack_version": "8.14",
@@ -9733,15 +9788,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Potential LSASS Clone Creation via PssCaptureSnapShot",
-        "sha256": "11b482716d805d5718f0923dc1b0127ca26a5c89ac02df96dab7fe8a371199d2",
+        "sha256": "ff0cfb580ab3d4b49d481e29249862e6b6880e365188f6042d40d1b3773f1b70",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Potential LSASS Clone Creation via PssCaptureSnapShot",
-    "sha256": "cbb9883d7a92a6a590c0f8f1280653d30652d6832ac8209e13d9fd8af07494bc",
+    "sha256": "12d937324cbeaaa49e957871d3d23a99d065e3a5070e763111e10bcb6a0e9a92",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "a1699af0-8e1e-4ed0-8ec1-89783538a061": {
     "min_stack_version": "8.14",
@@ -9749,34 +9804,34 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Windows Subsystem for Linux Distribution Installed",
-        "sha256": "254753d1734938715fc36fb23e5d45f5d37a5b2accd3f353a456fa14849072d9",
+        "sha256": "60b4da3686af1892886ef1568adc3da363b41fa02069a8ad5f02c1f13fc5e375",
         "type": "eql",
-        "version": 8
+        "version": 9
       },
       "8.13": {
         "max_allowable_version": 207,
         "rule_name": "Windows Subsystem for Linux Distribution Installed",
-        "sha256": "a67ae649a271e68ef17b80ec7a1d6cea6f39d80a5dec0803424fba96df9a9024",
+        "sha256": "a95daf1b60dd955c84fe99495d627e26da5f8c3071938bff985159d488d74b35",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Windows Subsystem for Linux Distribution Installed",
-    "sha256": "0e7f58671c9058c1194ab7cd3b496010e9aa320e5ca20b4bcc8b196c7fafdb4d",
+    "sha256": "ab452a27753833a9982fac9a2797499691153c3fcc51357315acc246796bce7f",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "a17bcc91-297b-459b-b5ce-bc7460d8f82a": {
     "rule_name": "GCP Virtual Private Cloud Route Deletion",
-    "sha256": "5830a379ffe8c72546a1ff07b39d70c6d196815e08f8e584828c81640426aa99",
+    "sha256": "1c1a346a5c44ffafc16e7a28a4703248527b03dd10eea79fe823ceb5a035ce73",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "a198fbbd-9413-45ec-a269-47ae4ccf59ce": {
     "rule_name": "My First Rule",
-    "sha256": "6e0a27cbad2201b443c14712e096547ab0f70144d8a1777fbc9a7118b6f31701",
+    "sha256": "63fb939bf754aaa427be9132c2868915140e558a8c69ce185d547593c05ab4ba",
     "type": "threshold",
-    "version": 4
+    "version": 5
   },
   "a1a0375f-22c2-48c0-81a4-7c2d11cc6856": {
     "rule_name": "Potential Reverse Shell Activity via Terminal",
@@ -9786,9 +9841,9 @@
   },
   "a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f": {
     "rule_name": "Linux Group Creation",
-    "sha256": "93d8a95d1c43dedafd6cece3fab8d0b375e5a15801c84585d037fd2c7f361076",
+    "sha256": "6318c4dff530e8b0d50c646549d60a859ca4d6d4881dbcc94e3b5c26620390ce",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "a22a09c2-2162-4df0-a356-9aacbeb56a04": {
     "min_stack_version": "8.14",
@@ -9796,34 +9851,34 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "DNS-over-HTTPS Enabled via Registry",
-        "sha256": "65d599f0ff2e8109bbdc28ad1f87017cebf9333caf2acc9368f2051f87e9cf36",
+        "sha256": "06f788f98600e28f36873cfa890ce266317a1b101169c481fb3099d9c0e35eae",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "DNS-over-HTTPS Enabled via Registry",
-        "sha256": "64d63c9fc9cd61923e9f98811c5823a1bb8a27a525a4b54b969fdd7051bb4649",
+        "sha256": "db4b51eff904ef0ef94f2e68fa3ac4e7e64a9bc8c6e03af8a426537789e233c8",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "DNS-over-HTTPS Enabled via Registry",
-    "sha256": "ce9a658724c78ad0fb002e88c88c00891614f43d625181cf23e6541447ff4daf",
+    "sha256": "ad7b4900548730f045e3b58898846a5953e28138ddc81ea4b2cb5e8f7bc4f30c",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "a22b8486-5c4b-4e05-ad16-28de550b1ccc": {
     "rule_name": "Unusual Preload Environment Variable Process Execution",
-    "sha256": "30e15837fc2299fc5bd51618f8f9d726a4f81121c3e9213c9f0f37b7f1922784",
+    "sha256": "9e16a6d58c5f5a677f1cebc91183afdae5a7ecdfcce34207fcc6f62f65367152",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "a22f566b-5b23-4412-880d-c6c957acd321": {
     "rule_name": "AWS STS AssumeRole with New MFA Device",
-    "sha256": "cfb03e9127dfd2a1580d29f64f412173261e28a1c22ca8b51e484f75b870ff8c",
+    "sha256": "bfb7eddaa9656dc8832f4d1a089450b5b180a6620a1dd22d601c7bed17c286de",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "a2795334-2499-11ed-9e1a-f661ea17fbce": {
     "rule_name": "Google Workspace Restrictions for Marketplace Modified to Allow Any App",
@@ -9853,22 +9908,22 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Execution via local SxS Shared Module",
-        "sha256": "68739f82fe835d6e8e546e396bd6b7166cab6ffb7af01ccc3d402c7b23ab1525",
+        "sha256": "c70b5b61b3ea697efa1bbf34aede51b77d26f0af37f29414c403967c589fa37a",
         "type": "eql",
-        "version": 108
+        "version": 109
       },
       "8.13": {
         "max_allowable_version": 307,
         "rule_name": "Execution via local SxS Shared Module",
-        "sha256": "2084297807278d91612b5ba01c82c2f10551b23506d0009a391feb6f63287dbf",
+        "sha256": "7f90a2bcf9eeaff4a2dc027ec117964bf311dedcbc86cba03a8615c9780c68bc",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Execution via local SxS Shared Module",
-    "sha256": "1bb9e2021e6b0db51906eb89a0556e7513a62b080972cf61ad4b7dd2a7f01e2a",
+    "sha256": "0411088910bff1036ccad0a0a7e3e47b669f970b76031d73843f1a6ee00aa168",
     "type": "eql",
-    "version": 308
+    "version": 309
   },
   "a44bcb58-5109-4870-a7c6-11f5fe7dd4b1": {
     "rule_name": "AWS EC2 Instance Interaction with IAM Service",
@@ -9890,9 +9945,9 @@
   },
   "a52a9439-d52c-401c-be37-2785235c6547": {
     "rule_name": "Netcat Listener Established Inside A Container",
-    "sha256": "8f9886fc92a4c69f14005790f8fdaab0b79bfd94930a6aaadc156c7b8a78e146",
+    "sha256": "04ff1b708f21926ca8673e536f01751da5464d3c618e199dad5190935569c59e",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "a577e524-c2ee-47bd-9c5b-e917d01d3276": {
     "rule_name": "CAP_SYS_ADMIN Assigned to Binary",
@@ -9902,9 +9957,9 @@
   },
   "a5eb21b7-13cc-4b94-9fe2-29bb2914e037": {
     "rule_name": "Potential Reverse Shell via UDP",
-    "sha256": "107d9dba2ad9b03f457311eef2f1d29f5c30f692db76b52c0ecb7ad90cb1bba0",
+    "sha256": "dd7935aa4635611792001b36012fecabe2d6bbb0b7a8cc2f80a706b7bfcf659b",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "a5f0d057-d540-44f5-924d-c6a2ae92f045": {
     "rule_name": "Potential SSH Brute Force Detected on Privileged Account",
@@ -9914,9 +9969,9 @@
   },
   "a60326d7-dca7-4fb7-93eb-1ca03a1febbd": {
     "rule_name": "AWS IAM Assume Role Policy Update",
-    "sha256": "232deeb70c03fe09805ae4aedeb77133435af63645bd9833c8d0b945b1f950df",
-    "type": "query",
-    "version": 209
+    "sha256": "9b292d485484c3753314bef6df52ec945933baa8293f6967b3f4a326ef8daa1d",
+    "type": "new_terms",
+    "version": 210
   },
   "a605c51a-73ad-406d-bf3a-f24cc41d5c97": {
     "rule_name": "Azure Active Directory PowerShell Sign-in",
@@ -9926,9 +9981,9 @@
   },
   "a61809f3-fb5b-465c-8bff-23a8a068ac60": {
     "rule_name": "Threat Intel Windows Registry Indicator Match",
-    "sha256": "911df9a41bce872a7cd60687c487a8d1b6d05ca3e4c2748968cefb7fdc63f3b3",
+    "sha256": "c061bcef15efcf1c65649493512805d27d383b262ef29f1ee14d2c941e88724e",
     "type": "threat_match",
-    "version": 7
+    "version": 8
   },
   "a624863f-a70d-417f-a7d2-7a404638d47f": {
     "min_stack_version": "8.14",
@@ -9955,27 +10010,27 @@
   },
   "a6788d4b-b241-4bf0-8986-a3b4315c5b70": {
     "rule_name": "AWS S3 Bucket Server Access Logging Disabled",
-    "sha256": "468acf9925b683cd43a8c9d55cff0117071c66f66e7c1a1dfe43b164b6cb22a2",
+    "sha256": "b597402a792a29e82c02d56787dfb0088afb24fe4681fccf800ec8ff10a08a10",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90": {
     "rule_name": "Emond Rules Creation or Modification",
-    "sha256": "279439946377684a1551b3d271e82b7225b1323b970f0e63c7a12fc2ba805287",
+    "sha256": "cbdf047624c4be0c4e5064b465f23c279737467edb36c6a8f0f51d8081900042",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "a74c60cb-70ee-4629-a127-608ead14ebf1": {
     "rule_name": "High Mean of RDP Session Duration",
-    "sha256": "55ef145cde18d6c08b01ce4ece7f4903351d9bdd131a8453002647a668aaa5c4",
+    "sha256": "16d442bb0e68cceb100b590cd99c27126094ef873e1557bc0494c33f672351ba",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "a7ccae7b-9d2c-44b2-a061-98e5946971fa": {
     "rule_name": "Suspicious Print Spooler SPL File Created",
-    "sha256": "96b2fcbc3924d11fc9c3eed38fc768bf6f97bfe8fe667f084d210769af057164",
+    "sha256": "1a8db1f12af5f8f6acda01d02bf1f7858b64b591e8cc97e80b1f821fd01b136b",
     "type": "eql",
-    "version": 113
+    "version": 114
   },
   "a7e7bfa3-088e-4f13-b29e-3986e0e756b8": {
     "min_stack_version": "8.14",
@@ -10002,39 +10057,39 @@
   },
   "a80d96cd-1164-41b3-9852-ef58724be496": {
     "rule_name": "Privileged Docker Container Creation",
-    "sha256": "5550f7f742c87f9bd39c1e4db8db24caee9b67540120dacf5f7b201023626f25",
+    "sha256": "04dfaf2e0ab843431c44a2508695e0793ee75aea13aa78ee94a7c26e31c27c5b",
     "type": "new_terms",
-    "version": 2
+    "version": 3
   },
   "a83b3dac-325a-11ef-b3e6-f661ea17fbce": {
     "rule_name": "Entra ID Device Code Auth with Broker Client",
-    "sha256": "1cf36e99756517a71c3c4daeef8d7ed86213399d94ede19cb11a01ad05ef7323",
+    "sha256": "3b36ca3385b038425d51a7e5ed4106e263b270fcfb2b2b3f080d747370eb1bc4",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e": {
     "rule_name": "Web Application Suspicious Activity: POST Request Declined",
-    "sha256": "ebfc9e780da093a1ff6bd51cae7eafadee5cf30f6044a85add7779f17d924a88",
+    "sha256": "7af20755d35869e009f843fef6fb3ad74173f1f9d745b649a798002ecd3fb640",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "a8aaa49d-9834-462d-bf8f-b1255cebc004": {
     "rule_name": "Authentication via Unusual PAM Grantor",
-    "sha256": "60aa85a93569474f9a1f9615a864f2472923f7f351a0f0a5e4770e668e072e3a",
+    "sha256": "7dc8a4e76f836a2dabc1f97682ff2a8788770c2df8b3c977a9a21e48600874bc",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "a8afdce2-0ec1-11ee-b843-f661ea17fbcd": {
     "rule_name": "Suspicious File Downloaded from Google Drive",
-    "sha256": "41c537740053f42fad23d5168744e96453f28557cccc97585c0f976a10ef5178",
+    "sha256": "9067b8538121e710f6bc88912dc5b959b87527aba3c8d4799197e2b1155bfafa",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "a8d35ca0-ad8d-48a9-9f6c-553622dca61a": {
     "rule_name": "High Variance in RDP Session Duration",
-    "sha256": "f40d918cd70e374c3ea932e1a3b6c14fe1d4bea3bc082607586e660708225c9f",
+    "sha256": "b10636c16f0df07435893373776847351520e760d2923c0ac25814bba42a51c1",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "a9198571-b135-4a76-b055-e3e5a476fd83": {
     "rule_name": "Hex Encoding/Decoding Activity",
@@ -10044,9 +10099,9 @@
   },
   "a989fa1b-9a11-4dd8-a3e9-f0de9c6eb5f2": {
     "rule_name": "Microsoft 365 Exchange Safe Link Policy Disabled",
-    "sha256": "3d299427823ca14b62de2ac6ceb1e378df0601897aea618d82aaf2ac27a5b9e2",
+    "sha256": "6388eaea93dbea69b2def246d3830353851466710a017a1b197cf97d811e445d",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "a99f82f5-8e77-4f8b-b3ce-10c0f6afbc73": {
     "rule_name": "Google Workspace Password Policy Modified",
@@ -10060,27 +10115,27 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Persistence via Hidden Run Key Detected",
-        "sha256": "a1e28dabfeef53ea08300663108d337b108ffbf92c169af41ac29938f2ad0d5d",
+        "sha256": "521b0deac4fa27230216cb8daf48bee86c9bbef64c5b0dc90d5dbd5acbb31f0e",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Persistence via Hidden Run Key Detected",
-    "sha256": "4687afae3e7472fed3b420f99cd3124158312bfbab94cd1f7303fda1d1a139bd",
+    "sha256": "3408526e0c0dac93e7765ada0f10c56843aec79f4e3c80ff93f5afb3ec32e96a",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7": {
     "rule_name": "IPSEC NAT Traversal Port Activity",
-    "sha256": "f6ceb7d4ece3477e49b056e9dd3e833f999b2eee034004d015ed34cab40f8df5",
+    "sha256": "c5e9563513ceff85a4cd305b620e50b46d0abdcd6b749995b72d1dfe43f137f2",
     "type": "query",
-    "version": 105
+    "version": 106
   },
   "aa8007f0-d1df-49ef-8520-407857594827": {
     "rule_name": "GCP IAM Custom Role Creation",
-    "sha256": "46fafcee6069a185beb2d0fc77d3f39e53b9ec3412f9afdef0e7b642b48e296f",
+    "sha256": "05234b27bd38c05a4148c880399948bb9f659dc2409c560ff2c17735d399fdaf",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "aa895aea-b69c-4411-b110-8d7599634b30": {
     "min_stack_version": "8.13",
@@ -10088,15 +10143,15 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "System Log File Deletion",
-        "sha256": "caebd910311dc1b958558375bcae2a9bd22b4ef344988046c43684e838d9d350",
+        "sha256": "9e7b2926bab16d0e65d0b84a1ec35d2ebfe3b10e1f219c4a9f7a8d87a9e5a132",
         "type": "eql",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "System Log File Deletion",
-    "sha256": "ada984096f2d14c711d004bdf03cf6f511a543fe021a46c40c89c501a6a2b6ed",
+    "sha256": "90cddbc10f4f4760da203311ee1ccaaffddec3e97369b36fa049935b55906f94",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "aa9a274d-6b53-424d-ac5e-cb8ca4251650": {
     "min_stack_version": "8.14",
@@ -10104,47 +10159,47 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Remotely Started Services via RPC",
-        "sha256": "f3aa0fe1214d034e842ff8839a0f07ba427b7c6f884aa08ce89c3802c4d4c6d0",
+        "sha256": "c5ae21879f28fadb1daca353f3c354f8f96a89ebe15eb191af73bbe85a2e1b0f",
         "type": "eql",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Remotely Started Services via RPC",
-    "sha256": "3bca920a328d271bc638274d9265324896cb1635894bb09d8c7628ee499617d2",
+    "sha256": "470c7c8413962fc0f844e61a7bf6314d1a2eb8517d76b793b627d1ab6c0ee1cc",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "aaab30ec-b004-4191-95e1-4a14387ef6a6": {
     "rule_name": "Veeam Backup Library Loaded by Unusual Process",
-    "sha256": "fae7ffc9ed0b702935ff7bccd87d6ddec3d54d21ce22d4aedb1cbb41d4e584c3",
+    "sha256": "b09c6bdf53c574bd6a13c29289040f6d39647434595c2ef5e908596c2f87e744",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "aab184d3-72b3-4639-b242-6597c99d8bca": {
     "rule_name": "Threat Intel Hash Indicator Match",
-    "sha256": "e1161667047c076c8d8e436e3ce9b940a7089c5cf8587b557f3b3b52119d231a",
+    "sha256": "dc906d8e338b0fba7e19f677e0f95691c4e1c94fab8b366f0f0fa007db2226e3",
     "type": "threat_match",
-    "version": 8
+    "version": 9
   },
   "aabdad51-51fb-4a66-9d82-3873e42accb8": {
     "min_stack_version": "8.13",
     "rule_name": "GRUB Configuration Generation through Built-in Utilities",
-    "sha256": "78ab7ba6d046b4901b164ee6e3fd63c4c9c277b9bd16337514274902f4322388",
+    "sha256": "6c9d7d72e70ba8fa7028586f7dd96f22a714aea37e9b6a748c48f4c2b84cf5bd",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "ab75c24b-2502-43a0-bf7c-e60e662c811e": {
     "rule_name": "Remote Execution via File Shares",
-    "sha256": "d83d4d35e0bb8980567f6aed233e06d8bcb4824a6e438a8f8606f7318ce7f204",
+    "sha256": "8969379383985fd2ccf5010b8b1c8c4e72e6c2508b920cfb65101ab13bfaa620",
     "type": "eql",
-    "version": 115
+    "version": 116
   },
   "ab8f074c-5565-4bc4-991c-d49770e19fc9": {
     "min_stack_version": "8.13",
     "rule_name": "AWS S3 Object Encryption Using External KMS Key",
-    "sha256": "3aff4d1d49850118022efab0afa8765485da6c1fdc1d96b20d05fca3803b18f0",
+    "sha256": "c58bc9bcee72af710a07f880ed3df3eceef229e97454f6ad449273d078b06c4b",
     "type": "esql",
-    "version": 2
+    "version": 3
   },
   "abae61a8-c560-4dbd-acca-1e1438bff36b": {
     "min_stack_version": "8.14",
@@ -10152,21 +10207,21 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Unusual Windows Process Calling the Metadata Service",
-        "sha256": "e47f2af768f5f8d5ebfcdad5c838efe410a8712405d61d5d3d4786000bd6e676",
+        "sha256": "83e5654634806cf836873526072beb4a411dbe215b4be002f799dc0eb0866d82",
         "type": "machine_learning",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Unusual Windows Process Calling the Metadata Service",
-    "sha256": "41d9773b53e26197a39fa675ffa40d07b17987dd304c38336693138b0222111c",
+    "sha256": "62b3cce8bb0d092c2759ebc4697ef92d744a740ec8e418ac7370a52052d0d04a",
     "type": "machine_learning",
-    "version": 206
+    "version": 207
   },
   "ac412404-57a5-476f-858f-4e8fbb4f48d8": {
     "rule_name": "Potential Persistence via Login Hook",
-    "sha256": "c757a8d19345f645690ffb8634527ad84b35d0195fe82d9ca81ccf57eaf2eef9",
+    "sha256": "5b1015d4458273b2f101dd22674b7cc73970fd91015c91ed9c22fc5049ca1729",
     "type": "query",
-    "version": 108
+    "version": 109
   },
   "ac5012b8-8da8-440b-aaaf-aedafdea2dff": {
     "min_stack_version": "8.14",
@@ -10174,22 +10229,22 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Suspicious WerFault Child Process",
-        "sha256": "624162b798c838d61c2764e0dfa953b896f800a9c5539ef5aee7051fb240ce10",
+        "sha256": "5a3182ca2012152d9bd5c912111d82b1f3214a893d6da8417d00cde83cc42f7b",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 414,
         "rule_name": "Suspicious WerFault Child Process",
-        "sha256": "c1b3b8d2072d918930efe998f724cf12942ee022c135971e24778f2c1821eb4f",
+        "sha256": "9e5fa90d4dcc2b7ba457b5d5c1701304fd158e99a68fb7fddee7dee79f9b55f3",
         "type": "eql",
-        "version": 315
+        "version": 316
       }
     },
     "rule_name": "Suspicious WerFault Child Process",
-    "sha256": "cf59420deb50d843084ffc3320ad39588acb649e55c3c0eb12c54b1d52a3b4aa",
+    "sha256": "2093382d45530ceba2ddf764b031af27fef9087e0b6f90f1e6cb535a04e5798b",
     "type": "eql",
-    "version": 415
+    "version": 416
   },
   "ac531fcc-1d3b-476d-bbb5-1357728c9a37": {
     "min_stack_version": "8.13",
@@ -10197,15 +10252,15 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Git Hook Created or Modified",
-        "sha256": "baf94c030f8649e89628d8d83f0e90cfebbb67da5b711c8a8c4063d48a01cd64",
+        "sha256": "ec16be4f5fe86ad7212a2520875b8f40ee71728666d7085220d272f1e3929d89",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Git Hook Created or Modified",
-    "sha256": "f2f13e4195a1e04b1288a31c748ca8bad1eb7112fc9e77a2a5547b948f54a5d4",
+    "sha256": "0c1a8c2bb10aaf8e8c9dc4c3c70b9fcafe1230ffe0687aa31e5909bf176ee7e9",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "ac5a2759-5c34-440a-b0c4-51fe674611d6": {
     "min_stack_version": "8.14",
@@ -10213,22 +10268,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Outlook Home Page Registry Modification",
-        "sha256": "a21b4408a3539687dc2e34b0165fd2633928f3f84e0389722ccb822dc45dae83",
+        "sha256": "9e311415c8086b3934da0eeaa5ccac777e192f9c2c9953b705e3368c14fad664",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Outlook Home Page Registry Modification",
-        "sha256": "1adad2fbaac61dd3b02e58f8271efb1177aadfc906d7c20a2a30ce2f984ae27d",
+        "sha256": "981f0b0dbe49943a8536ee475f57749dedc4e10f1c32351e9ee5c122813eed48",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Outlook Home Page Registry Modification",
-    "sha256": "02cd6bf4e2e371ef2e60d5a1df762ee51868c135ad78304ce723d27a91a4c7f2",
+    "sha256": "cf576e47d585c50b59b5886c7f0802f74deb1e56177dc7478d66d1e3a7379fa6",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "ac6bc744-e82b-41ad-b58d-90654fa4ebfb": {
     "min_stack_version": "8.14",
@@ -10236,15 +10291,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "WPS Office Exploitation via DLL Hijack",
-        "sha256": "006e257e7f3f415df5102ead250e9554e6755e192771f58bdab3c554075b7ae5",
+        "sha256": "f0b9a400aad8092fd6bd78cf6124173e5d87d3a8d40fb37af54e7611a60734de",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "WPS Office Exploitation via DLL Hijack",
-    "sha256": "ffe2ee7667dba6c6d5b6c0f2e759bd20739ce00b74f2ff55cfa78eaac5c6167a",
+    "sha256": "6d20396d3b2ba5db4a1fd80aca9c645d4b789dcb0d39161b5dfe9b1d4f1f216b",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1": {
     "rule_name": "Unusual AWS Command for a User",
@@ -10254,9 +10309,9 @@
   },
   "ac8805f6-1e08-406c-962e-3937057fa86f": {
     "rule_name": "Potential Protocol Tunneling via Chisel Server",
-    "sha256": "be005130100c74d62f0ae093ffaceedaf8ea816f88d721e2dd68dbaca2bd46c9",
+    "sha256": "244086ab4aa98317bccdb56cbe25ee1911c6c8b1b5d6b56e5da66e969e9a1aa2",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "ac96ceb8-4399-4191-af1d-4feeac1f1f46": {
     "min_stack_version": "8.14",
@@ -10264,15 +10319,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Potential Invoke-Mimikatz PowerShell Script",
-        "sha256": "e7b750985f6d8f290b5b3c9331448fc6c0e52c65dfa753ddf117fd70bd624e21",
+        "sha256": "73aa4e201e1220c47c689009c0c24f4ef6a0dcdab57655d7f25c5525472d28b4",
         "type": "query",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Potential Invoke-Mimikatz PowerShell Script",
-    "sha256": "b419d7a1beb994f9b021b2477fb9df633c75879e1523c5d9042f5f83dc1f98e0",
+    "sha256": "e75ecddee03f0ecd4c9052ef2974471d669da03a7d25fd6c4c46ad39537304b6",
     "type": "query",
-    "version": 210
+    "version": 211
   },
   "acbc8bb9-2486-49a8-8779-45fb5f9a93ee": {
     "rule_name": "Google Workspace API Access Granted via Domain-Wide Delegation",
@@ -10282,15 +10337,15 @@
   },
   "acd611f3-2b93-47b3-a0a3-7723bcc46f6d": {
     "rule_name": "Potential Command and Control via Internet Explorer",
-    "sha256": "4e05c9f350a2bf4380ddc180a068d6803b859a53e35e93b341397855f28c5924",
+    "sha256": "c893c9924f303a60bf8cafdffaf2cd627c6fdaae221bd7469fe25ef355839d32",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "ace1e989-a541-44df-93a8-a8b0591b63c0": {
     "rule_name": "Potential macOS SSH Brute Force Detected",
-    "sha256": "95cd29a163e6b0b1ffbed68a23beef7033446cdbce973aa1bac75d9a31a944d9",
+    "sha256": "0634c4cc8994181d8d803e1f8a015b27a0287326c7bbe72e41f6caabaec65771",
     "type": "threshold",
-    "version": 108
+    "version": 109
   },
   "acf738b5-b5b2-4acc-bad9-1e18ee234f40": {
     "min_stack_version": "8.14",
@@ -10298,22 +10353,22 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Suspicious Managed Code Hosting Process",
-        "sha256": "fe186a9faacc6e9e3e6491c59ba7d7f453f702cf162e0e4ae49354149e80326a",
+        "sha256": "71cf5c81124dd45113bcb530642c295387bd2b68ee1236cb2a3e8e2f0f0aca2a",
         "type": "eql",
-        "version": 108
+        "version": 109
       },
       "8.13": {
         "max_allowable_version": 307,
         "rule_name": "Suspicious Managed Code Hosting Process",
-        "sha256": "6bedea5ed62553b3faee7de59fc7d5379a82ec9a852980276971dc29d0c0b345",
+        "sha256": "86ac334bd5ab8b6d729a0fd45b6134932f7b204b865b83dd786664d0984c3da3",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Suspicious Managed Code Hosting Process",
-    "sha256": "de021f1c7c7f774f5ae581c5a8dcf13e91eaa358742311cabddc983f8bd428e0",
+    "sha256": "88a18ab3c5f799879b46bf994ced31f7d53b1188b29318f70d67e7f1fe7bc832",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "ad0d2742-9a49-11ec-8d6b-acde48001122": {
     "min_stack_version": "8.14",
@@ -10356,15 +10411,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Openssl Client or Server Activity",
-        "sha256": "5535a4f110cc1281d1ad303fd5f73ab8f18de03b4f7055194c5f86cb79cef0ce",
+        "sha256": "8eb908bf23fa02ea31de0dcd624ff3541d1bc60c2389d04820670c32bd4b7244",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Openssl Client or Server Activity",
-    "sha256": "7f976d99bb3f172f171e5652c8cad18cbd56030f72633c4a5455b0c8f420a2f0",
+    "sha256": "1b7199791c6d84167d236ea1e7b0d434bbd215be6509536b9d943c0be646d2a6",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "ad84d445-b1ce-4377-82d9-7c633f28bf9a": {
     "min_stack_version": "8.14",
@@ -10372,21 +10427,21 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Suspicious Portable Executable Encoded in Powershell Script",
-        "sha256": "d2271c15f1bcae13cb2632e4449638ff23a1e373ff5e0cd32c8722354646975d",
+        "sha256": "e36bc47e8ad58d550eb0511c38b7e7ebe9f68e088ec6215f78f7a2780d0f4e24",
         "type": "query",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "Suspicious Portable Executable Encoded in Powershell Script",
-    "sha256": "23c56aed37124f4d42a7e066da164226be49cc33c8358d269cb23b54daa61b9b",
+    "sha256": "014ab6a9d47a402634c60580acfcdbc73e02eda99e30868cdb84bd27f75bfe59",
     "type": "query",
-    "version": 212
+    "version": 213
   },
   "ad88231f-e2ab-491c-8fc6-64746da26cfe": {
     "rule_name": "Kerberos Cached Credentials Dumping",
-    "sha256": "b487d846e3b3cce77ab546dffaa06a50544f53ec03293a3bf6ef529123497ae6",
+    "sha256": "fdb9bfb1476b606fed9fb9f5d813bd2649bbfeb1e82522dbab72f7f63e379c10",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "ad959eeb-2b7b-4722-ba08-a45f6622f005": {
     "min_stack_version": "8.13",
@@ -10394,15 +10449,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Suspicious APT Package Manager Execution",
-        "sha256": "4cbd3476d128aad590e86079b7e07f0db490326f4339fd74b5c8b596bee4bc0a",
+        "sha256": "a1f733e8c14c8a8ddb91a5c919f8598d6578b992ab231ea6130ddff737d80b25",
         "type": "eql",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Suspicious APT Package Manager Execution",
-    "sha256": "a44fc3ff83a0e6aaabac522e599b8f92b95cce50059049fab47a1a16e41c5995",
+    "sha256": "746d0a429f9ff030e458664ae3eaa0292ccbc3c15e7f707921cde5fa37659e91",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "adb961e0-cb74-42a0-af9e-29fc41f88f5f": {
     "min_stack_version": "8.13",
@@ -10410,21 +10465,21 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "File Transfer or Listener Established via Netcat",
-        "sha256": "f27e0f720407692607f6eb75d893c29b6331360fec5838edbff6739eea960584",
+        "sha256": "883178d57a5f0e0cf1ea5d9e4c778051a895d0e41a27aea175cfeec0058c9573",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "File Transfer or Listener Established via Netcat",
-    "sha256": "fb1931f01dca4a44f26a9e4a4226b6ed2eb886d1ca2435600262bbdac2d279b0",
+    "sha256": "1da815d35ec17c8073f83a5113a2ecc2ed46bc4ea6694beafe243f8bba9f4f43",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "adbfa3ee-777e-4747-b6b0-7bd645f30880": {
     "rule_name": "Suspicious Communication App Child Process",
-    "sha256": "1e6f2fd1e6f9b02629b2f190c0872668bcaaa1d2b3b8011b1798f1e6ebda905d",
+    "sha256": "36e34a2abf002a55bb25f1d7c6333a2b2ab927c5e1e735f1ee9b1ab5e41b29aa",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "ae343298-97bc-47bc-9ea2-5f2ad831c16e": {
     "min_stack_version": "8.13",
@@ -10432,15 +10487,15 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Suspicious File Creation via Kworker",
-        "sha256": "a932bb2a7c777540aee96e3bd9ed937cff8e801ad0e9351bd907f5111f8a94c6",
+        "sha256": "cc84e69331853cce8fdc6642b517c1976575b91f66f2e049315267bc2bc1c035",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Suspicious File Creation via Kworker",
-    "sha256": "02ab7ea5b4914325e4e7cf18374acd1f9a35821031152a35fa098ed270466f3e",
+    "sha256": "638df02131a857a0c394365561637358f6a3ffb4aaa634e28f95a56dc649878a",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "ae8a142c-6a1d-4918-bea7-0b617e99ecfa": {
     "min_stack_version": "8.14",
@@ -10448,40 +10503,40 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Suspicious Execution via Microsoft Office Add-Ins",
-        "sha256": "6fce50e87a921fa949cd422fb8a0d0e0232051f30329df181dbebb37b5e5a184",
+        "sha256": "e98a3d6c4df8d691ad52d2e09453788cdd9059b5d1d1417f8c27adb82ad82604",
         "type": "eql",
-        "version": 5
+        "version": 6
       },
       "8.13": {
         "max_allowable_version": 204,
         "rule_name": "Suspicious Execution via Microsoft Office Add-Ins",
-        "sha256": "bc36274c731c5231be458f7c7b13cbefb5bbe0dba08f745f6d3a65c6f02bbbf6",
+        "sha256": "6f87d083a88525ef7eb03a6d4dde91d57fecb67021008268bbe38eddcb8de46b",
         "type": "eql",
-        "version": 105
+        "version": 106
       }
     },
     "rule_name": "Suspicious Execution via Microsoft Office Add-Ins",
-    "sha256": "8b17583a4547a22fa32e210797078688b3ea53cdd67f93494107cbc65d3e69ab",
+    "sha256": "6457c55cd14c40cf20aaa69545261b5acc6f52e94266a412cc7eae717c18f7d6",
     "type": "eql",
-    "version": 205
+    "version": 206
   },
   "aebaa51f-2a91-4f6a-850b-b601db2293f4": {
     "rule_name": "Shared Object Created or Changed by Previously Unknown Process",
-    "sha256": "e0f82917421c7696991e4560a68459553d9372473b32461c5f4dfefc5ad1c98a",
+    "sha256": "baa6bc2ea280de9151fdfe8e52180a5e692bd39318a6d37a5177670803b9600f",
     "type": "new_terms",
-    "version": 9
+    "version": 10
   },
   "af22d970-7106-45b4-b5e3-460d15333727": {
     "rule_name": "First Occurrence of Entra ID Auth via DeviceCode Protocol",
-    "sha256": "cb2725c021473f600c5a345ec6f8d3ff117b7ed72f2b96bd4e98d625edcfc640",
+    "sha256": "c873fc0c596cd973f1b742aac95e71e5cdd88437995ca1108204c81efb510ef3",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "afa135c0-a365-43ab-aa35-fd86df314a47": {
     "rule_name": "Unusual User Privilege Enumeration via id",
-    "sha256": "bd4da735535155bf2aaee82b58ad81ff85b1d638c319cf8afe1df6d4bd616123",
+    "sha256": "3b1d96fdac5914fb91eecbc97fa8f38bc40a93377e7b9b291e2521e0d62884e8",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "afcce5ad-65de-4ed2-8516-5e093d3ac99a": {
     "min_stack_version": "8.14",
@@ -10489,39 +10544,39 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Local Scheduled Task Creation",
-        "sha256": "49119f3e32864392ca8bba4c86bdc7d44cfa6076f3e6390401a646767f3b45a0",
+        "sha256": "153a680562c2db766ddc13960ff0b1b1d40590dbbf944177fdb07680c4695cbe",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Local Scheduled Task Creation",
-    "sha256": "866c1232689b9c39d30a1a03948c4544423e632af7fc8b8b42c69e4a88ca637c",
+    "sha256": "a9a640dba899a3c92c6a25fdfce9b2ce29774069d5e4b49e89209b64d0bd8431",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "afd04601-12fc-4149-9b78-9c3f8fe45d39": {
     "rule_name": "Network Activity Detected via cat",
-    "sha256": "61ed9cf042140481d4d3863f69481333d94ea25e480a8ddd95a5e38cd2fcacb6",
+    "sha256": "7be4987e791da9dfabee670a6146bc8feecdc79d6116df0d953a8ba12d281ac5",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "afe6b0eb-dd9d-4922-b08a-1910124d524d": {
     "rule_name": "Potential Privilege Escalation via Container Misconfiguration",
-    "sha256": "934babb371893cc423e2cc180a7b9c4e145c3477e29880463dee746c5b419b19",
+    "sha256": "9f17380d50e88b7451dd13c376b322d5597ee174ee532322e00728ddd30236e4",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "b0046934-486e-462f-9487-0d4cf9e429c6": {
     "rule_name": "Timestomping using Touch Command",
-    "sha256": "b076ae4e19a317fab6eb05472220dd936a4a3ea6852be8a783f28615c9f21de4",
+    "sha256": "f446d6a851c5fb5c1d8c57353f72923d40776727f9f1464155a7eb802e6a9d92",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "b00bcd89-000c-4425-b94c-716ef67762f6": {
     "rule_name": "TCC Bypass via Mounted APFS Snapshot Access",
-    "sha256": "5a871527957ab53227a0f5f906053deded0b332d6195c3e6cfbe9622601b646f",
+    "sha256": "c76e638ceb65578acea1d18f1415cffa579dd2b5922507665d774472de710a4f",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "b0638186-4f12-48ac-83d2-47e686d08e82": {
     "min_stack_version": "8.14",
@@ -10529,22 +10584,22 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Netsh Helper DLL",
-        "sha256": "5019bcc4c8001cf98d0d6df1626edce949e6bd8d7c18fbbc38b2a53cf847a5a9",
+        "sha256": "ae6521e56ff6823f52f0061b21556a43efe712f7fd43485bcc1e437849bb0c4d",
         "type": "eql",
-        "version": 2
+        "version": 3
       },
       "8.13": {
         "max_allowable_version": 201,
         "rule_name": "Netsh Helper DLL",
-        "sha256": "12a75647b89fa1a4bbc61d7654d7f62e6c69fd20f55ad24ff83e672bbb8ca97d",
+        "sha256": "f6a3950e6a53ae6b222eafb2db8745cb0c160be006a075c08b5fd6a0a7f9a7aa",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "Netsh Helper DLL",
-    "sha256": "54f00272d79b87fe262ae02033486e748e84d4ab22a02b091b094c3cb456d4d5",
+    "sha256": "8b1858525694ec6e7adb1eb4300cdd4ad1e6e4721418a4c30ff5567d37ed66f4",
     "type": "eql",
-    "version": 202
+    "version": 203
   },
   "b15a15f2-becf-475d-aa69-45c9e0ff1c49": {
     "min_stack_version": "8.13",
@@ -10552,22 +10607,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Hidden Directory Creation via Unusual Parent",
-        "sha256": "9775897dddd3d5ea2fa72deb33baef8f2737925ad1d5be0ea764df8986e49111",
+        "sha256": "6108a4f29f29a7a3de508648ab5fc9681b4307662435aa380267f50682002e00",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Hidden Directory Creation via Unusual Parent",
-    "sha256": "801f1305ee382a5aa0d97a9fe784df8f025d7b4a31f0a0560ab3165dc7731fc9",
+    "sha256": "354b847a7f132052a3849af3c53e5def5104dd2dd73db94eca1fed67cfd83e8e",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "b1773d05-f349-45fb-9850-287b8f92f02d": {
     "min_stack_version": "8.13",
     "rule_name": "Potential Abuse of Resources by High Token Count and Large Response Sizes",
-    "sha256": "b4bb7df60780eda7a7112af699e8f9eeb886859104a14dc0c0e590d88fbdfc26",
+    "sha256": "0ec57bc339f3fce1eca49752d9517e31d376889501714169d4c2e86fc43c6d2e",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "b1c14366-f4f8-49a0-bcbb-51d2de8b0bb8": {
     "rule_name": "Potential Persistence via Cron Job",
@@ -10593,9 +10648,9 @@
   },
   "b240bfb8-26b7-4e5e-924e-218144a3fa71": {
     "rule_name": "Spike in Network Traffic",
-    "sha256": "de46ac771569265cca83a3eb78ca92c48cf3478e0c49d68ffeb12dfeeaeccaf5",
+    "sha256": "b3411c6b99d0c79d2fe1c0df6b34fe5c2a9866107f061e8bc8b9c5ae08a66c80",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "b25a7df2-120a-4db2-bd3f-3e4b86b24bee": {
     "min_stack_version": "8.13",
@@ -10603,21 +10658,21 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Remote File Copy via TeamViewer",
-        "sha256": "a29d0b9a977b708aa1a61691d747913dbec9f7c2b91dbc0a40e511177f53deab",
+        "sha256": "0d0bd0de1c42b394ca6d718a32761db9128689309c818676ea02bd44009e6f48",
         "type": "eql",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "Remote File Copy via TeamViewer",
-    "sha256": "0c04cfa96ede82a6bbb59d8e384474d50b45f25914ae1e80b8f511c08aeb6711",
+    "sha256": "c8f3a33a1eda62ed530a6fc161bba9b0b5971ab42727c08f73a793be0b2199f8",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "b2951150-658f-4a60-832f-a00d1e6c6745": {
     "rule_name": "Microsoft 365 Unusual Volume of File Deletion",
-    "sha256": "1dbef7993a821421fc2fa12a51dab4936081be0382afeb3ebd8f36b93c07bdcf",
+    "sha256": "723230c66b898eb377542e469559e3654604ede32b8721af457c83afa144c4da",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "b29ee2be-bf99-446c-ab1a-2dc0183394b8": {
     "min_stack_version": "8.14",
@@ -10625,27 +10680,27 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Network Connection via Compiled HTML File",
-        "sha256": "0c4011e34ae723b0d5fbd00bd1e354badeb76adb69e7c4a44dd7e7cb1acc480b",
+        "sha256": "8eed8d54357b27cc75f72fb6d8bfbf8329b2bd2a0c09b43187d7132a3a6e195c",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Network Connection via Compiled HTML File",
-    "sha256": "116a6ad1cd9cb04c665956e8d54a4b226e296be8ffbf0a20f7073e7b6329ed3a",
+    "sha256": "7399a81fb47d057bd4c83b8a488b4fe9e614fe9fbca03daa78018eac37dcc058",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "b347b919-665f-4aac-b9e8-68369bf2340c": {
     "rule_name": "Unusual Linux Username",
-    "sha256": "a06f31bcbb968f4b0f7c2b9729c84a695e91e13c34ea63cd6aaedb3ccb06324d",
+    "sha256": "2eb4c2399504f67ff666102ceed72f7d457d96362545c820950c951e0fa3c5db",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "b36c99af-b944-4509-a523-7e0fad275be1": {
     "rule_name": "AWS RDS Snapshot Deleted",
-    "sha256": "5ef62fe38d22a4511a897c8008ac45dc5666daf58d4330f04538f49decbbeea1",
+    "sha256": "b66f1e7d1ec9f7028453eabcbf79b0a385bcd2f7f051b6c42fc560f604bf3ebb",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "b41a13c6-ba45-4bab-a534-df53d0cfed6a": {
     "min_stack_version": "8.14",
@@ -10653,22 +10708,22 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Suspicious Endpoint Security Parent Process",
-        "sha256": "8dcb7952ad32b417b17af0842d510e13cc6cdbc53392b0faf1d86f3f4ed08817",
+        "sha256": "788aa64f654d1ac9b8ffd4d72359798797fc89867374541a87bbe9a894fcf4e5",
         "type": "eql",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Suspicious Endpoint Security Parent Process",
-        "sha256": "67351b07df4aa1f47a5962233ac558f0f841b0b99dc69791d778f50a1490b724",
+        "sha256": "319f2d05d6abb9b5ba124cc01beac7e744ae47dc12b992b2bed1a9e23f17d27d",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Suspicious Endpoint Security Parent Process",
-    "sha256": "0cf7c5888e6bd4702f883dc4ba471a0d9c383c885d4588e6fe1a7ff741df7a15",
+    "sha256": "36ec98bc6180df8ef468f9c0214119135f7e9048ef4758dc1373818fc33d81e2",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "b43570de-a908-4f7f-8bdb-b2df6ffd8c80": {
     "min_stack_version": "8.14",
@@ -10676,34 +10731,34 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Code Signing Policy Modification Through Built-in tools",
-        "sha256": "168f65fff8c879d2ac1d9d8f75f943f5bfc82f8f42fb32accf1cafe4fa2f394b",
+        "sha256": "e8d26c789dc518e64dbc8a2ebc802ec86ad2ece06bdd9b24713721e87e4c3f2e",
         "type": "eql",
-        "version": 9
+        "version": 10
       },
       "8.13": {
         "max_allowable_version": 208,
         "rule_name": "Code Signing Policy Modification Through Built-in tools",
-        "sha256": "8abbd6548883de2d4be1a5b3301cd6db8b4794b27c6795d260aa7bc4563dbf15",
+        "sha256": "8e1370bc732b7ca13a8a4398d2978e5fbce22c79d8ed69889d4271f8500f9347",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Code Signing Policy Modification Through Built-in tools",
-    "sha256": "40c7f66bf4e89df1d59470f6039032a32e6991959d8e11a12649604b2ba79da1",
+    "sha256": "ada7de75fee9e8d288c51a4bea4856ecbad5060b978f2319b741a67989164c15",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "b4449455-f986-4b5a-82ed-e36b129331f7": {
     "rule_name": "Potential Persistence via Atom Init Script Modification",
-    "sha256": "c504a9e2929d88a06087ed97f63cef00dc04803abda6cfbe448c6c7c5a3d9900",
+    "sha256": "bdd06953c595a6c37482e67037eb72fb0d5301b42a5f4343e549c01b8c7cbb52",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "b45ab1d2-712f-4f01-a751-df3826969807": {
     "rule_name": "AWS STS GetSessionToken Abuse",
-    "sha256": "8d815943419b48862fd4b4d8bf7e7415b72bff58fb7dc7299a2548453ffd2670",
+    "sha256": "2f8c1a57650a8885345541c39bf72fc1fb21b8a10ac375920f107bc8110e7c76",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "b483365c-98a8-40c0-92d8-0458ca25058a": {
     "min_stack_version": "8.14",
@@ -10727,28 +10782,28 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Delete an Okta Policy",
-        "sha256": "477e3762a7205a2acdb25a27b55e30e562430a576cb8828546ddda6b8c94295e",
+        "sha256": "c8c6556d38f9955cc734b183b4e55614674315ba1a83737244551d638477aa88",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Delete an Okta Policy",
-        "sha256": "477e3762a7205a2acdb25a27b55e30e562430a576cb8828546ddda6b8c94295e",
+        "sha256": "c8c6556d38f9955cc734b183b4e55614674315ba1a83737244551d638477aa88",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Delete an Okta Policy",
-    "sha256": "2809e87ba46854079f02b132262f4babb3421ed1439ed5a93fa93365d8bfc5d9",
+    "sha256": "7e95af47b812b851ff7c0d56818e3f8c2aa918a77fc10b771a33f6b34d47291d",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "b51dbc92-84e2-4af1-ba47-65183fcd0c57": {
     "rule_name": "Potential Privilege Escalation via OverlayFS",
-    "sha256": "58bcb45f4849adaa8d78a19d8a371830c27498740c55f3af585b223cd3043f93",
+    "sha256": "e577352f4e85cfd958d5873c0804e639b7b3bf1f869e7ccc0f203e6d2492672d",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "b5877334-677f-4fb9-86d5-a9721274223b": {
     "min_stack_version": "8.14",
@@ -10798,15 +10853,15 @@
   },
   "b605f262-f7dc-41b5-9ebc-06bafe7a83b6": {
     "rule_name": "Systemd Service Started by Unusual Parent Process",
-    "sha256": "f7dabab39fc646885b39c4c9afb130a28ee22c77ab5d59c1661931a5024b5ea4",
+    "sha256": "632c8e11b721e5ec61820d811a8007bab97cc61f20dcaac08301345e24d0651e",
     "type": "new_terms",
-    "version": 3
+    "version": 4
   },
   "b627cd12-dac4-11ec-9582-f661ea17fbcd": {
     "rule_name": "Elastic Agent Service Terminated",
-    "sha256": "f3649a0d50320a3030f75006849ddad5a4d2da60d180156464fccb95ead0343d",
+    "sha256": "fff06615434083388a264c460161ae05556bb720792b5e921a635a843dfd4739",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "b64b183e-1a76-422d-9179-7b389513e74d": {
     "min_stack_version": "8.14",
@@ -10814,15 +10869,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Windows Script Interpreter Executing Process via WMI",
-        "sha256": "aa213b08606a60ecaa3893813321313519164133eef986d6e7514b6d32df9abc",
+        "sha256": "60fa1c1f92316dff5dbafafb8828c4493eb084e0a892fef14665afb65d337269",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Windows Script Interpreter Executing Process via WMI",
-    "sha256": "4f452d9f56b62a85917e5573aa9d6ccec3f73e1f315ed4713033aa6c121baad6",
+    "sha256": "972276704cff979323a1023ba183a94c4a7811ffb359898829ab87df4c85a032",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "b661f86d-1c23-4ce7-a59e-2edbdba28247": {
     "min_stack_version": "8.14",
@@ -10830,22 +10885,22 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Potential Veeam Credential Access Command",
-        "sha256": "b3f8b7e37e939e3cd6163ab49a982617cbd2281cc8245da41d7f0b07ffb9ac0d",
+        "sha256": "1f948ef193a4bd5afe3496e85933faafaa574a3999c3f5ebdb743dc559799312",
         "type": "eql",
-        "version": 2
+        "version": 3
       },
       "8.13": {
         "max_allowable_version": 201,
         "rule_name": "Potential Veeam Credential Access Command",
-        "sha256": "a781b7d7d5cb0610d58d9d15d1958e44ecdca51bccac374b26439493b44aa19e",
+        "sha256": "668a4b5083f2e5cddf17ac87a8d72dea5459ecb274000056b4b1190cf8cc9bb5",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "Potential Veeam Credential Access Command",
-    "sha256": "72b427f54c6695f023af0e9104a96d6c24a4b1b4656b3ad7c04ec87636e4af2c",
+    "sha256": "bb6f902b009039096c1412de2474ec0ac73ebe4aa60b042d2c63f0b0a7d3d2bf",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "b66b7e2b-d50a-49b9-a6fc-3a383baedc6b": {
     "min_stack_version": "8.14",
@@ -10853,21 +10908,21 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Potential Privilege Escalation via Service ImagePath Modification",
-        "sha256": "050e1cfaf93c6b295453f348901119d4394b12f7e0cab4e059bd351a1b69dd62",
+        "sha256": "84cb2fa184205ec6c7b5ebef44c3cf43d7a24ecba9aec4c0f148e7a5973fe61e",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Potential Privilege Escalation via Service ImagePath Modification",
-    "sha256": "af45308979a39d4eaba7f820d1065c522553f97422f59b37e1ceaa30e384f5b6",
+    "sha256": "ea54cd3fdb16046632a7a7a59ce1c225ff10aa9102c2044d0a293ea1b71c04d0",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "b6dce542-2b75-4ffb-b7d6-38787298ba9d": {
     "rule_name": "Azure Event Hub Authorization Rule Created or Updated",
-    "sha256": "a4d9380d9e964e50c7845854fa02ca808976bf2d52c4cb73dd90ed4e9439ae09",
+    "sha256": "cd16ad7a073247fc161d8c2ca330792ee681647ebcd1f37bb77fdc876df61cda",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "b719a170-3bdb-4141-b0e3-13e3cf627bfe": {
     "min_stack_version": "8.15",
@@ -10875,28 +10930,28 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Deactivate an Okta Policy",
-        "sha256": "c47529d65e905842112a5d39f9e08eb335d9a8b351fd619b3fc43409d2ec9a5d",
+        "sha256": "bab968eb40f5ad626342a32f0e22e901245c3618d0f488c7dbc51fd7db2ce2c7",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Deactivate an Okta Policy",
-        "sha256": "c47529d65e905842112a5d39f9e08eb335d9a8b351fd619b3fc43409d2ec9a5d",
+        "sha256": "bab968eb40f5ad626342a32f0e22e901245c3618d0f488c7dbc51fd7db2ce2c7",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Deactivate an Okta Policy",
-    "sha256": "22ed71c03d4cb3f48d0f982ba99da15abf24f3e69cca06212522c11dbd8b7c48",
+    "sha256": "08c9c6276d365fc690a88084ebcbae48a7842785385a954b0ed862a4b2a174dc",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "b7c05aaf-78c2-4558-b069-87fa25973489": {
     "rule_name": "Potential Buffer Overflow Attack Detected",
-    "sha256": "5380c3038a2af299ccd3b033b1406b58964ffa17c1f58df16c2ef6e5cf6cb8f3",
+    "sha256": "11fb2c414420fb768ad7993fc68b1c74c07ed35b6a72c9b94fad1706a163e9d3",
     "type": "threshold",
-    "version": 3
+    "version": 4
   },
   "b8075894-0b62-46e5-977c-31275da34419": {
     "min_stack_version": "8.15",
@@ -10904,22 +10959,22 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Administrator Privileges Assigned to an Okta Group",
-        "sha256": "67e6cd6cb7adda43f8503c30592825e8fafeed049f9746a421e91661fb162a60",
+        "sha256": "0041448b174d360c353186f2289154e2647e516ccf083b80c30bbe9a7e80e4f5",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Administrator Privileges Assigned to an Okta Group",
-        "sha256": "67e6cd6cb7adda43f8503c30592825e8fafeed049f9746a421e91661fb162a60",
+        "sha256": "0041448b174d360c353186f2289154e2647e516ccf083b80c30bbe9a7e80e4f5",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Administrator Privileges Assigned to an Okta Group",
-    "sha256": "f93d27a63ab602b347414513ec2b4a19c4b61d0750629e5f80bb1721d7e397ff",
+    "sha256": "e169dafee56e838f29e144fabeded937b7f9b89958e3b1bd0ecaf6001a8cab9f",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "b81bd314-db5b-4d97-82e8-88e3e5fc9de5": {
     "rule_name": "Linux System Information Discovery",
@@ -10949,22 +11004,22 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Creation or Modification of Domain Backup DPAPI private key",
-        "sha256": "45e53a796c682966471bda3cced6a2f51648bd4fac591899b88b9b5111ee3d04",
+        "sha256": "07495ad3087d7d941d4ac6b44ccb6b4afffd0b7a10b6cd91e41dc91e2c8bf5df",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 410,
         "rule_name": "Creation or Modification of Domain Backup DPAPI private key",
-        "sha256": "5fbb8e28328ce0d6b8eb601ed88b02aea94913e0aaac62864d73965cca3ef190",
+        "sha256": "dbe3ce72ae96d9a388571dbaee69e57b2e0783bfb28d89c12682e731babdc79f",
         "type": "eql",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Creation or Modification of Domain Backup DPAPI private key",
-    "sha256": "1a2bd980116032f3b23c60f6ff7d330af67914677769ffb5257e3c4586c81cf7",
+    "sha256": "f6b6199880ad069f381932ed419cc9eb6a89a0bdd3a8643c23bdf0f8ec1375b6",
     "type": "eql",
-    "version": 412
+    "version": 413
   },
   "b86afe07-0d98-4738-b15d-8d7465f95ff5": {
     "min_stack_version": "8.14",
@@ -10972,15 +11027,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Network Connection via MsXsl",
-        "sha256": "97661aa1f38ec86767f0b0059ad5aab142c0f1dfcfe79c093165e0dcd8ef1266",
+        "sha256": "6fa622d8cf25c559993ee681c4c59fe4875676f7a1e75fae7f9837ae73c39837",
         "type": "eql",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Network Connection via MsXsl",
-    "sha256": "2a8d4623d634d9ba410321005df48a3d01e6223aae8df69789c9d8d06ba0b095",
+    "sha256": "1d3c54055176ee07cd35f819d276249cbef1c3a9d0f0f4e1baa830336b20aaf7",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "b8f8da2d-a9dc-48c0-90e4-955c0aa1259a": {
     "min_stack_version": "8.14",
@@ -10988,22 +11043,22 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Kirbi File Creation",
-        "sha256": "52733bb7e64cb9cd415a8e7906dafb89ab3d959b851c1ad8b6afd29cfc6eae22",
+        "sha256": "c10cf18764bba367c5dc4f521024dc94ef68710285c6f90a067c4237780913a5",
         "type": "eql",
-        "version": 7
+        "version": 8
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Kirbi File Creation",
-        "sha256": "d4bb7b621d40378ce8bd39a87d46ccfedd440b733962e100fa3813f738a80a22",
+        "sha256": "e4040481f58c3fe815861e36ac5ce0ae5800f0c677fbfe8fb4f3b92a3ed843e3",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Kirbi File Creation",
-    "sha256": "9c52cab4c0ede53965241d9332ed5d03335a7efa2d96067f2cd95ea3844f3e1b",
+    "sha256": "4657563a7e924aa8d3e22e93a3d7b63359d96a5f3fca0bcc8b2acf48620e8517",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "b90cdde7-7e0d-4359-8bf0-2c112ce2008a": {
     "min_stack_version": "8.14",
@@ -11011,22 +11066,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface",
-        "sha256": "06cd8a9c2cc711c339f9e9c86a0b0e31950b1620f3c927162433104d644a4a8d",
+        "sha256": "58aa89bc163a9683f9b49afe3a23214fc5db86e93510a6cec8b716e16e93cbe1",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface",
-        "sha256": "0cf05a58ea4296f5dd53393e3fa87a56decafbc24ed8a95c02173a6278d99696",
+        "sha256": "cbcbee9fed32c048febce9bb94050b601d2a11f48b70199fced4a32261b24be1",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface",
-    "sha256": "214ce6ab3146a3459a0af3b78a456204ac356e19d633e99e5b038f6e42f1306b",
+    "sha256": "5279287a7c569096f588da6a81739ad2b52940bb1fde4b4cdfc5e18d4c91a8f7",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "b910f25a-2d44-47f2-a873-aabdc0d355e6": {
     "min_stack_version": "8.13",
@@ -11034,15 +11089,15 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Chkconfig Service Add",
-        "sha256": "9c7a8cfb8eca73b67ec15c23255ca9cf126e741100f64dc1894d35746f8b2985",
+        "sha256": "86f0056ad335bea28f944aa15d086beedcd4cf45c699a155c5d200a3c5f35630",
         "type": "eql",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Chkconfig Service Add",
-    "sha256": "79b56443468b45ce575c9a254a235d16a81c2aa037b5f0b8468ab2ba1ee11c68",
+    "sha256": "21e5aa78000484a6ec71a88a5576fdb6b587b05dcf7dfce464c4f80c2acb36cc",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "b92d5eae-70bb-4b66-be27-f98ba9d0ccdc": {
     "rule_name": "Discovery of Domain Groups",
@@ -11052,9 +11107,9 @@
   },
   "b946c2f7-df06-4c00-a5aa-1f6fbc7bb72c": {
     "rule_name": "Multiple Alerts in Different ATT&CK Tactics on a Single Host",
-    "sha256": "b83cfd125f81b6526b23aac2a53cc883827934288f3bb4ae9a000c705c69cd7c",
+    "sha256": "19d1c906ae5392003ceb75e3b5029ddbf145381cfd2a57fe149af0c098078bcf",
     "type": "threshold",
-    "version": 4
+    "version": 5
   },
   "b9554892-5e0e-424b-83a0-5aef95aa43bf": {
     "min_stack_version": "8.14",
@@ -11074,9 +11129,9 @@
   },
   "b9666521-4742-49ce-9ddc-b8e84c35acae": {
     "rule_name": "Creation of Hidden Files and Directories via CommandLine",
-    "sha256": "96c38ecf43de8a4a33c0288d46a9ba72c818241dbfade2a921c8c79a69ed4faf",
+    "sha256": "6eb78e4e68db04a09adf0fdb65a67e357d7241e22256f53fa3efe38323d47515",
     "type": "eql",
-    "version": 111
+    "version": 112
   },
   "b9960fef-82c6-4816-befa-44745030e917": {
     "min_stack_version": "8.14",
@@ -11084,22 +11139,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "SolarWinds Process Disabling Services via Registry",
-        "sha256": "71e9aa09fa89569defb2a149c30bf379e219b2f9cba453977f75c6ab69845847",
+        "sha256": "30d3fcfb86a4c9e23c5563059dc2df4b75f106ceedf2a7f57f7731cb984430bc",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "SolarWinds Process Disabling Services via Registry",
-        "sha256": "bda5b68f6a9ce0faa83bde7e30a5eec3d8841869e427b86112cf0f0a52a6353d",
+        "sha256": "021d6661e231a18c2c0c62fe88c1b3a16cf3dfa20e449e7d6c704c50f70616ce",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "SolarWinds Process Disabling Services via Registry",
-    "sha256": "9623c43706d421a241ab6b399c014dbf39d8e09e1801bf1e8527980848090a52",
+    "sha256": "8448fdad37a26284d2c146a1c6f84be4345849b97567a3c0faf586e92b59aada",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "b9b14be7-b7f4-4367-9934-81f07d2f63c4": {
     "min_stack_version": "8.13",
@@ -11107,15 +11162,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "File Creation by Cups or Foomatic-rip Child",
-        "sha256": "7c771e2cb6b8fc6e241c50beebc9871ffb34e29e2758e25d9042b45a8104f2b4",
+        "sha256": "19b3cd102fa17756195c9b9ed7ab06bb5a730f2d79302f0afa39106c89e7525e",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "File Creation by Cups or Foomatic-rip Child",
-    "sha256": "7290db76baf9144af96253a9ce550a595a2a9f73702c03d611771e991ad38f20",
+    "sha256": "bf75ba62f1105bfb5b0c1a6818eb8027febd42efb55d134e7d5d25f967e06369",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "ba342eb2-583c-439f-b04d-1fdd7c1417cc": {
     "min_stack_version": "8.14",
@@ -11123,27 +11178,27 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Unusual Windows Network Activity",
-        "sha256": "f44147f6949a71b6f2d3d1fce8812830bd011f98dcef007a977d3a50df705d57",
+        "sha256": "cd715d2616e427081beaa901230dba625ab6c14e52d0571ae643a92f04c77435",
         "type": "machine_learning",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Unusual Windows Network Activity",
-    "sha256": "0a7119838ef1bbfcb9f54801d64f16dd3d98728399c20c2d35f94a5ce6ad4ce4",
+    "sha256": "006889f0bed32a73ed4d97e42325e7b69cd13e35ed45d30f6b58a091b6f54973",
     "type": "machine_learning",
-    "version": 206
+    "version": 207
   },
   "ba5a0b0c-b477-4729-a3dc-0147c2049cf1": {
     "rule_name": "AWS STS Role Chaining",
-    "sha256": "58bc4d819e8f3c20c185397da3f15f20e53974723a07372c04ba0d8368367511",
+    "sha256": "78203718bf9153ae050ec6e0c41b037e34f6916e09b6cfb0d771158a41500c71",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "ba81c182-4287-489d-af4d-8ae834b06040": {
     "rule_name": "Kernel Driver Load by non-root User",
-    "sha256": "8c938c1fdbabd146fcde85cf8129c9bd1bcf1dd989aaf68650cd11bf09181844",
+    "sha256": "33f5ec32f53d28ddc67a858bea818290a2defa25dbb7487eca3dc127a6b2c2e9",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "baa5d22c-5e1c-4f33-bfc9-efa73bb53022": {
     "min_stack_version": "8.14",
@@ -11151,51 +11206,51 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Suspicious Image Load (taskschd.dll) from MS Office",
-        "sha256": "e224bdce56aa39ba7fca19f483ee4080daea489a943e6211cb1ec88aa1754671",
+        "sha256": "998cfcfee5231e24bd5fb08c5921e0c9915f8d4b9db65d1b7daaa574cbf601af",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Suspicious Image Load (taskschd.dll) from MS Office",
-    "sha256": "94ce634225344b3f6df8c3497393fba829c409f0d01520f34d4611a74ed8bea3",
+    "sha256": "bf12d588236251e2feda39ddb4621aab72de0d06c0cc78366cfb8cde48293fc9",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "bab88bb8-cdd9-11ef-bd9a-f661ea17fbcd": {
     "rule_name": "AWS SQS Queue Purge",
-    "sha256": "8173c3edd7611e8e6ac7f67f431510c5f5f03b166aebaf51c63f23002e51efab",
+    "sha256": "5142cc67f154e6eca142e3365f66a98511c0ea7276fa784ece159df9c9204371",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "bb4fe8d2-7ae2-475c-8b5d-55b449e4264f": {
     "rule_name": "Azure Resource Group Deletion",
-    "sha256": "d6e81ca3325b8461c497b7a0edcb7ba2a438aaadc2af98f490696891126c3576",
+    "sha256": "ee0a9985f47c61b4899e6db0ffb46a7ecbf7889137cbc89ba4af8a83b184591e",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "bb9b13b2-1700-48a8-a750-b43b0a72ab69": {
     "rule_name": "AWS EC2 Encryption Disabled",
-    "sha256": "8d31ea9768807181a7d1aca8eb47a8f3c015b3412c46ccf6963c5e06b676e834",
+    "sha256": "38ebab645d36ccdb700fab60ae741b7fc1fdcd857893d3f9a8bd8d8104af6e69",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "bba1b212-b85c-41c6-9b28-be0e5cdfc9b1": {
     "rule_name": "OneDrive Malware File Upload",
-    "sha256": "b2abdce89d919f7eaeb571349e52d6d14eac86020237f33d935576d9f83954aa",
+    "sha256": "b6bae391783faf8fddf063267243569a829caea469887045e326ef63f991dada",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "bbaa96b9-f36c-4898-ace2-581acb00a409": {
     "rule_name": "Potential SYN-Based Port Scan Detected",
-    "sha256": "0586e7ec163e6ee3f44ce1f67ad461e83904af39fd44217e236e606f06b3631b",
+    "sha256": "05243ad8bcf1c489dda20542d41494fe6641f590a7c9163823244bca9ef5e080",
     "type": "threshold",
-    "version": 8
+    "version": 9
   },
   "bbd1a775-8267-41fa-9232-20e5582596ac": {
     "rule_name": "Microsoft 365 Teams Custom Application Interaction Allowed",
-    "sha256": "bfeee6d64b53fd5857ae139679a0455df0d0127f55134eadfdf8053869f558f3",
+    "sha256": "d2591be6119e7fd59bceea00f9241d1477bfca0672c2bddffa9aa118eba5e5a5",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "bc0c6f0d-dab0-47a3-b135-0925f0a333bc": {
     "rule_name": "AWS Root Login Without MFA",
@@ -11205,33 +11260,33 @@
   },
   "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331": {
     "rule_name": "GCP Storage Bucket Deletion",
-    "sha256": "56e79003e4ad65163eb8f9aaf96239590b6a756222a60be2d8115a39b4c1a54d",
+    "sha256": "0e92d2b35ccf8e91dbd05bb2cf976add13ed7c2ebe9e7b8f3a14e6ba4423ddfd",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "bc0fc359-68db-421e-a435-348ced7a7f92": {
     "rule_name": "Potential Privilege Escalation via Enlightenment",
-    "sha256": "6401927f8fccbd1a2df04a2676ccbbb51a67242c1fed8afcc893fdff0e431642",
+    "sha256": "c495eca6bcb598a318fb77f1671382014e7772f5465284d0f6c25913744e6e5d",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "bc1eeacf-2972-434f-b782-3a532b100d67": {
     "rule_name": "Attempt to Install Root Certificate",
-    "sha256": "903b93770a64c71465333adf2e585d4931a592eccfe4eb954cadab052441c972",
+    "sha256": "ca00d2bc624c0e0eb4f4138104ba3f44baf33fe7d37ef8b693d45c8809e8f686",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "bc48bba7-4a23-4232-b551-eca3ca1e3f20": {
     "rule_name": "Azure Conditional Access Policy Modified",
-    "sha256": "cfacc3ddc30a65458618914bcd492cf9fbb25d104b2271afdb3ff3fef7bf0c0c",
+    "sha256": "585daba14bfe511045ed1f9225e2c8ef3004686898d5598678574811ce335190",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9": {
     "rule_name": "Potential Non-Standard Port SSH connection",
-    "sha256": "97bc67179bba8f6cfb7b0f1f51016d7a35525d4394522b1dff503b2777675b42",
+    "sha256": "af251fd5a27dc1da60e95a6f5bd4dcf2a8651ea1becf053232e00e667f4eaac8",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "bc9e4f5a-e263-4213-a2ac-1edf9b417ada": {
     "rule_name": "File and Directory Permissions Modification",
@@ -11241,15 +11296,15 @@
   },
   "bca7d28e-4a48-47b1-adb7-5074310e9a61": {
     "rule_name": "GCP Service Account Disabled",
-    "sha256": "10252c6946a904bb799ac153943817d274319179587022f10240f3e65af79ace",
+    "sha256": "e63ea7699aec49aa63199a96c6f12b53d541b10b9035007f16c27383a357cd39",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "bcaa15ce-2d41-44d7-a322-918f9db77766": {
     "rule_name": "Machine Learning Detected DGA activity using a known SUNBURST DNS domain",
-    "sha256": "41097481c1fd5da6e1bd4c66305518ee0a92846e0a69ae89fd936b10338b1c33",
+    "sha256": "4c0f453a7ee9fec7e8d4245344823941109f187ed0b227e6556e050122701cdf",
     "type": "query",
-    "version": 5
+    "version": 6
   },
   "bd2c86a0-8b61-4457-ab38-96943984e889": {
     "min_stack_version": "8.14",
@@ -11289,21 +11344,21 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Suspicious Print Spooler Point and Print DLL",
-        "sha256": "d3a4fe36f9cfc3992560267e468577a3a244bcf0ef337b17dd9d40cfc525840c",
+        "sha256": "e65486c1eace3f2cba2f77b32a8523d31ee20a81635805ba14e9344aff57dabc",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Suspicious Print Spooler Point and Print DLL",
-    "sha256": "db7cf9c80bdb8b5893f2f43e48a7d7df98a942bf350a50d63170ac69fa939a6f",
+    "sha256": "f993d429934670b2858130841325ed6efbed63e48d06218e4b98f59688c119b2",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc": {
     "rule_name": "Potential Pspy Process Monitoring Detected",
-    "sha256": "208ae3e9f868bf1cce7eb02281964c937adbfde045a989a1092be5f6762da5f5",
+    "sha256": "3631d09f36db2837c95c7275f4a50e82f4de95b0d0073c8f8e590b4962170e27",
     "type": "eql",
-    "version": 8
+    "version": 9
   },
   "bdcf646b-08d4-492c-870a-6c04e3700034": {
     "min_stack_version": "8.14",
@@ -11311,15 +11366,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Potential Privileged Escalation via SamAccountName Spoofing",
-        "sha256": "88869a90ff8b60cea2e3b311a3cff7348cabd05ea463923dacb7e7810c9063a8",
+        "sha256": "c8d4db837c40680f29b2140e0f41995c0ce4aed2dbca551b70894be0abd9fd37",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Potential Privileged Escalation via SamAccountName Spoofing",
-    "sha256": "648bf202efc778e1ea44b6f4bc7c7ed4bc604a577fcc05f919cf3c4039e47be7",
+    "sha256": "2100b7b6c9f3ce481f1dcf4333c039e84300cc7aa056627d9862759994df042c",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "bdfaddc4-4438-48b4-bc43-9f5cf8151c46": {
     "min_stack_version": "8.14",
@@ -11327,15 +11382,15 @@
       "8.13": {
         "max_allowable_version": 100,
         "rule_name": "Execution via Windows Command Debugging Utility",
-        "sha256": "fa9ae9a7e20aab6c162d2e5a0efe0f3abacb8e51ecc0dfde0e1e9ada66b911e5",
+        "sha256": "128e25dc4dd9800c4db478e306a37b6768835a4ef62f53f680e0cdd502d7d9bc",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Execution via Windows Command Debugging Utility",
-    "sha256": "de2a9f336f392f64c5a8f2b0a31498085b0ef328787d7393babf01a457d396ae",
+    "sha256": "a97e98b65f9fd4cfb965319493b00bacc31ef7a46fb0a50e22baa11a6fba7ac7",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "bdfebe11-e169-42e3-b344-c5d2015533d3": {
     "min_stack_version": "8.14",
@@ -11343,21 +11398,21 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Suspicious Windows Process Cluster Spawned by a Host",
-        "sha256": "cc1d705bc605d526d53b66ae99fe04295569f385dba1baf4b454810b18014206",
+        "sha256": "a2ccf5e3e960c49d64850d992659f30b31d2b4619143f6ace9586298ada41e55",
         "type": "machine_learning",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Suspicious Windows Process Cluster Spawned by a Host",
-    "sha256": "33fbe922a809500b90b0b747bca167cf62c51e06ababa878a628223092488470",
+    "sha256": "9b8577a62bbfbbcec6a5aba3c11a4d4901222b6a7403c548c74dda4a01e5f84a",
     "type": "machine_learning",
-    "version": 107
+    "version": 108
   },
   "be4c5aed-90f5-4221-8bd5-7ab3a4334751": {
     "rule_name": "Unusual Remote File Directory",
-    "sha256": "7b9570bb0ddabacbeccf2b03bf6ea05d0ed3a286165e5b807313c17531ac9116",
+    "sha256": "02fd93eaee629a0cd91484e1809579b28f142b07255c4e850b358d3255e40870",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "be8afaed-4bcd-4e0a-b5f9-5562003dde81": {
     "min_stack_version": "8.14",
@@ -11365,28 +11420,28 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Searching for Saved Credentials via VaultCmd",
-        "sha256": "9fccd84e0d8fb3b15fbb84c2772e68bece05e41bf66896555fe409a03f691dd7",
+        "sha256": "1bf926c25f9a52807b31c6c522765f3687f5c07aded267e5efb051935cd32426",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Searching for Saved Credentials via VaultCmd",
-        "sha256": "db1f6c9c5239a78f6c915ce9494aaffcf9463f9e6f0dd22ae5f13015228ec267",
+        "sha256": "50a2fccdd9f12b719de8bf5aa6575e9411a70beb5f69f0d624a2d57b94565894",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Searching for Saved Credentials via VaultCmd",
-    "sha256": "f4689b888fd798880d919b9f8ffbd6b0e6a45d941a01ac44077e773d933a4b5b",
+    "sha256": "760c0bdbfa8e2d2cbd1b79da8d81f2bef5f54a26c29695209f466ed712a2ba4a",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "bf1073bf-ce26-4607-b405-ba1ed8e9e204": {
     "rule_name": "AWS RDS DB Instance Restored",
-    "sha256": "0703a09b818a7309df61f2173cfadcdd04899c0f597c70caebec0a6a7a077968",
+    "sha256": "5ed9f6f791ac753a0f0fa1e54b8d921e255e589b1e837cdbd454b8d4cd6703a5",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "bf8c007c-7dee-4842-8e9a-ee534c09d205": {
     "rule_name": "System Owner/User Discovery Linux",
@@ -11396,9 +11451,9 @@
   },
   "bfba5158-1fd6-4937-a205-77d96213b341": {
     "rule_name": "Potential Data Exfiltration Activity to an Unusual Region",
-    "sha256": "c3cf350e861be02338f712fd3772691bcefeb7f7d07e9718eec2fbc3476c707e",
+    "sha256": "ea23ea39e92ba2c5aa62c8b58b895f5fc1b9ed7e1645e2d1ebdf6f94725f24de",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "bfeaf89b-a2a7-48a3-817f-e41829dc61ee": {
     "min_stack_version": "8.14",
@@ -11418,9 +11473,9 @@
   },
   "c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d": {
     "rule_name": "Potential Privacy Control Bypass via Localhost Secure Copy",
-    "sha256": "5443c5577d436ff7ea5d9802accfe2fff6ea50813a238c85ff0b60dc1a102579",
+    "sha256": "d1081bdf15942c3ead0b673aca3c61da00f6a80d02751edf2450107ee01283ad",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "c0429aa8-9974-42da-bfb6-53a0a515a145": {
     "min_stack_version": "8.14",
@@ -11428,29 +11483,29 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Creation or Modification of a new GPO Scheduled Task or Service",
-        "sha256": "db80515372b13521184021a9451c545f6e530fc191866f76eb9a2c1584f99210",
+        "sha256": "7e6ca9dcd52afbbcb0b9a55e6aa6e2769fa1ec0eea2be911c612512a3d980c07",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Creation or Modification of a new GPO Scheduled Task or Service",
-        "sha256": "46f5dedea1c425098d98714b5c270d6a19a1448ac58d30298bfc61ed75871e39",
+        "sha256": "2c89d3ecf4ae5e9471d08131a67258ada5c25e166066700187f8fb376b224e4b",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Creation or Modification of a new GPO Scheduled Task or Service",
-    "sha256": "22c604dcead155c536a23f4687ff4c4ff12c55e14328e455fe26c9d245f4db2f",
+    "sha256": "b27fd36d7d58fc1103502201694ebb4f9711505eb7be212b1970a49aa4018803",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "c04be7e0-b0fc-11ef-a826-f661ea17fbce": {
     "min_stack_version": "8.13",
     "rule_name": "AWS IAM Login Profile Added for Root",
-    "sha256": "e97ee0da03a10eab7cd326f1e77d4b2c462848200bc15e183a7be0b2074dcca1",
+    "sha256": "260baba4a026a272e648f568530059f1eea3a4f0c91f0895da0a4110d7f684aa",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "c0b9dc99-c696-4779-b086-0d37dc2b3778": {
     "rule_name": "Memory Dump File with Unusual Extension",
@@ -11460,9 +11515,9 @@
   },
   "c0be5f31-e180-48ed-aa08-96b36899d48f": {
     "rule_name": "Credential Manipulation - Detected - Elastic Endgame",
-    "sha256": "5bcb1915b28b6a1282d3b512b13b559f6d0256da8db229d9210b4a03f2fe6af3",
+    "sha256": "a4ff1c4f9d920c7e68294561498fe4fed983eb988fb9f5f2b48394a7deebc588",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "c124dc1b-cef2-4d01-8d74-ff6b0d5096b6": {
     "min_stack_version": "8.14",
@@ -11482,15 +11537,15 @@
   },
   "c125e48f-6783-41f0-b100-c3bf1b114d16": {
     "rule_name": "Suspicious Renaming of ESXI index.html File",
-    "sha256": "5e8b6b9370d7f11367a4da3f7d0911702117a24814ab84a0bf12ae972ff4c2aa",
+    "sha256": "7bfc1be6cb1b3f2bc6acd909ac81053d7da40a859ce32f301f7448b76a17d4fe",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "c1812764-0788-470f-8e74-eb4a14d47573": {
     "rule_name": "AWS EC2 Full Network Packet Capture Detected",
-    "sha256": "c3267472104e0888d5c9e55574ae19d07c39c00e8c6a76a01fc766fbb0689f63",
+    "sha256": "ae318338980158a5279e376699053252b367bd3ad4618eeec9bd5f9d18ca9749",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "c1a9ed70-d349-11ef-841c-f661ea17fbcd": {
     "rule_name": "Unusual AWS S3 Object Encryption with SSE-C",
@@ -11499,10 +11554,10 @@
     "version": 1
   },
   "c1e79a70-fa6f-11ee-8bc8-f661ea17fbce": {
-    "rule_name": "Attempt to Retrieve User Data from AWS EC2 Instance",
-    "sha256": "e91c1937b74003d85688ec403aaac6adde3afedc30ff608772e3b3f8346e2bdc",
-    "type": "query",
-    "version": 2
+    "rule_name": "AWS EC2 User Data Retrieval for EC2 Instance",
+    "sha256": "d6549a9282b2ef25313f167c7193896b02cb13efe287b26ba00e59de84647195",
+    "type": "new_terms",
+    "version": 3
   },
   "c20cd758-07b1-46a1-b03f-fa66158258b8": {
     "rule_name": "Unsigned DLL Loaded by a Trusted Process",
@@ -11512,9 +11567,9 @@
   },
   "c24e9a43-f67e-431d-991b-09cdb83b3c0c": {
     "rule_name": "Active Directory Forced Authentication from Linux Host - SMB Named Pipes",
-    "sha256": "7eaafe9a1859aea975f3a42c61875d9938e374647239d4b28ad396c47e79b439",
+    "sha256": "639384f73345b48b0a96eb16e0b3f8160d8573e672cdc7743e710a69b00c200a",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "c25e9c87-95e1-4368-bfab-9fd34cf867ec": {
     "min_stack_version": "8.14",
@@ -11522,40 +11577,40 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Microsoft IIS Connection Strings Decryption",
-        "sha256": "fbee6d2c06dbbfc87ca0b8695bd5b6d9f72acbb751ce228da8e4cb479b01d60f",
+        "sha256": "29903b3865bb0e5568138436f842ca97f4731359045b7bff776424130946cc06",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Microsoft IIS Connection Strings Decryption",
-        "sha256": "75e92ba876a46ba416822bbfaaed256d7fa604ac8d9cdcaebf4485f15cd91632",
+        "sha256": "69a7694bbee8a347e6b1f706a60da157e9a3f4ebef346e841475709ae3d55f67",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Microsoft IIS Connection Strings Decryption",
-    "sha256": "6d389db925ca6ff91bfe40b09dda0749379ddfca071421d7cd921cb6eda3b48c",
+    "sha256": "dab86b9d33245df07123dcaad409fafb00109831e1aaa7d92ab104baa5ac8f46",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "c28c4d8c-f014-40ef-88b6-79a1d67cd499": {
     "rule_name": "Unusual Linux Network Connection Discovery",
-    "sha256": "7d982bb13ae1a04e1debe5ea0265e3e5d576b25838f8bd13877d6c5a1b77a681",
+    "sha256": "8d8ee64704769447bf2d40b32ebb9e6d6425a52106d8fb1761fdbfe190f269a5",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "c292fa52-4115-408a-b897-e14f684b3cb7": {
     "rule_name": "Persistence via Folder Action Script",
-    "sha256": "8249dd1544fa4a71d15bdd5d893422c51458d358b8c77ac350b3d7b9ad0d2cfa",
+    "sha256": "aebb2d6e14deb297e5776a1b9acbd4365a9ca16d04e7f180425a7d9f597c79e4",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "c296f888-eac6-4543-8da5-b6abb0d3304f": {
     "rule_name": "Privilege Escalation via GDB CAP_SYS_PTRACE",
-    "sha256": "ea98f3aeb649cfc57e8d9c4a04ecb8f4599dd683fc28415e8146ca925c02d14d",
+    "sha256": "c56c5fbae20de71b0b2282d5c481c2ae900325075c2feb25b32907fb7565593e",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "c2d90150-0133-451c-a783-533e736c12d7": {
     "min_stack_version": "8.14",
@@ -11563,27 +11618,33 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Mshta Making Network Connections",
-        "sha256": "c874d8e0df6ae897a277a01aff80ac0258b1defdaa7722e37539a516348e7624",
+        "sha256": "1df29ad5d0ca0a28702b68944cb3950151ce264faeed1d0cac6cdc59be122b4b",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Mshta Making Network Connections",
-    "sha256": "9f77b2b2eebd6e08c007e73536752a8651c85bccde0c72303282ccb671a8ed42",
+    "sha256": "35ebb1787e73b188c74759108e7580f588b69fec28e602e40297dbe2e08a1709",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "c3167e1b-f73c-41be-b60b-87f4df707fe3": {
     "rule_name": "Permission Theft - Detected - Elastic Endgame",
-    "sha256": "bc09245f3bf048bc8d9e4f1ca381711fc8fa9d71f6533673b7f573f84061f6d5",
+    "sha256": "cadcbc3ef71a2fdf85c7b7666569914967f3b8045422bfb42a860c4aa73358ec",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "c371e9fc-6a10-11ef-a0ac-f661ea17fbcc": {
     "rule_name": "AWS SSM `SendCommand` with Run Shell Command Parameters",
-    "sha256": "0708e23a034fee01df470474eaa8c8f2f7a058631b83a0987e39af15bc538007",
+    "sha256": "18af645751efdccc31b367d06c1f9221851668fc7dabdcc02e9be3bc6d1268f5",
     "type": "new_terms",
-    "version": 3
+    "version": 4
+  },
+  "c37ffc64-da75-447e-ad1c-cbc64727b3b8": {
+    "rule_name": "Suspicious Usage of bpf_probe_write_user Helper",
+    "sha256": "783dba9bf2adf9672499975f28ca2c251157407146f529383f27229b8b03b597",
+    "type": "query",
+    "version": 1
   },
   "c3b915e0-22f3-4bf7-991d-b643513c722f": {
     "min_stack_version": "8.14",
@@ -11591,28 +11652,28 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Persistence via BITS Job Notify Cmdline",
-        "sha256": "9739d6cb844a334bc159de23e8d565d195f79368a52e93838ee883fa2049ec87",
+        "sha256": "2f351a320cf7736fa0382f0a514fc587d7a9a6e9df3e0fa798996b1378845e86",
         "type": "eql",
-        "version": 108
+        "version": 109
       },
       "8.13": {
         "max_allowable_version": 409,
         "rule_name": "Persistence via BITS Job Notify Cmdline",
-        "sha256": "3ee641a856aab0e4e1f23e3bb55717a5567eef2d8e52cd2264595fff36224273",
+        "sha256": "858019a92e6dbfe1af3a06f1d96710314aa12802e6db988f1f4a9c5bd6fbfe5a",
         "type": "eql",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Persistence via BITS Job Notify Cmdline",
-    "sha256": "84190df73efbeee30c435b862e6339cd80ea290b44deb8a5717118537039b954",
+    "sha256": "aadadca71e75e01e994ff9148f368bfd7b277c1ddfdae04d6f9ea3aecf1e2ce2",
     "type": "eql",
-    "version": 410
+    "version": 411
   },
   "c3f5e1d8-910e-43b4-8d44-d748e498ca86": {
     "rule_name": "Potential JAVA/JNDI Exploitation Attempt",
-    "sha256": "0776cc8251cdbd9e2e2060a17b2300834a0ed4a49489a105abb3c0dd75b19cc8",
+    "sha256": "280e239c6b53224a5351f5f23e4f4660518500fe9da555ca1218ac45abb6caf5",
     "type": "eql",
-    "version": 104
+    "version": 105
   },
   "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14": {
     "min_stack_version": "8.14",
@@ -11620,22 +11681,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Mounting Hidden or WebDav Remote Shares",
-        "sha256": "4f666b4d6483dcf490a23c94ca65dce3962f9a0dc3d482280c676c363d4bf77e",
+        "sha256": "bc1b90a1a5d02845a8233abdaaff8ca068f4d6ccb29b7d6e8df55c25ccc8190d",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Mounting Hidden or WebDav Remote Shares",
-        "sha256": "050a77ee2d2b2c854c6320a07694f747e48b09086e2645e5e46e63cda03729f0",
+        "sha256": "66d36844c67b648b4c4559b7763008bb43f79e6e5a69933731f037b434d1b553",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Mounting Hidden or WebDav Remote Shares",
-    "sha256": "d8d527c314b2a860bfd447d4f890c361324c76dafb9094cb24b83ce8992a998c",
+    "sha256": "72af0267f6d68ef9e8303b0f95ca9b116c0ab53dec1fbb65653f47f1db386071",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "c4818812-d44f-47be-aaef-4cfb2f9cc799": {
     "min_stack_version": "8.14",
@@ -11643,22 +11704,22 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Suspicious Print Spooler File Deletion",
-        "sha256": "6764db9d99a9d2a1bce0efae356412f7b62f66204dfe3496cf5d8e142aa916ff",
+        "sha256": "04b3ecf212987b57bdaedbb14a301b6f913473e5abb301dc94b6371c56d73567",
         "type": "eql",
-        "version": 107
+        "version": 108
       },
       "8.13": {
         "max_allowable_version": 306,
         "rule_name": "Suspicious Print Spooler File Deletion",
-        "sha256": "8895e76598306332603174aa736fad580b191085cfa16e063a5e68dd62cfd102",
+        "sha256": "3cde3fd44462edc279d64b412008d521638ddabb0029d151dc594348b04ed627",
         "type": "eql",
-        "version": 207
+        "version": 208
       }
     },
     "rule_name": "Suspicious Print Spooler File Deletion",
-    "sha256": "471171679c1f48fa93954b8787198a0094598e326a0f6c24ae1b22c07b40251d",
+    "sha256": "1ad69e32d7a2cf3559f0ee82cc8620601c5d764ba5c054292e16e4f9e5953fbf",
     "type": "eql",
-    "version": 307
+    "version": 308
   },
   "c4e9ed3e-55a2-4309-a012-bc3c78dad10a": {
     "rule_name": "Windows System Network Connections Discovery",
@@ -11704,28 +11765,28 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Potential Remote Desktop Shadowing Activity",
-        "sha256": "2d3a93d4e613dace19446854539467cead96901968f44270796ce546beeb940a",
+        "sha256": "f23375e5d2e676c1e1abe448a171c858dc5ad2300e66ef5c599e7e8325cb3390",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Potential Remote Desktop Shadowing Activity",
-        "sha256": "d7461fda5a82259331589a9df2a3a7f39630bc5f8e08c25f2190e7f8bfb1ae29",
+        "sha256": "fc5dcf6dd48339a257eefaebdb911d38f7a3a6bfd632423bee74a204c7834344",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Potential Remote Desktop Shadowing Activity",
-    "sha256": "9f78c640ad25e83eafe47ad5226ce12c169358048d03ffb119f9b94df969c3e5",
+    "sha256": "71cec7c47c2c7d46230f68fe874142b0c1e36dec0aa4bec9023d29d4c4f23a15",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "c58c3081-2e1d-4497-8491-e73a45d1a6d6": {
     "rule_name": "GCP Virtual Private Cloud Network Deletion",
-    "sha256": "7f47bc00b67f2997890fd47eff9350e23e6effea54914edcbb180c321a553276",
+    "sha256": "ae48749a0c3d555094e1e400445796ffab2c7a22025f4ec856e582107747e9ce",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "c5c9f591-d111-4cf8-baec-c26a39bc31ef": {
     "min_stack_version": "8.14",
@@ -11733,15 +11794,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Potential Credential Access via Renamed COM+ Services DLL",
-        "sha256": "bd759b2a552a5ce6a16e041b6708cf7215821c978d6c820100f29ff8567b357f",
+        "sha256": "7e9ee856f86f121f008eb8a3304b4955828d5b4d5333a47de3f36d478e0562e7",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Potential Credential Access via Renamed COM+ Services DLL",
-    "sha256": "7c57916d4cbeb0fde51ef91819b1a5011019694b631ce8c734dd6aae5bede3c6",
+    "sha256": "0fc2faa2b6a15a4dcf2d5aa403a414c13d8d9f33fc943f74616e6d4f067d98a8",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "c5ce48a6-7f57-4ee8-9313-3d0024caee10": {
     "min_stack_version": "8.14",
@@ -11749,22 +11810,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Installation of Custom Shim Databases",
-        "sha256": "a4e910236d8c8466806752afee8114c07605a36292529e463c8e66e44fb8eb3b",
+        "sha256": "e23bdb57b42ec1bbefbace5a408e8ede22db9bd8be59fae66e1ed6803db76173",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Installation of Custom Shim Databases",
-        "sha256": "71bfefdca279f32dd86cd0b316f2315947b2489ae20e1246bbe17df82f6004e9",
+        "sha256": "5a38f511fb995bba2a90739bb1fb7a241b0db108f50e9c84fb52f75652a1ab64",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Installation of Custom Shim Databases",
-    "sha256": "ae8bc9d069de44bffb8c71f3b18a9843bb54f74eec29f1e1cdd40651771676a0",
+    "sha256": "322920ea0c3accf1a5852f8ffd6d3e8861e45f262314f49ba54569768ea085f9",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "c5dc3223-13a2-44a2-946c-e9dc0aa0449c": {
     "min_stack_version": "8.14",
@@ -11791,16 +11852,16 @@
   },
   "c5f81243-56e0-47f9-b5bb-55a5ed89ba57": {
     "rule_name": "CyberArk Privileged Access Security Recommended Monitor",
-    "sha256": "13f4c23dbe61be7af51b9b4e4a27b192c9305f1caa67119f4ea89ac89792737f",
+    "sha256": "693843ef15d63ac5a1119459660ea9638b60f814907ca37f1dad377b7ee0e382",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "c5fc788c-7576-4a02-b3d6-d2c016eb85a6": {
     "min_stack_version": "8.13",
     "rule_name": "Initramfs Unpacking via unmkinitramfs",
-    "sha256": "4c57f2ddcfdb1ebc7a9fa5222aca8bbf15a1b5cd862dc64ee9bf4719eee56581",
+    "sha256": "e0db18142f2246b20e8ced81755abfe720896bdb3f739e08b18c4aab3a6a9f43",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "c6453e73-90eb-4fe7-a98c-cde7bbfc504a": {
     "min_stack_version": "8.14",
@@ -11808,22 +11869,22 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Remote File Download via MpCmdRun",
-        "sha256": "c2186669d5261bfa7c34dc39f93fc099d98e0e2e752839199476fe5c176ccc2c",
+        "sha256": "264309c3db8c109a609e4940bae53e25b00cd85ca02cfd4adbf27f2113815950",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Remote File Download via MpCmdRun",
-        "sha256": "5ee5259c1f1e782f05ada777a136193574b44d4a693c38ad33781b6996a42ee3",
+        "sha256": "3e854ebb07cef539caae7a12bdabdbe67a2d9931c64e2558b2fce09bcb270e12",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Remote File Download via MpCmdRun",
-    "sha256": "a8f43c737d22256ef316daf60178182defb4bff24396c497fb6d3b777514ab10",
+    "sha256": "c4bcf943fd4ffed84dca06e325620fcd175c62a4953b6070d11085699584bb0f",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "c6474c34-4953-447a-903e-9fcb7b6661aa": {
     "rule_name": "IRC (Internet Relay Chat) Protocol Activity to the Internet",
@@ -11834,9 +11895,9 @@
   "c6655282-6c79-11ef-bbb5-f661ea17fbcc": {
     "min_stack_version": "8.13",
     "rule_name": "Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source",
-    "sha256": "6ab179e3a47d3f25210c43b3d5af0d43eb7a3cac375c01c3181c75c095864ccb",
+    "sha256": "5dc411adacd7845d2c32dfe1d1b08f2b7cfb75f5e07a9ca693f8b1050edb2fa3",
     "type": "esql",
-    "version": 2
+    "version": 3
   },
   "c749e367-a069-4a73-b1f2-43a3798153ad": {
     "min_stack_version": "8.15",
@@ -11844,22 +11905,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Delete an Okta Network Zone",
-        "sha256": "b5104f7ae3ace37e84d9a3b23a48e2695144b6feed203643be712db808db99a4",
+        "sha256": "dad15ba894bcc5ff04c6d29ad18348d0ae785598205d8bfce378e6652e599f4b",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Delete an Okta Network Zone",
-        "sha256": "b5104f7ae3ace37e84d9a3b23a48e2695144b6feed203643be712db808db99a4",
+        "sha256": "dad15ba894bcc5ff04c6d29ad18348d0ae785598205d8bfce378e6652e599f4b",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Delete an Okta Network Zone",
-    "sha256": "fe87eee2d50e3c74804fe1e519a14befd42e90b5b03257628e7406389d455ab9",
+    "sha256": "16dde6466f20cbc871b8fc349b4b46bb900cb9e48a0fd8eff6d2b4d73115074c",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "c74fd275-ab2c-4d49-8890-e2943fa65c09": {
     "min_stack_version": "8.15",
@@ -11867,28 +11928,28 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Attempt to Modify an Okta Application",
-        "sha256": "16425c2a2a76a6acc54e5d8a82a6d4440c04a74789979a89c722ee29238b5efd",
+        "sha256": "759198a89c60e9ee7a73bbd3954fd8b6224469a0a0e9f9ba0f9006b461325f05",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Attempt to Modify an Okta Application",
-        "sha256": "16425c2a2a76a6acc54e5d8a82a6d4440c04a74789979a89c722ee29238b5efd",
+        "sha256": "759198a89c60e9ee7a73bbd3954fd8b6224469a0a0e9f9ba0f9006b461325f05",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Attempt to Modify an Okta Application",
-    "sha256": "74a88132078b114dc023a5b61f024dc9362e64c23274b892eed47d376b0d4010",
+    "sha256": "7079d9fbf68d6f1ce6eb93ce13bf93d12eb165900aa50027e2212ef5af7dd8f5",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "c75d0c86-38d6-4821-98a1-465cff8ff4c8": {
     "rule_name": "Egress Connection from Entrypoint in Container",
-    "sha256": "316a1006bad5109ad8ef036d4b8ba5142bcc0cd4822c7c4c0e3f4852e1860f20",
+    "sha256": "bd9585b91a7e002b9713af6ecd82da4971298f71e200464b58abff6e760480cc",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "c7894234-7814-44c2-92a9-f7d851ea246a": {
     "min_stack_version": "8.14",
@@ -11896,21 +11957,21 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Unusual Network Connection via DllHost",
-        "sha256": "5bffb108e728d78c04b4974f087af87b6352942f82977a580fcc749a742fffc6",
+        "sha256": "1cd890b963ab7a701f5a6c45943d20f22cb173ff36b6ca80955b13239be44860",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Unusual Network Connection via DllHost",
-    "sha256": "2ec487d2c8aa01cad9488f877c4a770ba69fb9065a728c79edf06e8c31aaf20f",
+    "sha256": "dad569a0e953afbb3adc4424aa091610da67d623add251f2f923f920cdba014c",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "c7908cac-337a-4f38-b50d-5eeb78bdb531": {
     "rule_name": "Kubernetes Privileged Pod Created",
-    "sha256": "3220434ae7ebd56669033cb648bf9d422b8aec1fb59053d8472bcb7a69abf1a1",
+    "sha256": "c02bd45f7127af6e3e516d36e39ddbf02d871d2d11196309d70a1b09b8e4d618",
     "type": "query",
-    "version": 204
+    "version": 205
   },
   "c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9": {
     "min_stack_version": "8.14",
@@ -11918,45 +11979,45 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Unusual File Modification by dns.exe",
-        "sha256": "a52a50c6b43c02c95ace52b42924ca8e064e2f859b4d50fdba2866d47ac9d182",
+        "sha256": "a3a91a39decef3a359f4dc95bc8be0401664ca49546b526ad694a3154ce425b6",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Unusual File Modification by dns.exe",
-    "sha256": "84418134bc5c4c6ecc1151adcb9fbc62839c51dd865a24dc270d5f1d3dc50363",
+    "sha256": "5055c42206d7d3df32f4241bed3b12ec940e263d0cf696d8de05ee4a4b71193a",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "c7db5533-ca2a-41f6-a8b0-ee98abe0f573": {
     "rule_name": "Spike in Network Traffic To a Country",
-    "sha256": "f4b60bfd164d4de31f46f95a825acf02d2de3a0105fbea2b689f27ab7e13639c",
+    "sha256": "7e12650d2a7699b7d95e3bd4ed1a6ecf73e9dd59f940d81fea5fface3186e1a7",
     "type": "machine_learning",
-    "version": 105
+    "version": 106
   },
   "c81cefcb-82b9-4408-a533-3c3df549e62d": {
     "rule_name": "Persistence via Docker Shortcut Modification",
-    "sha256": "8e087bd16e3f663e5c0dd49d81cd2d8d302ffeabec5dc9bc31693752e7e6ed37",
+    "sha256": "7b938e8a5930231c6667e1dfb87fafbc50238e0b6a32759a79dfff9a24132c45",
     "type": "query",
-    "version": 107
+    "version": 108
   },
   "c82b2bd8-d701-420c-ba43-f11a155b681a": {
     "rule_name": "SMB (Windows File Sharing) Activity to the Internet",
-    "sha256": "801e97235c25019c80a78237b5ef98ff66883e7e236ae9ff293f74ec6ae09aad",
+    "sha256": "9ee8e6d69ebda1834191eedfbf0049afb38007ac2ba4e7e9899fac953921aca5",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1": {
     "rule_name": "SMB Connections via LOLBin or Untrusted Process",
-    "sha256": "5d272b19dcb9cdb2beaf0e6124ebad3b1ecfd48dab9d60987f7ef8bc5bab5318",
+    "sha256": "43cde79e14c795e66c93f424bb5109e68b3c837ecaa1139fd6031167225af203",
     "type": "eql",
-    "version": 112
+    "version": 113
   },
   "c85eb82c-d2c8-485c-a36f-534f914b7663": {
     "rule_name": "Virtual Machine Fingerprinting via Grep",
-    "sha256": "a8a7e92874d6888c32575ca236fb263ec128596d8a4d510a265b8fad36cb1827",
+    "sha256": "ea18c1e7446051bed3554cc614f300bd88307747e1963a329a0971f9ec41562b",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "c87fca17-b3a9-4e83-b545-f30746c53920": {
     "rule_name": "Nmap Process Activity",
@@ -11966,15 +12027,15 @@
   },
   "c88d4bd0-5649-4c52-87ea-9be59dbfbcf2": {
     "rule_name": "Parent Process PID Spoofing",
-    "sha256": "b829c4a07bfb5c509b1c4bd6241656300dcb169905e9882e8e5c905f621f03d4",
+    "sha256": "0dc688321ac70be1762f4deffdd16b19f17b750ce8b9dd956b7aa04592517439",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "c8935a8b-634a-4449-98f7-bb24d3b2c0af": {
     "rule_name": "Potential Linux Ransomware Note Creation Detected",
-    "sha256": "beed8f315f35277cafc2f3c69e1efaa6dbb44c60c2a4898cb869bbccef4035c9",
+    "sha256": "1c866f4e679c1ff78ef5ea91bd349d56335ecec0516fd39e16fa829dc5b0caa4",
     "type": "eql",
-    "version": 10
+    "version": 11
   },
   "c8b150f0-0164-475b-a75e-74b47800a9ff": {
     "min_stack_version": "8.14",
@@ -11982,22 +12043,22 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "Suspicious Startup Shell Folder Modification",
-        "sha256": "240ef030208238909ed116c65fb35bd1e2c030a6abaa3dffd50c51e79a4e2c78",
+        "sha256": "b02f2bf5fccfed2accfb810dd6c38be499cc9fd52c4d23309848eb8170f374a8",
         "type": "eql",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Suspicious Startup Shell Folder Modification",
-        "sha256": "d67260cfe20ef2ee8eb9e8acf13d36352e2608a38716e5270b57bd531fec9191",
+        "sha256": "c33b3be4b6a67c4dae7fba0831280618a7986cfaaebd4795ec7543db5a63792b",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Suspicious Startup Shell Folder Modification",
-    "sha256": "d560617a0b7c26d4a8f02dc76d6e3f106206eddf439a88ea24de0dc33126e896",
+    "sha256": "ef305abdbae7d8f1ecfb6ca40a4142dd81af12b9b5cdd154e063c7a98a5d8589",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "c8cccb06-faf2-4cd5-886e-2c9636cfcb87": {
     "min_stack_version": "8.14",
@@ -12024,34 +12085,34 @@
   },
   "c9482bfa-a553-4226-8ea2-4959bd4f7923": {
     "rule_name": "Potential Masquerading as Communication Apps",
-    "sha256": "de1eb0970073590a08bf755681e729281d7d797a171493a9134023136554d391",
+    "sha256": "5532545b1d0648dc1414555d4be90a43ffb80fef68bc1f2e63af6b28990b4556",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa": {
     "rule_name": "Credential Manipulation - Prevented - Elastic Endgame",
-    "sha256": "0c167eb4f05fabb720f52a987923b25796c8f0a3bffbd753aa699a1c8a8e26b3",
+    "sha256": "99ae1a62762bf7d0262c79b33658fa930f597568a1ae9fc8331c333dfc91bbe8",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "ca3bcacc-9285-4452-a742-5dae77538f61": {
     "min_stack_version": "8.13",
     "rule_name": "Polkit Version Discovery",
-    "sha256": "f71269394fd431ce68136702833ee5771eb6e4bb037e00776ecc9c7e4e4e6a28",
+    "sha256": "9b78faf57a8b5d10a2f71d6ab2ab00366515792348714943ad1aa1ee2d303d00",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "ca79768e-40e1-4e45-a097-0e5fbc876ac2": {
     "rule_name": "Microsoft 365 Exchange Malware Filter Rule Modification",
-    "sha256": "35f6d54b3e3c26169e00e55122b6e68ac8018946a2b9dd31d26fdb36faa90d82",
+    "sha256": "f9d687c9e6c694138baa5bac44dcc183c2cb70c69a7580e14fd4188c01bedbba",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "ca98c7cf-a56e-4057-a4e8-39603f7f0389": {
     "rule_name": "Unsigned DLL Side-Loading from a Suspicious Folder",
-    "sha256": "0f0023fc74fadd22887ee74c13f93f0c5174f8b66d140965587e4972eb2d3647",
+    "sha256": "ea099bf7bf302aa4eb27d5adcc8c2e0187e538d3b042ad83abdfaf4e869b5e3f",
     "type": "eql",
-    "version": 9
+    "version": 10
   },
   "cab4f01c-793f-4a54-a03e-e5d85b96d7af": {
     "rule_name": "Auditd Login from Forbidden Location",
@@ -12061,9 +12122,9 @@
   },
   "cac91072-d165-11ec-a764-f661ea17fbce": {
     "rule_name": "Abnormal Process ID or Lock File Created",
-    "sha256": "a8cbba8e757bacc0d4a491555d42b7d66a7d1eec1394da1a8f1cddfd82cf5bb9",
+    "sha256": "17830a8c24378fb8ea0b2c0fd6b002089e0761f86d47ae0af127d74ec05489a7",
     "type": "new_terms",
-    "version": 214
+    "version": 215
   },
   "cad4500a-abd7-4ef3-b5d3-95524de7cfe1": {
     "rule_name": "Google Workspace MFA Enforcement Disabled",
@@ -12073,9 +12134,9 @@
   },
   "cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51": {
     "rule_name": "Suspicious Calendar File Modification",
-    "sha256": "662489a94a180344e4b3e1c2aa679d4fe1ec51f91387a216835b0e11a14db9da",
+    "sha256": "dbf5167ff460dda688296a49e1d5d48d5f1d0f19ca621f413100a1cbb02eedb5",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "cc16f774-59f9-462d-8b98-d27ccd4519ec": {
     "rule_name": "Process Discovery via Tasklist",
@@ -12085,9 +12146,9 @@
   },
   "cc2fd2d0-ba3a-4939-b87f-2901764ed036": {
     "rule_name": "Attempt to Enable the Root Account",
-    "sha256": "c2c3f92e6fb953e4f0338ffe25751df1ae713c9f7e8460ce2addfd9d8bf8e59d",
+    "sha256": "b89a2b2d3038c777d4599aaebf7e06253ae8c022cdeee090402de4e373b22654",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "cc382a2e-7e52-11ee-9aac-f661ea17fbcd": {
     "min_stack_version": "8.15",
@@ -12102,28 +12163,28 @@
       "8.13": {
         "max_allowable_version": 203,
         "rule_name": "Multiple Device Token Hashes for Single Okta Session",
-        "sha256": "07fd1e33169ef40013d3c92bad14a349d83f6cf1d02d3c9faf3fc74d657e0f1f",
+        "sha256": "7a54288765d90440a1d3da5ea46ee1746323c6b4268a456262dce90422b820cd",
         "type": "esql",
-        "version": 104
+        "version": 105
       },
       "8.14": {
         "max_allowable_version": 303,
         "rule_name": "Multiple Device Token Hashes for Single Okta Session",
-        "sha256": "07fd1e33169ef40013d3c92bad14a349d83f6cf1d02d3c9faf3fc74d657e0f1f",
+        "sha256": "7a54288765d90440a1d3da5ea46ee1746323c6b4268a456262dce90422b820cd",
         "type": "esql",
-        "version": 204
+        "version": 205
       }
     },
     "rule_name": "Multiple Device Token Hashes for Single Okta Session",
-    "sha256": "07fd1e33169ef40013d3c92bad14a349d83f6cf1d02d3c9faf3fc74d657e0f1f",
+    "sha256": "7a54288765d90440a1d3da5ea46ee1746323c6b4268a456262dce90422b820cd",
     "type": "esql",
-    "version": 304
+    "version": 305
   },
   "cc653d77-ddd2-45b1-9197-c75ad19df66c": {
     "rule_name": "Potential Data Exfiltration Activity to an Unusual IP Address",
-    "sha256": "332626f80c0a809547d1b86248b4ac5acc33ad7dd090fb4c94596b699126f751",
+    "sha256": "c81d5f537f0a2c406763b42d4ef5ef5a4bad745e4d41176ac84c5d34598e6c1e",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "cc6a8a20-2df2-11ed-8378-f661ea17fbce": {
     "rule_name": "Google Workspace User Organizational Unit Changed",
@@ -12133,9 +12194,9 @@
   },
   "cc89312d-6f47-48e4-a87c-4977bd4633c3": {
     "rule_name": "GCP Pub/Sub Subscription Deletion",
-    "sha256": "be76246406041025864af7eeea3c9600ab406bf778763b00a6ea6e6489240408",
+    "sha256": "0f342ddaebb8be170f8947b26bbf9976454a9609a3fab69ef43946340d965b1f",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "cc92c835-da92-45c9-9f29-b4992ad621a0": {
     "min_stack_version": "8.15",
@@ -12143,22 +12204,22 @@
       "8.12": {
         "max_allowable_version": 309,
         "rule_name": "Attempt to Deactivate an Okta Policy Rule",
-        "sha256": "55337a1b7167b7c1dcc9f5dd03c16e8f33bb1140dac71b90520bd885a4016fdf",
+        "sha256": "710c62d83fdaa016127ed9e29d989f772587c9eab5f3cf3062bacc34d969a8f2",
         "type": "query",
-        "version": 210
+        "version": 211
       },
       "8.14": {
         "max_allowable_version": 410,
         "rule_name": "Attempt to Deactivate an Okta Policy Rule",
-        "sha256": "55337a1b7167b7c1dcc9f5dd03c16e8f33bb1140dac71b90520bd885a4016fdf",
+        "sha256": "710c62d83fdaa016127ed9e29d989f772587c9eab5f3cf3062bacc34d969a8f2",
         "type": "query",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Attempt to Deactivate an Okta Policy Rule",
-    "sha256": "fd0aba3ff53989f01ee9078c0ea58ce24c9e6d309d6e62d54aaaf02f41f7d74e",
+    "sha256": "e077043096bb995208ae7655f2088f680ac0954e54eef38a732a21fbf54027d9",
     "type": "query",
-    "version": 411
+    "version": 412
   },
   "ccc55af4-9882-4c67-87b4-449a7ae8079c": {
     "rule_name": "Potential Process Herpaderping Attempt",
@@ -12172,22 +12233,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Modification or Removal of an Okta Application Sign-On Policy",
-        "sha256": "79838ed35b355cacad06827a8cad3846a6270b6331c8cf0e5f0925e2a841681c",
+        "sha256": "6b030bb11fda77cb9c68d2328306b80b13f3d9a055aa8504740c09a98e57139d",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Modification or Removal of an Okta Application Sign-On Policy",
-        "sha256": "79838ed35b355cacad06827a8cad3846a6270b6331c8cf0e5f0925e2a841681c",
+        "sha256": "6b030bb11fda77cb9c68d2328306b80b13f3d9a055aa8504740c09a98e57139d",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Modification or Removal of an Okta Application Sign-On Policy",
-    "sha256": "7e8147176fd51e46174c3524a9048c6878bdbb752d019c933df10a94925297d4",
+    "sha256": "690e620924cf220b5b56c70024faf4279be53fcb1832f317bd52fd6b70db9705",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126": {
     "rule_name": "Socat Process Activity",
@@ -12197,9 +12258,9 @@
   },
   "cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530": {
     "rule_name": "Anomalous Linux Compiler Activity",
-    "sha256": "71e437f699c5d256f96075db61c66ace40b1ed47dd875360db1c99de905bff79",
+    "sha256": "70003b5b25514505d843dd9aee62ca085795777f69e03784b7df399a89f5832f",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "cd66a5af-e34b-4bb0-8931-57d0a043f2ef": {
     "min_stack_version": "8.13",
@@ -12207,21 +12268,21 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Kernel Module Removal",
-        "sha256": "4899db29eec2e7c875e0f09ddbaf04bd8c73d3e360259279916f0e08c135ecb7",
+        "sha256": "d72671bd3bab4e18d0837fc746481567bb678e23b73c20159cfbcaa361b9912c",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Kernel Module Removal",
-    "sha256": "184bbc37170d0bde143713a342eae3b1a1a6b6b01d294dbb267b6043fed984d7",
+    "sha256": "0d900e5572e3000cc32b07c35ac1201dca0eaa32fb23af0b0a837bd4a66af0ba",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "cd82e3d6-1346-4afd-8f22-38388bbf34cb": {
     "rule_name": "Downloaded URL Files",
-    "sha256": "96627951c8f79991a7e7ad2d73372aa5abe51ca5b57851c08dd650ab77f12760",
+    "sha256": "4ea12333f42f437aa58e54d2644f3646936a8a5f93c6814a0ed2c67dff925da5",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "cd89602e-9db0-48e3-9391-ae3bf241acd8": {
     "min_stack_version": "8.15",
@@ -12229,22 +12290,22 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "MFA Deactivation with no Re-Activation for Okta User Account",
-        "sha256": "61d2a74ac6c506cea833b428367bc8fd3f6c9c320f019009c9c92717e3f38c31",
+        "sha256": "48fedc9e649a01c172f18890a7ad9521f25b3c6d743edaaccebba5be9cb4e759",
         "type": "eql",
-        "version": 211
+        "version": 212
       },
       "8.14": {
         "max_allowable_version": 411,
         "rule_name": "MFA Deactivation with no Re-Activation for Okta User Account",
-        "sha256": "61d2a74ac6c506cea833b428367bc8fd3f6c9c320f019009c9c92717e3f38c31",
+        "sha256": "48fedc9e649a01c172f18890a7ad9521f25b3c6d743edaaccebba5be9cb4e759",
         "type": "eql",
-        "version": 312
+        "version": 313
       }
     },
     "rule_name": "MFA Deactivation with no Re-Activation for Okta User Account",
-    "sha256": "7f705d4fdcc46721e2773e18dad5230ea702911cc032bd3fac545a16e0119857",
+    "sha256": "f642652974fc308178cf8b88483c24d61cae898a7b3b2f9e3254e4dcd182cb40",
     "type": "eql",
-    "version": 412
+    "version": 413
   },
   "cdbebdc1-dc97-43c6-a538-f26a20c0a911": {
     "min_stack_version": "8.15",
@@ -12252,22 +12313,22 @@
       "8.12": {
         "max_allowable_version": 309,
         "rule_name": "Okta User Session Impersonation",
-        "sha256": "aab59642eb5e5e9a0adea96789128810c3c79dd6ec8d45944c48ad210858a2b7",
+        "sha256": "384b87d73752bb34af3573330f4217d16470de86054bb4c2c698c6434d47cdde",
         "type": "query",
-        "version": 210
+        "version": 211
       },
       "8.14": {
         "max_allowable_version": 410,
         "rule_name": "Okta User Session Impersonation",
-        "sha256": "aab59642eb5e5e9a0adea96789128810c3c79dd6ec8d45944c48ad210858a2b7",
+        "sha256": "384b87d73752bb34af3573330f4217d16470de86054bb4c2c698c6434d47cdde",
         "type": "query",
-        "version": 311
+        "version": 312
       }
     },
     "rule_name": "Okta User Session Impersonation",
-    "sha256": "0b588a73db66fc4e366209fa591307051cc0be8902e926d0e3c63e42df1695b4",
+    "sha256": "3aa673f1c0c34cebfc6e3e55a3be648b570843086b6289d22c44ef3c70ff4f0d",
     "type": "query",
-    "version": 411
+    "version": 412
   },
   "cde1bafa-9f01-4f43-a872-605b678968b0": {
     "min_stack_version": "8.14",
@@ -12275,21 +12336,21 @@
       "8.12": {
         "max_allowable_version": 110,
         "rule_name": "Potential PowerShell HackTool Script by Function Names",
-        "sha256": "635be6f0c0378af6eb3bfd0c7172864e1e2f47cf1f98606720a80f3d6f53e65b",
+        "sha256": "a02aef3d53b50e1841dd01ee25f506dc63a897f003265f8678ef3f82fa618670",
         "type": "query",
-        "version": 12
+        "version": 13
       }
     },
     "rule_name": "Potential PowerShell HackTool Script by Function Names",
-    "sha256": "6262fc93d9b9ad2723c123c69d5d878e62bdec2dc156698f9ad18a818677df0c",
+    "sha256": "ab4ec07b2bdd59f75529ab2b6f8e58098bad8f3f8a08c9e0b2261cf7500d3015",
     "type": "query",
-    "version": 213
+    "version": 214
   },
   "cdf1a39b-1ca5-4e2a-9739-17fc4d026029": {
-    "rule_name": "Shadow File Modification",
-    "sha256": "ab59547a675e69ef560b0060dc95a158b1e98d40da959d1e6102a4474c39afbe",
+    "rule_name": "Shadow File Modification by Unusual Process",
+    "sha256": "31811725296500b46a530f4167b50a90a1939a9a30ae575a5f1605db107c530c",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "ce08b55a-f67d-4804-92b5-617b0fe5a5b5": {
     "min_stack_version": "8.13",
@@ -12310,9 +12371,9 @@
   "ce4a32e5-32aa-47e6-80da-ced6d234387d": {
     "min_stack_version": "8.13",
     "rule_name": "GRUB Configuration File Creation",
-    "sha256": "64ec1097b715394beab2e75a36a9208a2ea026844e9af45605c73a09a0de896f",
+    "sha256": "cf29eec9c7946126d6e84a24c8c726e02c45cc182ef0dbc48dcb9b388761509a",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "ce64d965-6cb0-466d-b74f-8d2c76f47f05": {
     "min_stack_version": "8.14",
@@ -12320,28 +12381,28 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "New ActiveSyncAllowedDeviceID Added via PowerShell",
-        "sha256": "d66af889a4f25a88bf895b4dccd150b6e7d236baf15963c969ac201ed5bcbd65",
+        "sha256": "d6cd204299d4a7613c0652ab78b54b1b97f5c11b4f208fb0b5fb05d0f142656f",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "New ActiveSyncAllowedDeviceID Added via PowerShell",
-        "sha256": "3124a4ec07d5162829476ceebb62530a7ed736152f13b37c55791b32ecf351b4",
+        "sha256": "abd7f59b6a23d28908dddaf17edaa914939c9587f387ef557ca5faaff341abd2",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "New ActiveSyncAllowedDeviceID Added via PowerShell",
-    "sha256": "306a951d4400b5b1612097ba11a9eeaaa71e1d40a54b3f80d5a82ad3660c4b84",
+    "sha256": "90451475ce48d53de51f8ef8c31ab01801580c163221def965e9ed6c9b7d3b3b",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "cf53f532-9cc9-445a-9ae7-fced307ec53c": {
     "rule_name": "Cobalt Strike Command and Control Beacon",
-    "sha256": "ddb4b9d7e2f95d26c85ab37fb9696c58aa1f937e5f4788214b8711b988206967",
+    "sha256": "7917f89564301d83f5dcb2013db39240afa955863bc98f21a1016208a37ea998",
     "type": "query",
-    "version": 105
+    "version": 106
   },
   "cf549724-c577-4fd6-8f9b-d1b8ec519ec0": {
     "rule_name": "Domain Added to Google Workspace Trusted Domains",
@@ -12367,22 +12428,22 @@
       "8.12": {
         "max_allowable_version": 213,
         "rule_name": "Execution from Unusual Directory - Command Line",
-        "sha256": "265d820856193f4c1a981afc09dbd2e2455f2585cfa15e0e47b99a46c1e157fe",
+        "sha256": "8db9e44ecf31d95be5241f20bf1dda7fee037f97daf672d1c60aa48ed16fa84a",
         "type": "eql",
-        "version": 114
+        "version": 115
       },
       "8.13": {
         "max_allowable_version": 313,
         "rule_name": "Execution from Unusual Directory - Command Line",
-        "sha256": "bb4695e9b2608cae2d13b3bd01ab45072258c75394dfc44f816bf2516ec760d7",
+        "sha256": "a54a9feef37567feb968c9bb2bbd6e0343c7c1a2371538b9d448e491e4870ce4",
         "type": "eql",
-        "version": 214
+        "version": 215
       }
     },
     "rule_name": "Execution from Unusual Directory - Command Line",
-    "sha256": "c89e2ffe082dc78f5ead10fa743f39ea35e1333b8a50a74298ef5d9b66ff1397",
+    "sha256": "627a9ee7b45a19df7b70233781fb7c76b129346cdb7286aeed83bdc9c87a7da6",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "cffbaf47-9391-4e09-a83c-1f27d7474826": {
     "rule_name": "Archive File with Unusual Extension",
@@ -12396,21 +12457,21 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Namespace Manipulation Using Unshare",
-        "sha256": "258bf65e5da42c0bef720f575c963343ace055871316f6bba6ec31b60869c06e",
+        "sha256": "0f000268fdc695dfbee160cd34e2e1321d37c12eac2a69d832aef01d5306655d",
         "type": "eql",
-        "version": 9
+        "version": 10
       }
     },
     "rule_name": "Namespace Manipulation Using Unshare",
-    "sha256": "239b829877d333ed75985a7eab0c2a2871778d3d0e8c4fea043f8a5f4157955e",
+    "sha256": "a34a38a2bd69b76b11a281c127669096bb54a71939d3a68397b3b21f872b0401",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "d0b0f3ed-0b37-44bf-adee-e8cb7de92767": {
     "rule_name": "AWS Credentials Searched For Inside A Container",
-    "sha256": "27918dd9cf339832d9efc37e0b589ce887eae09959450ae8a4297df5ba0f040e",
+    "sha256": "b3f0dfc6f24cc6c2787d62f56817932713a1a3feddb8a231273e9a0e3c66a88f",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "d0e159cf-73e9-40d1-a9ed-077e3158a855": {
     "min_stack_version": "8.14",
@@ -12418,22 +12479,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Registry Persistence via AppInit DLL",
-        "sha256": "7b61d91f3b32b7c2abf856dc7c191977667022be4b7d6c9bd819615c622a1a35",
+        "sha256": "4bb55e1f7ac32a17597deba9c24186c785abfcd6953b10305a596ff29a27dd63",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Registry Persistence via AppInit DLL",
-        "sha256": "a6887e5edda607f541eedcf84f05242bf6d66840c91d08ea1cf84fc80283fa70",
+        "sha256": "c97fbd41a9b9ac3b79c7459e0bf3c636d1652d33043f7e530ccd2e038f258b18",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Registry Persistence via AppInit DLL",
-    "sha256": "fe172ebb9b9cc09ac3418473f8bbbe1fd438fc8c7f5e2711984cb8c781070f18",
+    "sha256": "0d395b1f9a4f028fc752ec37396aaea0a8b3896f2ac3318fe2edbd6daae092f7",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "d117cbb4-7d56-41b4-b999-bdf8c25648a0": {
     "min_stack_version": "8.14",
@@ -12460,9 +12521,9 @@
   },
   "d12bac54-ab2a-4159-933f-d7bcefa7b61d": {
     "rule_name": "Expired or Revoked Driver Loaded",
-    "sha256": "ea840a544f731bf59d6e9ef5ab6773395bd85b0b68618e2116a391972ab21fa2",
+    "sha256": "232255e1a27a32df53f7b03d4a328673ddafc73b3d701b901c20ab79e1b5e28a",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "d197478e-39f0-4347-a22f-ba654718b148": {
     "rule_name": "Compression DLL Loaded by Unusual Process",
@@ -12472,9 +12533,9 @@
   },
   "d1e5e410-3e34-412e-9b1f-dd500b3b55cd": {
     "rule_name": "AWS EC2 Instance Console Login via Assumed Role",
-    "sha256": "16a5255bebd2dbea413bcd674ddbbe9fc7c0e8a6c372b513b9a452bba2274d8a",
+    "sha256": "c4baae65ca422ef39a7b46b0def65701fd04eaaf1b938ab2d950984acde5db2a",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "d2053495-8fe7-4168-b3df-dad844046be3": {
     "rule_name": "PPTP (Point to Point Tunneling Protocol) Activity",
@@ -12484,9 +12545,9 @@
   },
   "d22a85c6-d2ad-4cc4-bf7b-54787473669a": {
     "rule_name": "Potential Microsoft Office Sandbox Evasion",
-    "sha256": "60d547919df01902f6d9894993e128a708f3086fe89e9058b7ff57338d0a5fa2",
+    "sha256": "95008cbe23f1fc8380e8181c4dac5e28c0ed9c9315589761e18569e50c4cde9d",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "d31f183a-e5b1-451b-8534-ba62bca0b404": {
     "min_stack_version": "8.14",
@@ -12540,15 +12601,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Remote Windows Service Installed",
-        "sha256": "d3d7e72381e6345a67cffab43f821b026927d01ad097fa644718316d8b841386",
+        "sha256": "aa6cdcf93a49ab5e86235d0f4bef6b42dd410c7af99275ef526c0d215b127609",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Remote Windows Service Installed",
-    "sha256": "7483da5c5a66152f79d48484ff586847c93f9cd9f44c51048e4dcdfbbf18bc12",
+    "sha256": "ca8463464ebf568c419e1064f2ee75dca25cfbe1117c40f7af9a92a48acc6ac3",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "d3551433-782f-4e22-bbea-c816af2d41c6": {
     "min_stack_version": "8.14",
@@ -12568,15 +12629,15 @@
   },
   "d461fac0-43e8-49e2-85ea-3a58fe120b4f": {
     "rule_name": "Shell Execution via Apple Scripting",
-    "sha256": "71aae69ea3a3fbd1d8e627c5d0fd9b6f7a01313216ddf8c23df060835c0864fd",
+    "sha256": "200625c2fbf06bb29f0c8238d440907deefa32e29cfc3982a544f408d9b7fdd3",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "d488f026-7907-4f56-ad51-742feb3db01c": {
     "rule_name": "AWS S3 Bucket Replicated to Another Account",
-    "sha256": "fc10d87ef74b91aafdf6f789f6c0f7602e2a1f222d20a3433c18424042268f55",
+    "sha256": "01c816014f421370ac32bb6369f8a83bc036b4cc7a1f817e5f34eed99deaaa01",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "d48e1c13-4aca-4d1f-a7b1-a9161c0ad86f": {
     "min_stack_version": "8.15",
@@ -12584,40 +12645,40 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Attempt to Delete an Okta Application",
-        "sha256": "0c3561f0d315499992370d9974bc175314ffa72037d52c76bb93df7427912ebb",
+        "sha256": "08df81b97dfa133653055496f11e710598c74c28c4fdaf0efd0a3f3ea2cfe666",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Attempt to Delete an Okta Application",
-        "sha256": "0c3561f0d315499992370d9974bc175314ffa72037d52c76bb93df7427912ebb",
+        "sha256": "08df81b97dfa133653055496f11e710598c74c28c4fdaf0efd0a3f3ea2cfe666",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Attempt to Delete an Okta Application",
-    "sha256": "11f05dcf8137ce57f2d00d46f6ca15ed79efcce76b106b9790f8b24272236a4d",
+    "sha256": "90f5212b5d6f828360ef355e1f922212881b33016383d2d9c78719cd37ed1639",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "d49cc73f-7a16-4def-89ce-9fc7127d7820": {
     "rule_name": "Web Application Suspicious Activity: sqlmap User Agent",
-    "sha256": "f10cb94a414e6983ebdaa36e5c4a332a76a4d06134043937967fdf2e2faa2cc7",
+    "sha256": "6ad7ede3c52ca6d191275bc53d5af195bd6c4bac16d37b2a0d2c8431ae4a33dd",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "d4af3a06-1e0a-48ec-b96a-faf2309fae46": {
     "rule_name": "Unusual Linux System Information Discovery Activity",
-    "sha256": "a740cf8d2af1163a0caf8571d1fa427c9ffbb89c38d76d67e0c2b0c96f6a6eec",
+    "sha256": "589f094b4f15686c52f3a6b3e8d0b26b2f6bc93446f91d37f0deed5dacbc30ca",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "d4b73fa0-9d43-465e-b8bf-50230da6718b": {
     "rule_name": "Unusual Source IP for a User to Logon from",
-    "sha256": "52036d5d366833aa7013ae971eb5ed3ed41df8bea6cf821f0e49dbd0a551fa1d",
+    "sha256": "526a1d698d53c469d024aa72d1d2b07ea56ac34aa51fb0104c5f69fdce70948c",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f": {
     "min_stack_version": "8.13",
@@ -12625,27 +12686,27 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Linux init (PID 1) Secret Dump via GDB",
-        "sha256": "809e2c52ca587a80879385c7226866c574d86e366a6787b0b1e8df77a8763e06",
+        "sha256": "3ac7fcb80411d506306b5e742ea93bc2592f558ea93ac74f82e98b6453cf1094",
         "type": "eql",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "Linux init (PID 1) Secret Dump via GDB",
-    "sha256": "a75a1c1f4f8d7379bddad6e879bb080e101d602e3a08c9e102a3af15d389b70e",
+    "sha256": "ae69c61f5dab3f5ba9b70f690911dca4cb31c94c9b851172f3093c18ea67a459",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "d55436a8-719c-445f-92c4-c113ff2f9ba5": {
     "rule_name": "Potential Privilege Escalation via UID INT_MAX Bug Detected",
-    "sha256": "aa8a522f28deb9884ad3020ca10c320a35f2efecbaa26d0aae94519585b590cf",
+    "sha256": "6362b1916a2b6791294870b918126ed2b46b5a96f795bd03409f2948502d95a3",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "d55abdfb-5384-402b-add4-6c401501b0c3": {
     "rule_name": "Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities",
-    "sha256": "f6afb5d7d43edf7f2bb60691606cbc408d2e5790f4939177bdf5b9822c465fff",
+    "sha256": "c49807873cce90e54f6113c815e7c5772bf5e8273efeb370a5cb2812efcf171a",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "d563aaba-2e72-462b-8658-3e5ea22db3a6": {
     "min_stack_version": "8.14",
@@ -12653,22 +12714,22 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Privilege Escalation via Windir Environment Variable",
-        "sha256": "60df5eed46bbcf083835c15802642a1d7dc80990487cf8c6f593aeb2bbcd6625",
+        "sha256": "517d28ddbcd9550ac85394cdac2cee0844bc448d4be9b4e4aa81be52e1275002",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 307,
         "rule_name": "Privilege Escalation via Windir Environment Variable",
-        "sha256": "ccd6f0e1dc7444cd01f7f1273379600f001c8ba2608cd8c1e4744f5de3f677a1",
+        "sha256": "76d7e76f6c26a0e245b833dbed9be07a49f80004d68992ad351a789ab93f06d6",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Privilege Escalation via Windir Environment Variable",
-    "sha256": "b882bc3921a13712f0db559c292b13772f12aaeb5673711e227685ccad9e7c56",
+    "sha256": "60b8eec12452b573096d484a711a30dba4b444661e967528e029b47d6ee84f62",
     "type": "eql",
-    "version": 308
+    "version": 309
   },
   "d5d86bf5-cf0c-4c06-b688-53fdc072fdfd": {
     "min_stack_version": "8.15",
@@ -12676,22 +12737,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Delete an Okta Policy Rule",
-        "sha256": "cbab8acc99323949b9c63aa1b75bd6a9769d66ca5df1645bb04da013526fb28e",
+        "sha256": "6f347c2a22c881f591ab308ee4e149bb0d2460d463ea37ee64dd2a3445863f2c",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Delete an Okta Policy Rule",
-        "sha256": "cbab8acc99323949b9c63aa1b75bd6a9769d66ca5df1645bb04da013526fb28e",
+        "sha256": "6f347c2a22c881f591ab308ee4e149bb0d2460d463ea37ee64dd2a3445863f2c",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Delete an Okta Policy Rule",
-    "sha256": "039f4a7ce95ec9e9263fde6e222baf44ab21a47719f820afe63cdbd7442a1af2",
+    "sha256": "457f9745d44991b7dbff97c8032d25b5f3d5c631adb8dc0e909ea948b837ae41",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc": {
     "min_stack_version": "8.14",
@@ -12699,21 +12760,21 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Service Command Lateral Movement",
-        "sha256": "a06abd5554d50f0ebc9b99f80159dbf24d97dc6453dab05f27bd09f0e8884f42",
+        "sha256": "0d07056086afc2ae7fc3933f654811d9b31cbcf86939f52cea27261c807c0b8c",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Service Command Lateral Movement",
-    "sha256": "17f85cbe91c6b5fdcfe53a17b2b99e0ecb72d024dd472cbc509963acec2b5ace",
+    "sha256": "e767e2798904e06d27a494fdecd4eec49bb912ec8b0c6940d3992927ef6354e1",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "d6241c90-99f2-44db-b50f-299b6ebd7ee9": {
     "rule_name": "Unusual DPKG Execution",
-    "sha256": "24402d8ab6122a577c5617dca6a28ef35fbfe7ce2ff4051aaed28f9fd8640891",
+    "sha256": "895b0b421e83d0c19bb678d6d2924fd5fabe2fe53d4b1c5bf1ba548d6ffa65ac",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "d624f0ae-3dd1-4856-9aad-ccfe4d4bfa17": {
     "rule_name": "AWS CloudWatch Log Stream Deletion",
@@ -12723,9 +12784,9 @@
   },
   "d62b64a8-a7c9-43e5-aee3-15a725a794e7": {
     "rule_name": "GCP Pub/Sub Subscription Creation",
-    "sha256": "981abcaff8eaa4e947885a8b6e60edb877602e6ec2974994837ffbf18e7085b4",
+    "sha256": "bdfafb9c68e9892fa7b9ca7598f201f97e7939ca8ca8c33ffc98baa5c1c46cdf",
     "type": "query",
-    "version": 105
+    "version": 106
   },
   "d6450d4e-81c6-46a3-bd94-079886318ed5": {
     "rule_name": "Strace Process Activity",
@@ -12751,9 +12812,9 @@
   },
   "d68eb1b5-5f1c-4b6d-9e63-5b6b145cd4aa": {
     "rule_name": "Microsoft 365 Exchange Anti-Phish Policy Deletion",
-    "sha256": "e1c61b6847b137835d630c3eba3b8bf7a5da03bf08a0e81a27ca46637b093b91",
+    "sha256": "64a63407de9de164073767409d81c4ad49dc544271236c164345d1a626d94c3a",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "d703a5af-d5b0-43bd-8ddb-7a5d500b7da5": {
     "min_stack_version": "8.14",
@@ -12777,28 +12838,28 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Command Execution via SolarWinds Process",
-        "sha256": "8fbf7a1dcae87ae50b11fbc90ac978f7238819b6fffdbff9e2762e2ba3cef2a9",
+        "sha256": "eee49e97f8be4dd945fdd081627a3fa84151189394053407c767cc654b03f61a",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "Command Execution via SolarWinds Process",
-        "sha256": "7c19ee463ecfc62c87fee685189cb441ee9abfb2ea897009a6c11ee131b6ede9",
+        "sha256": "636a5aa15d3dee30f441ac50911f29d0c8a99035e4b8d1e57294c5957baf6b73",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Command Execution via SolarWinds Process",
-    "sha256": "17eea5871c73f5fb356a051968d7cb36bd835774aeff070acb752283235c8009",
+    "sha256": "77f519e1c25064d73042352df755adbf55aaa3901bd4c338ef309863f9b8dbd2",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "d743ff2a-203e-4a46-a3e3-40512cfe8fbb": {
     "rule_name": "Microsoft 365 Exchange Malware Filter Policy Deletion",
-    "sha256": "8ac44c71af4271eb13db4ef37b755bdfb7b4c9aa8f3ec7041a7a2ec06b98482d",
+    "sha256": "641ef2451b1987a3e9cb28358fcfd308d956ef099cab89e13168b853db4d48c1",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "d74d6506-427a-4790-b170-0c2a6ddac799": {
     "min_stack_version": "8.13",
@@ -12806,21 +12867,21 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Suspicious Memory grep Activity",
-        "sha256": "62d90a376ed43ac65cbd84ee0b7d37b598d450de07cfde82408db98cfee04d6a",
+        "sha256": "be15becb96ba5f7d3bbfbb8d336acdd122a95f155d4235a4e3941eefa4d8fa70",
         "type": "eql",
-        "version": 3
+        "version": 4
       }
     },
     "rule_name": "Suspicious Memory grep Activity",
-    "sha256": "f153c6dee45aea70187e026f52bda5867a4d86ac55deeab921bd0b98f1386ea1",
+    "sha256": "ec4ccab9d3dd84614e45cc02c3ca638790f46ac21b6b52ea32b08885e416649f",
     "type": "eql",
-    "version": 103
+    "version": 104
   },
   "d75991f2-b989-419d-b797-ac1e54ec2d61": {
     "rule_name": "SystemKey Access via Command Line",
-    "sha256": "6459c63e59f54f94e12abb17883b4ae2c8a99424f6e2c321c1647d47ce81c091",
+    "sha256": "4c5994d232095f98e72abc6b0a4ff08477e6c845b50df9de6e6ae92745f25835",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "d76b02ef-fc95-4001-9297-01cb7412232f": {
     "min_stack_version": "8.13",
@@ -12828,39 +12889,39 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Interactive Terminal Spawned via Python",
-        "sha256": "06fed263415e4ac3e3f062be3c0bc968c640a3632e4588fd2a405dbdac73f541",
+        "sha256": "aa0975e7620cba81ba4d6b2b9aa05da8913d3f309cb4803fbff2ac88f7d9a4e0",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Interactive Terminal Spawned via Python",
-    "sha256": "e74a4d15744de9d351b31df43db4c14a3c027cb74eba3f0342dabc2b9d4ae03a",
+    "sha256": "f2c6a851be425812db9800238f821905d9956db9ec85937da8ce5b2d78f563b4",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "d79c4b2a-6134-4edd-86e6-564a92a933f9": {
     "rule_name": "Azure Blob Permissions Modification",
-    "sha256": "346cc434526ad0dc7188a5077b3493b8499b644cfa218fe758d584d9f9e9074a",
-    "type": "query",
-    "version": 104
-  },
-  "d7d5c059-c19a-4a96-8ae3-41496ef3bcf9": {
-    "rule_name": "Spike in Logon Events",
-    "sha256": "c88f7b8030359f06613e9c7fd1bf60b5c1e8f86f7d7febccd34c7969e1077bbc",
-    "type": "machine_learning",
-    "version": 104
-  },
-  "d7e62693-aab9-4f66-a21a-3d79ecdd603d": {
-    "rule_name": "SMTP on Port 26/TCP",
-    "sha256": "fafc9b93a08a48425d81e9b8d77c65427d4a0059c9002836e7cd43db72fb0365",
+    "sha256": "b6f7d9e1c6d3053f849ee87cdd0567aa3e046fbf9c1400a060021426261838d2",
     "type": "query",
     "version": 105
   },
+  "d7d5c059-c19a-4a96-8ae3-41496ef3bcf9": {
+    "rule_name": "Spike in Logon Events",
+    "sha256": "e6d5824de70c85d84e7bf5a4158c0893db7265f5bf6a4310aadd7a4cc1806bde",
+    "type": "machine_learning",
+    "version": 105
+  },
+  "d7e62693-aab9-4f66-a21a-3d79ecdd603d": {
+    "rule_name": "SMTP on Port 26/TCP",
+    "sha256": "dc4aaaebbe30ceb017d1b3100fec840afc7c916a2519037418a91ea060b581ea",
+    "type": "query",
+    "version": 106
+  },
   "d8ab1ec1-feeb-48b9-89e7-c12e189448aa": {
     "rule_name": "Untrusted Driver Loaded",
-    "sha256": "c22a4b5aaf9a5211781fbafa109ec85e7094f3b473efa585e2dafa6bd86b481d",
+    "sha256": "9d627c046b1d969fa3cee29c64c2ede631bd7c2f11e2d5b0195467910718d443",
     "type": "eql",
-    "version": 9
+    "version": 10
   },
   "d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958": {
     "rule_name": "AWS IAM Deactivation of MFA Device",
@@ -12874,22 +12935,22 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "NTDS Dump via Wbadmin",
-        "sha256": "34ce5f9596b36a1b992575548e8c62b16a49e5261440a67f784671e4eb4bdbb3",
+        "sha256": "a3662b99a5aeaba17b20017e4f74a5a700018221aa4f539eae6586749aef123b",
         "type": "eql",
-        "version": 2
+        "version": 3
       },
       "8.13": {
         "max_allowable_version": 201,
         "rule_name": "NTDS Dump via Wbadmin",
-        "sha256": "9a7aecff18c2b2c03fb09f108eb19cf4062741ef26df0abd91a13a980b793f8d",
+        "sha256": "6d5f2be14d23c96aec4e7d179a2f0102cb02ce3f198dc30016b6ea842a71fdb1",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "NTDS Dump via Wbadmin",
-    "sha256": "0c9ca98240f1da76e24997c3f0e416ba94169679df7c594faaded88c0928357d",
+    "sha256": "432106a3b18e6a6c3983f2db37cc0d7c3d3a12ef2622c48805e23e67fc76576d",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "d99a037b-c8e2-47a5-97b9-170d076827c4": {
     "min_stack_version": "8.14",
@@ -12920,22 +12981,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Suspicious Windows Command Shell Arguments",
-        "sha256": "0dd9b1e590a4b301d83ffb6fbc022556f692630bef01e7d31223c89a7032ecdb",
+        "sha256": "f33fa3c2f6e59b87d777b60c36ca2f7b49b83e7d55fd70bda7b51c5164f2e484",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Suspicious Windows Command Shell Arguments",
-        "sha256": "4100ea91fd5746ceabc0b3056bf622961cb4e56a6733775ccb8b74fc1394d4ff",
+        "sha256": "6992b10f898c3dd9c58648107a909375f088a7cbe752dfa3e89ad95f36d12be6",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Suspicious Windows Command Shell Arguments",
-    "sha256": "f14448c067e0a0e0be1f51976cbc11fff0b37b0f5da3205c8afde1ae167e0eec",
+    "sha256": "091d2119d9f9bd8b91745b62a2dcab088dd2631acb0cbf1eb5b855fa829ef778",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "da7733b1-fe08-487e-b536-0a04c6d8b0cd": {
     "min_stack_version": "8.14",
@@ -12943,28 +13004,28 @@
       "8.12": {
         "max_allowable_version": 110,
         "rule_name": "Code Signing Policy Modification Through Registry",
-        "sha256": "4a1be4588f4264941f314924e28dbfaf3791577f1aa8805dd33a0e1d2a49a53e",
+        "sha256": "fc23e41a7d22a46223a5b1ed558336101405e6adad108127504e440c44d82a19",
         "type": "eql",
-        "version": 11
+        "version": 12
       },
       "8.13": {
         "max_allowable_version": 210,
         "rule_name": "Code Signing Policy Modification Through Registry",
-        "sha256": "d9efb6f5bfab991a95e185da00b9c3797f891983b8b396c9d7dbf292e759abe7",
+        "sha256": "9d490d625ede5483e6874408d935d1e8ae2e654bf38990bd8ec90cac8d61e7e4",
         "type": "eql",
-        "version": 111
+        "version": 112
       }
     },
     "rule_name": "Code Signing Policy Modification Through Registry",
-    "sha256": "cf52711a1189dd89d5cc0b35fc53b8cf7cf58f927144ecd794a969dd6245ad54",
+    "sha256": "0ac7d1624e694cec67982400a822b5692087df342748f9d9b10eebc1de8ffe03",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "da7f5803-1cd4-42fd-a890-0173ae80ac69": {
     "rule_name": "Machine Learning Detected a DNS Request With a High DGA Probability Score",
-    "sha256": "84e89ef6464acb25c59d3bbb6ebd82d470bd3a6ad2ea4cb023ea9406ce17b797",
+    "sha256": "6f132baef5851efd00f760a31aa6cfdd4a68c0bd286f6abbf8cd245ebc635745",
     "type": "query",
-    "version": 5
+    "version": 6
   },
   "da87eee1-129c-4661-a7aa-57d0b9645fad": {
     "min_stack_version": "8.14",
@@ -12972,15 +13033,15 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Suspicious Service was Installed in the System",
-        "sha256": "2b3b6416e094f6fd0f246cdccd204f657433c0899082d352eee17f0a42c6e5cb",
+        "sha256": "0d596807e4224d804bdfe2e04ba7a55241ebcd35ec0c8329585b908e6a811d4c",
         "type": "eql",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Suspicious Service was Installed in the System",
-    "sha256": "4a237b6a951c3e4530bac7e5c14e1b5270fc7263a9cc7b53c6355f05422701df",
+    "sha256": "8c5a1b27f6a02621b57dc23c369f980d79cbceb34f18024d02dcf75ca46ae963",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "da986d2c-ffbf-4fd6-af96-a88dbf68f386": {
     "rule_name": "Linux Restricted Shell Breakout via the gcc command",
@@ -12994,15 +13055,15 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Potential Pass-the-Hash (PtH) Attempt",
-        "sha256": "c8d78b9a264919f6a100901cb87b338a1148ed52bb4f422e912c4a9b4c534a5d",
+        "sha256": "6e675455e0691aa059267316b5c588a3be00378d5ffc8f0d62d327ea9cf9bf9b",
         "type": "new_terms",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "Potential Pass-the-Hash (PtH) Attempt",
-    "sha256": "605a26973cce40e167abba5375124060d5ae04432693969be8b5bee370e4185e",
+    "sha256": "e40d42488b5d12045dd32b4d104b2128f4032fc3e2a66c9578576d8f75e093b3",
     "type": "new_terms",
-    "version": 106
+    "version": 107
   },
   "dafa3235-76dc-40e2-9f71-1773b96d24cf": {
     "rule_name": "Multi-Factor Authentication Disabled for an Azure User",
@@ -13016,22 +13077,22 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Network-Level Authentication (NLA) Disabled",
-        "sha256": "5ba03fd03c459addbd61462891a2464974c59930a12e77a48efb688584584474",
+        "sha256": "f070b0885fd560dca726ee750baad0826feb31d8d40ccb087eb224a1ea7abfbc",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Network-Level Authentication (NLA) Disabled",
-        "sha256": "ea295acc9a2c0d920da2e8cd84ded801c713a06ad473c948126091def230b5ad",
+        "sha256": "042a48825a4fad14bc7163dd1ec03c4495809a3b597ef85c391fa358b2abf475",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Network-Level Authentication (NLA) Disabled",
-    "sha256": "452e5fbee79ceeb158518545ac367412757396a660f25ecf4e8940a04976f311",
+    "sha256": "6512a9d12fa4ef27519126e321762a291e72b255d30192405b4cb411001266c6",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd": {
     "min_stack_version": "8.14",
@@ -13039,28 +13100,28 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Execution via Windows Subsystem for Linux",
-        "sha256": "86c73ee5160e7e68a9e03ca44a7191655b1ab3644edf3c7468b433eb42722f54",
+        "sha256": "1ec2b5f008f9e9bead822c864926d9183431f584d472eb22e8ff3ce2939b9c8c",
         "type": "eql",
-        "version": 7
+        "version": 8
       },
       "8.13": {
         "max_allowable_version": 206,
         "rule_name": "Execution via Windows Subsystem for Linux",
-        "sha256": "7d866450dcc8e535903a7e7d28333859b7c1e5b20cf243b9885c0ba2fd3e3bfa",
+        "sha256": "daf311a52ba5b293679091a760f4b56a52f62f96e0ab510ea01cd988baa19167",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Execution via Windows Subsystem for Linux",
-    "sha256": "d238242db88c4dffe3b45b6338748daa6638b409ae25dcebf555dc5fbd22ef37",
+    "sha256": "20558f6e7908c8dea171a7635ec499e0ebeccbe62d14d7f06850636afc8283f6",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "db8c33a8-03cd-4988-9e2c-d0a4863adb13": {
     "rule_name": "Credential Dumping - Prevented - Elastic Endgame",
-    "sha256": "5de5038a06b13f9d4d0b252316c5fc2a6d92c60d65cf8613bdde5c1514f4bd65",
+    "sha256": "d51a9914cc58576ea6fcc57df0fb35de299f08b8acf0ff37597124b12b9862db",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "dc0b7782-0df0-47ff-8337-db0d678bdb66": {
     "min_stack_version": "8.13",
@@ -13068,15 +13129,15 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Suspicious Content Extracted or Decompressed via Funzip",
-        "sha256": "e56d02dd6b3a5cd288516467c111539cbe759ada556ffe40e5d4f26a0e9c6ee0",
+        "sha256": "d4648bbfa3d971cafd0c2664cbb8da0fc57af62582278b2246e279b1c7dcaa2e",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Suspicious Content Extracted or Decompressed via Funzip",
-    "sha256": "bad0d95c6a8551468b0c035ca98e1d1f47ec295b1d544833a75c04ae31f18d44",
+    "sha256": "cfb81693b34a2db216c043943162205581d94349579a2b66a2675e3afedec5fa",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "dc61f382-dc0c-4cc0-a845-069f2a071704": {
     "min_stack_version": "8.13",
@@ -13084,15 +13145,15 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Git Hook Command Execution",
-        "sha256": "343b1b3846b8995220cd5a2462610b56200a929f418593766ed4d6be59d611c6",
+        "sha256": "dd6719030d3fe2a0ee69963aabd0b10598548861f0ca6a7ce968eb283b8a96f0",
         "type": "eql",
-        "version": 2
+        "version": 3
       }
     },
     "rule_name": "Git Hook Command Execution",
-    "sha256": "3bac5605f2f7f71fbee8e939fdc4662424cab31681bb8fc5e2dd50983610fdf6",
+    "sha256": "3ad68272adbc2c5c4f5b945a065b67154c91b826cef8f120af822a44d62724e1",
     "type": "eql",
-    "version": 102
+    "version": 103
   },
   "dc672cb7-d5df-4d1f-a6d7-0841b1caafb9": {
     "rule_name": "Threat Intel Filebeat Module (v7.x) Indicator Match",
@@ -13106,22 +13167,22 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Potential Hidden Process via Mount Hidepid",
-        "sha256": "69570f9ed79d40fc1f9217930bb3117b6392d515cdf063f8cde02c53c6e7f60c",
+        "sha256": "e16de17547f45513cc6097ae2c1fafc3fb841a3d7cd4876355dfdce3bd42d171",
         "type": "eql",
-        "version": 9
+        "version": 10
       }
     },
     "rule_name": "Potential Hidden Process via Mount Hidepid",
-    "sha256": "4ec4efd8bc14d050cda2446ffa046c47cab81bedbea602f51c64f53582b57fa0",
+    "sha256": "0578fdb139348058c8c4a2e14b5a6ac8ae540f83b3f732433b174db4e0725628",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "dc765fb2-0c99-4e57-8c11-dafdf1992b66": {
     "min_stack_version": "8.13",
     "rule_name": "Dracut Module Creation",
-    "sha256": "51f31e2decacb917b2045e791f5b03e17de861b13042f271441c3df1a71461dc",
+    "sha256": "af7a3f72ed7f24e50bc14f940937bc9cf2bc1f6872e1d672d463b5165d85d1dc",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "dc9c1f74-dac3-48e3-b47f-eb79db358f57": {
     "min_stack_version": "8.14",
@@ -13158,22 +13219,22 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Suspicious Execution from INET Cache",
-        "sha256": "6890ee7e9f98fd62cb7e5660852cebcf2ec9c6a367072ae8b1660ee40eca75da",
+        "sha256": "6aecf0b6e2c4fdfeae54ec1cfaa51070bd371c150206b98a27cf2be01bbad3a0",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Suspicious Execution from INET Cache",
-        "sha256": "ff4e6f8fc8ffdad46c9ca8403e225098989a5548343270fe5420b6a1021d3fbf",
+        "sha256": "e97febd5beb392ed445ad0e67d7a284e6d6588dd93baad573301b7714cff4c46",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Suspicious Execution from INET Cache",
-    "sha256": "6a04f4ffaa5c40018c58ab7ef7d0b4986d678da98c9dd78706e4c645c8bc71a5",
+    "sha256": "ab1e64f0d5a84e58ddf9a0fdbe54ccd23b6eeda4909f99483374237a1c2c74c1",
     "type": "eql",
-    "version": 204
+    "version": 205
   },
   "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e": {
     "min_stack_version": "8.14",
@@ -13181,28 +13242,28 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Attempt to Install Kali Linux via WSL",
-        "sha256": "7209db8e30fa81579cc3b28f823b3efc3f48863b31868b2c52ccee2a937887bd",
+        "sha256": "8475f6c6b1206c9fd3c5085bb9b4677b0b6e931699d1763068961d84d8aa46a6",
         "type": "eql",
-        "version": 8
+        "version": 9
       },
       "8.13": {
         "max_allowable_version": 207,
         "rule_name": "Attempt to Install Kali Linux via WSL",
-        "sha256": "db373be5d72255dcfc03d21367e6a23f15576fe50874ec53d75ff7edf26e222d",
+        "sha256": "c4104efeb172e0634cf59ac025d803d9d3171803756060c76e6bf8cfd3d88a90",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Attempt to Install Kali Linux via WSL",
-    "sha256": "eb5782b9024f97b13ced9ed9a27e3af47b54101824f8592c383c4fa46f18bcb1",
+    "sha256": "795b6a57e976d8a06dd804326ac7ea4f673753436de7405e506a7a6ea8d8974a",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "dd52d45a-4602-4195-9018-ebe0f219c273": {
     "rule_name": "Network Connections Initiated Through XDG Autostart Entry",
-    "sha256": "9d09534c9e25cb62cc2ac0983ac2a41afb47c19dfec4625145ed0922d5c490d6",
+    "sha256": "877ce9bd8dbd29cea230dc9f74e14b082161a6dbe3fa64633fae76d569dc6b3d",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "dd7f1524-643e-11ed-9e35-f661ea17fbcd": {
     "rule_name": "Reverse Shell Created via Named Pipe",
@@ -13216,29 +13277,29 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "NullSessionPipe Registry Modification",
-        "sha256": "2dc4ed28b131d5fcdb67907c89c6524e73a884148e5d5ad792d42e65f619c8c2",
+        "sha256": "84f5b0cc9b45784f5f3268b1f1cd252e3e460a30225570b04bd90ed819e7cd75",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "NullSessionPipe Registry Modification",
-        "sha256": "6581546aba5c9cbdb29e1998c5b3ce1a10bba7abbbdf5036de332cc395e4d74b",
+        "sha256": "c53af1114c332c599481a0ff4eede6a5a9b7a2b80284a201c3c7c5c3ba9dae11",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "NullSessionPipe Registry Modification",
-    "sha256": "50633d69f921b67ff24e8f6a63aef23b74ed335c0104445871dbc3945e3af63c",
+    "sha256": "e723d0b3254745f488ccac62bb67e6d2f069196659d17cf778fb42a524933135",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "dde13d58-bc39-4aa0-87fd-b4bdbf4591da": {
     "min_stack_version": "8.13",
     "rule_name": "AWS IAM AdministratorAccess Policy Attached to Role",
-    "sha256": "400a598f9f5f9aa9ee82ed31b38bfeea4491ad833f44cc808bb637777e55b74e",
+    "sha256": "c129a707d58db25a4c45591577570e807c1cda2be7e4167c44a922ada89b2939",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "de9bd7e0-49e9-4e92-a64d-53ade2e66af1": {
     "min_stack_version": "8.14",
@@ -13246,22 +13307,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Unusual Child Process from a System Virtual Process",
-        "sha256": "64088266c02ecdf9fa7132deb1addf06105d09c902e7ec255a0b536395272ff8",
+        "sha256": "dc59f461ee6eaded59582a8d9d1665d294369cbd7cefb74b93fc69c65b3626e3",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Unusual Child Process from a System Virtual Process",
-        "sha256": "a7b99e7aa7cbd5a81b8013087a2b9fccead7841f4219882418dcbd63763d3608",
+        "sha256": "d48e91e2df3b46dddd47dc1f8381eccd2d4ea3654875665feb8871b7f7df2498",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Unusual Child Process from a System Virtual Process",
-    "sha256": "cbc93e8df0c9561bcf71aa5c1c047699a17c624200c322609b788853594cca6a",
+    "sha256": "0e4c1d925e33511a5ca1c1b97c6b325baac1871f6c4426d17058007044aadf6f",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "debff20a-46bc-4a4d-bae5-5cdd14222795": {
     "min_stack_version": "8.13",
@@ -13269,15 +13330,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Base16 or Base32 Encoding/Decoding Activity",
-        "sha256": "a7f6c2c79e782df9aa8415605d72b36e28ac9b0ab828b6077ede6a98958a6977",
+        "sha256": "2110c27e62d99781d5a1189a8ed1fe2d6a400568585a8e6573fb473f783f9761",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Base16 or Base32 Encoding/Decoding Activity",
-    "sha256": "46f4ce8dd188feabf7a2bb0fb7aca87218ea33ea2fbd8f82ed35ca46faf70489",
+    "sha256": "a1fcc107efdf93073c6b20ae1f2c19b8fd281cc4cb1e5877c5c362869279c555",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "ded09d02-0137-4ccc-8005-c45e617e8d4c": {
     "rule_name": "Query Registry using Built-in Tools",
@@ -13287,9 +13348,9 @@
   },
   "df0fd41e-5590-4965-ad5e-cd079ec22fa9": {
     "rule_name": "First Time Seen Driver Loaded",
-    "sha256": "1faad3f27c89ce87b1a4f9ba8d28fcd968f1da207d94216c3e71a09884db6eb8",
+    "sha256": "6323546ce88a2062ab9b777768a0a4282ac1a74384c1f21449a3262202208011",
     "type": "new_terms",
-    "version": 8
+    "version": 9
   },
   "df197323-72a8-46a9-a08e-3f5b04a4a97a": {
     "min_stack_version": "8.14",
@@ -13297,21 +13358,21 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Unusual Windows User Calling the Metadata Service",
-        "sha256": "d5f633c341e7ba95ad81959129723474ae16c829ff3e3182a147b764bacf405e",
+        "sha256": "92bb89bd0e84c9232dcf024b09b211d04bf914a34e8ebcfcc2700c0f9f4154f6",
         "type": "machine_learning",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Unusual Windows User Calling the Metadata Service",
-    "sha256": "d328e86d5da5551f9015b551689158237ac673a65a0d2980967ff93f1b9638b3",
+    "sha256": "e7e813348ed80c496689f948ecd7de5edfefb9f63b906114a57bb6798b9253ae",
     "type": "machine_learning",
-    "version": 206
+    "version": 207
   },
   "df26fd74-1baa-4479-b42e-48da84642330": {
     "rule_name": "Azure Automation Account Created",
-    "sha256": "b82b8d83b12f049d275d3f1d78e61640c6b772c160ca3844d5e09df9cf465669",
+    "sha256": "8fc27e74bfd62fc69cfb08bc0944fb02643fbb3fd3e9b84ef1e6b06e36ccba3b",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "df6f62d9-caab-4b88-affa-044f4395a1e0": {
     "min_stack_version": "8.13",
@@ -13319,28 +13380,28 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Dynamic Linker Copy",
-        "sha256": "c492826e8eb6d6b4fbae1dfc5820adbdcbc847d6f88fbf1e57c06d347b0d6c4f",
+        "sha256": "c129b0c687239213e54f4f95219e0ba6f09ce259ad97d16efe4789c56b4c1205",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Dynamic Linker Copy",
-    "sha256": "15a7a2d4be9e298988ff4d281539bbae818f22ccc5f95a1423e09fdb21f76bd2",
+    "sha256": "158bf61594522a3d1f0fdde66ec6ddedf8126dd16a556cd2b9a67ea025ae233a",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "df7fda76-c92b-4943-bc68-04460a5ea5ba": {
     "rule_name": "Kubernetes Pod Created With HostPID",
-    "sha256": "0aa047864e74cf8a18fe9dd039cc10fc1cfadcd1b2b98de5cfedf9afe1c98251",
+    "sha256": "ac73d656120d73f8776a9afbdc0c8a63ba9863321b9153d9529c67e61651a5a9",
     "type": "query",
-    "version": 204
+    "version": 205
   },
   "df919b5e-a0f6-4fd8-8598-e3ce79299e3b": {
     "min_stack_version": "8.13",
     "rule_name": "AWS IAM AdministratorAccess Policy Attached to Group",
-    "sha256": "87f99fdccd4153758ed878449ec6d1fd72e56f20cd92bda5b802fe99fd9856e1",
+    "sha256": "f33b42f628062aaf94789a5880e98522fa684c465bdf6da024d16c74a4f02efc",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "df959768-b0c9-4d45-988c-5606a2be8e5a": {
     "rule_name": "Unusual Process Execution - Temp",
@@ -13354,34 +13415,34 @@
       "8.12": {
         "max_allowable_version": 102,
         "rule_name": "Potential privilege escalation via CVE-2022-38028",
-        "sha256": "be7d0516427d16d13075a9c6cbeb259c965436b814a3a00c02a5a879e239aaaa",
+        "sha256": "f14455fd6ea9bdc73123f4c69cb12843cfcbe7747b51b622198eb087bb953f08",
         "type": "eql",
-        "version": 3
+        "version": 4
       },
       "8.13": {
         "max_allowable_version": 202,
         "rule_name": "Potential privilege escalation via CVE-2022-38028",
-        "sha256": "7b6acf6b548474373227dfe0d95525762951ea112531f064e226bb790080e8b1",
+        "sha256": "f7fcd4ec131f7e648b7fe8bb86887bfb768bd7bf3a006340a5e9fca5467205bd",
         "type": "eql",
-        "version": 103
+        "version": 104
       }
     },
     "rule_name": "Potential privilege escalation via CVE-2022-38028",
-    "sha256": "d0fe93377143f6c21a5d7bacce642eca85c15341cbdd34b6b4254173a819008c",
+    "sha256": "2b622d8bb5228a5ab103d2c5197eab64a8c1a0977cbc0594097fe979c66d2034",
     "type": "eql",
-    "version": 203
+    "version": 204
   },
   "e00b8d49-632f-4dc6-94a5-76153a481915": {
     "rule_name": "Delayed Execution via Ping",
-    "sha256": "da0cf4affe1558ec93cbb7b96eac795d58a8770bcb564ff0b2021a7f7622eceb",
+    "sha256": "8b63af67b0b77e5d770c49f6e9a9216ab92f9f7aba27fe58b2f87b38dfd3b24e",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "e02bd3ea-72c6-4181-ac2b-0f83d17ad969": {
     "rule_name": "Azure Firewall Policy Deletion",
-    "sha256": "fbf370e089437f900b3701b3d7a7af66a118801719201fe03fbfea44438802c0",
+    "sha256": "3145c97b2a0f8a3dbe953d706b20b0db89737e622460e8eb92f562e46316b78d",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "e052c845-48d0-4f46-8a13-7d0aba05df82": {
     "min_stack_version": "8.14",
@@ -13389,15 +13450,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "KRBTGT Delegation Backdoor",
-        "sha256": "5b56188233f9c0e6251065b18ac9a7d80ebd1b7cd9a55d4dfbc2fa8735b403cc",
+        "sha256": "d66a68b32ae569978a6ef6580b94f0b86b0f34b30ebec5e7173db7138003bce5",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "KRBTGT Delegation Backdoor",
-    "sha256": "d73db62405efc39a8ad58641974ba0785e0ae2f01440c19c88e84e81a194593a",
+    "sha256": "93383cc44307548a071047b61fc0df04c3b9f6b286e64e7f6d26fcc4f6e1b84c",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "e0881d20-54ac-457f-8733-fe0bc5d44c55": {
     "min_stack_version": "8.14",
@@ -13421,22 +13482,22 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "Attempts to Brute Force an Okta User Account",
-        "sha256": "91ded37d974e4de028ec04fa54ba38c79ead6a088bc6384e8e7f081bd19a1068",
+        "sha256": "9b77e22fb6460cbdb3e85d6b43d58ba16119cf9ce64692958b30fc4ed9657bc5",
         "type": "threshold",
-        "version": 211
+        "version": 212
       },
       "8.14": {
         "max_allowable_version": 411,
         "rule_name": "Attempts to Brute Force an Okta User Account",
-        "sha256": "91ded37d974e4de028ec04fa54ba38c79ead6a088bc6384e8e7f081bd19a1068",
+        "sha256": "9b77e22fb6460cbdb3e85d6b43d58ba16119cf9ce64692958b30fc4ed9657bc5",
         "type": "threshold",
-        "version": 312
+        "version": 313
       }
     },
     "rule_name": "Attempts to Brute Force an Okta User Account",
-    "sha256": "9bfcd68bbf114751fd78efc3b74026c22f9b576e4f7985482325cf2bdff6e238",
+    "sha256": "0f1797f4458f41926c4fb9920e9bad30476efd48173d83db37c845ac553c2e1a",
     "type": "threshold",
-    "version": 412
+    "version": 413
   },
   "e0cc3807-e108-483c-bf66-5a4fbe0d7e89": {
     "min_stack_version": "8.13",
@@ -13444,15 +13505,15 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "Potentially Suspicious Process Started via tmux or screen",
-        "sha256": "bbc79c31a49dbadfd95c068a4bae83f11457d10bd83b3a13b598049767cb3119",
+        "sha256": "6147022642131c87ac6702fa482fbae2afa75394591d2a12545a08d85336f5f2",
         "type": "eql",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "Potentially Suspicious Process Started via tmux or screen",
-    "sha256": "a94c98d17b9a4ba79fbd2db8a440aabe9f52a55a651464571a9bf18937b49a4e",
+    "sha256": "10bdf2a8cb060ef98b459f111677380e45c54d687124dbe465153fc00b2a538b",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "e0dacebe-4311-4d50-9387-b17e89c2e7fd": {
     "rule_name": "Whitespace Padding in Process Command Line",
@@ -13462,21 +13523,21 @@
   },
   "e0f36de1-0342-453d-95a9-a068b257b053": {
     "rule_name": "Azure Event Hub Deletion",
-    "sha256": "a2ecaf7e5ffeba64be9df560b78b9046a7dd8803d4d3e1f50854456965291dc7",
+    "sha256": "55c15bc0ab3e65a9e0dcb4e9babf915de29b34b26b842fe6ad70c153dbc50212",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "e12c0318-99b1-44f2-830c-3a38a43207ca": {
     "rule_name": "AWS Route Table Created",
-    "sha256": "862abfa5c379d1e32f01d1c6199755c9de4bfcd13eaf1b23d019ae40ccde21c5",
+    "sha256": "c76bc6e2331f0b9bbf3d8f05a6f363c267e1509a793f6949082fc196e12f1fc6",
     "type": "query",
-    "version": 207
+    "version": 208
   },
   "e14c5fd7-fdd7-49c2-9e5b-ec49d817bc8d": {
     "rule_name": "AWS RDS Cluster Creation",
-    "sha256": "3971b630a9892ede07636cbd4aafedb6e0a66eb9a58e95bca937fd3d473486f6",
+    "sha256": "7b5a2e8745804344d0c558af38ae871fb0c48a51a92c943f98830876bce353b4",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "e19e64ee-130e-4c07-961f-8a339f0b8362": {
     "min_stack_version": "8.13",
@@ -13484,21 +13545,21 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Connection to External Network via Telnet",
-        "sha256": "aca0eb0c2cc280c1e11e840c13fbdf1d68c10d4842912b4d5f2c41f27ca376c5",
+        "sha256": "28c7ce83de51514d2b297b6590e71038a20120a59fd3f1b8f1693e98dc5c1d7d",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Connection to External Network via Telnet",
-    "sha256": "eb720eb1df39451162379dd73ebb8021f2d6d061f11536dd6890358652908bc0",
+    "sha256": "d720edce6b79fc47c791e12e5f56665107bda8a672446989a274d7b62d630320",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "e1db8899-97c1-4851-8993-3a3265353601": {
     "rule_name": "Potential Data Exfiltration Activity to an Unusual ISO Code",
-    "sha256": "18d369e85745dfad874fe33bb6e7faff482e843a231c6c456cd2668d675040bb",
+    "sha256": "79e7d8b6c91ff85bfe18be26bfd2bbe3de8d62a447c19e86c2250d6f10e25dd6",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "e2258f48-ba75-4248-951b-7c885edf18c2": {
     "min_stack_version": "8.13",
@@ -13506,15 +13567,15 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Suspicious Mining Process Creation Event",
-        "sha256": "e91422636467edf05da152b15ace87fb9f957102bab6ef22a1f413c45c076dc9",
+        "sha256": "2e1ea018087510cd48cb9978f295dfc7ae3df5e33ae6087605fe0c171ee6f7af",
         "type": "eql",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "Suspicious Mining Process Creation Event",
-    "sha256": "a9d9a985224bb2c25aae53626c351423299271473fb94800bbec865b77549cad",
+    "sha256": "573c1614e9fd8cb5c852934bb98d126cd819067b93989525581aa5526b540646",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "e26aed74-c816-40d3-a810-48d6fbd8b2fd": {
     "rule_name": "Spike in Successful Logon Events from a Source IP",
@@ -13528,15 +13589,15 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Suspicious .NET Reflection via PowerShell",
-        "sha256": "0340e6a85d09bbf8fa8fb4f0c4c7bbabbcf56d7196e1c6a8ced5b4922f07f7b2",
+        "sha256": "aceeffb1d2d30da61a5c975b4c978c1a8dd0687ddac7214c80ae21c9067eadfc",
         "type": "query",
-        "version": 113
+        "version": 114
       }
     },
     "rule_name": "Suspicious .NET Reflection via PowerShell",
-    "sha256": "ca835ae54902b43b43600be560e50e3ec172b5bab2d1419520717665a9b443e8",
+    "sha256": "ed908ff078c5a2e7569fc9967c30cc040397ed9122a09287031c0a4e5d04e377",
     "type": "query",
-    "version": 316
+    "version": 317
   },
   "e28b8093-833b-4eda-b877-0873d134cf3c": {
     "rule_name": "Network Traffic Capture via CAP_NET_RAW",
@@ -13546,9 +13607,9 @@
   },
   "e29599ee-d6ad-46a9-9c6a-dc39f361890d": {
     "rule_name": "Suspicious pbpaste High Volume Activity",
-    "sha256": "a4c8f8bfde8a3b923156ef450b75f64bc7fe03e04671221bd7040e12c3e98c02",
+    "sha256": "2190e84f9e7192e1648c8b1673576f046c4e03d475bb75045c7b9e2e12bae237",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "e2a67480-3b79-403d-96e3-fdd2992c50ef": {
     "rule_name": "AWS Management Console Root Login",
@@ -13568,22 +13629,22 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Windows Subsystem for Linux Enabled via Dism Utility",
-        "sha256": "b9a7b32c3dfb500b067eb62db94be7e669a714213f44475884a5d82188a89576",
+        "sha256": "8d70b76836720ce1d1bfc90c83ef511c63192ceba13afe89de6d4bd71db8d10c",
         "type": "eql",
-        "version": 8
+        "version": 9
       },
       "8.13": {
         "max_allowable_version": 207,
         "rule_name": "Windows Subsystem for Linux Enabled via Dism Utility",
-        "sha256": "e20728e2d7fdb11e0c89fe8b59339217c06311f3e887ecc68c878ac02e342c43",
+        "sha256": "8c937a63efdd09c306a4b062fb0111216523fadb6b29f8ddd000fc831dffb3a3",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Windows Subsystem for Linux Enabled via Dism Utility",
-    "sha256": "e700c3aa1868cdab411187bb9463c15130cb104b333c4aeca0f322d52bfbe885",
+    "sha256": "16d97ecf035e7b51f4cd64bf55a659d5b15dd93323fc78280d023922c5e1d00a",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2": {
     "min_stack_version": "8.14",
@@ -13603,9 +13664,9 @@
   },
   "e2fb5b18-e33c-4270-851e-c3d675c9afcd": {
     "rule_name": "GCP IAM Role Deletion",
-    "sha256": "81da5ac170cebd66bcbf89e17268d9b7d3559955c522f1623d651961f6419cbe",
+    "sha256": "44411255b771a99faffe0685c0f5e63977818e21d073d24091ff91bd9aa33b51",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "e302e6c3-448c-4243-8d9b-d41da70db582": {
     "min_stack_version": "8.13",
@@ -13613,15 +13674,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Potential Data Splitting Detected",
-        "sha256": "e9c73adb2c1f6cce1863d61a9079baab27593eb754bed9dfb7462a2a0e757dfa",
+        "sha256": "7b1c198e74d0e4f3d7b01f471cbcaf92ef595343883d73f4bcca641970102396",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Potential Data Splitting Detected",
-    "sha256": "c08a0ecf0d3956e8250d8f80883239a461489dd8a2b1a3f25bf3ddee0e528d5f",
+    "sha256": "e5a627c8877854a1743a8653bf701e6a542b29ef63ac512764742090ab97f019",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "e3343ab9-4245-4715-b344-e11c56b0a47f": {
     "min_stack_version": "8.14",
@@ -13629,34 +13690,34 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Process Activity via Compiled HTML File",
-        "sha256": "433f8b6dbfbb827e6060d659633ff337f13f121b38b71de98f5e0c71cae016bb",
+        "sha256": "c66a168ed3b1aa0efc9fd8a2c7f723b9b814fd5d0c3d2b6f04b437cf128a89ff",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Process Activity via Compiled HTML File",
-        "sha256": "b2ec162d5e1153e3aec75388d239610723efecf8e84f07bed191977174467f88",
+        "sha256": "076f262b0c9c62805bd7d969fc2bc5a6e3ae9dcbfa5c30cc922041a3087b7a7f",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Process Activity via Compiled HTML File",
-    "sha256": "af6bff4d9b0f88e5cadd6ce1f24e77dac8a706d375a23109a8c681c97c6b4706",
+    "sha256": "77d77852881da5c7de3250605cbf8440cfb6dae48e1b9b767e4aad194d02688d",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "e3c27562-709a-42bd-82f2-3ed926cced19": {
     "rule_name": "AWS Route53 private hosted zone associated with a VPC",
-    "sha256": "7ffafc6db354cba90fcf1ace4d763e22cb051ba2f8ad28c7e9f2cd89ef903525",
+    "sha256": "f2d736a544e71eb0be5118b7e11cc5ca78ef900a8f8d7225e8c0b03ad08c6587",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "e3c5d5cb-41d5-4206-805c-f30561eae3ac": {
     "rule_name": "Ransomware - Prevented - Elastic Endgame",
-    "sha256": "b7d178b2a838a3cb100c12763f21969b20233d489823c43d10e756e079284462",
+    "sha256": "6b3dadd40aa120848fae2bf405a3e564a4f8f1f135f3e43273c9a5990cce5592",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "e3cf38fa-d5b8-46cc-87f9-4a7513e4281d": {
     "min_stack_version": "8.14",
@@ -13664,15 +13725,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Connection to Commonly Abused Free SSL Certificate Providers",
-        "sha256": "888df58b2f7bdef7997e9bf98f6cefecc8e5dc094ec1c1391fbec5f03fc85d8e",
+        "sha256": "15425280f466c2729b02c0af122c6c595b30165cd51c4f683fee546070d396a0",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Connection to Commonly Abused Free SSL Certificate Providers",
-    "sha256": "b96e61601debc0c2b8731cd56031412334418497e035336cb8c471af5f70b60f",
+    "sha256": "151650631c31a43c201b4eaea3749b4f13790dd576c4420057b75b9cd51c740b",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "e3e904b3-0a8e-4e68-86a8-977a163e21d3": {
     "min_stack_version": "8.13",
@@ -13680,15 +13741,15 @@
       "8.12": {
         "max_allowable_version": 213,
         "rule_name": "Persistence via KDE AutoStart Script or Desktop File Modification",
-        "sha256": "782e6ea2ec801b948326c6dde829cf378f884c812681328c4577234da4bf90fa",
+        "sha256": "3d6b19ea3b397ac9a3e1d4779f0bfbbbe891a2b9352cc8331b3d1b21b3492f86",
         "type": "eql",
-        "version": 114
+        "version": 115
       }
     },
     "rule_name": "Persistence via KDE AutoStart Script or Desktop File Modification",
-    "sha256": "8af95982bc5bf6ac79c1640581bac78450e3467512b7640c60b0ecf139a19a45",
+    "sha256": "55762f454327d9065371b5165062d4e75939cd27c5a7b9d08a60987b18431cbc",
     "type": "eql",
-    "version": 214
+    "version": 215
   },
   "e468f3f6-7c4c-45bb-846a-053738b3fe5d": {
     "min_stack_version": "8.14",
@@ -13696,15 +13757,15 @@
       "8.12": {
         "max_allowable_version": 104,
         "rule_name": "First Time Seen NewCredentials Logon Process",
-        "sha256": "020a011d15d2d0ad7e19782ca05849aee2beece8563925f3c5ecba763271bf0f",
+        "sha256": "15409282fc22300e62bdd9cfa9c3699264d000fb84da5ff6405ad81aaa842305",
         "type": "new_terms",
-        "version": 5
+        "version": 6
       }
     },
     "rule_name": "First Time Seen NewCredentials Logon Process",
-    "sha256": "ffe14ac65dfa2a8820245873c21a9e1c00089649ed9d3be35102f434e3824639",
+    "sha256": "e2d4147e9b55b1a927716d2a92ff1672ed2857f83721c419e597fac90cda2559",
     "type": "new_terms",
-    "version": 105
+    "version": 106
   },
   "e48236ca-b67a-4b4e-840c-fdc7782bc0c3": {
     "min_stack_version": "8.15",
@@ -13712,22 +13773,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Modify an Okta Network Zone",
-        "sha256": "b1e2d03c73734a939284f846dea8d0c59717275736d683ab676fa33d53e87cf3",
+        "sha256": "e088d4ca612ade27d31a69dd5614c2f742ce616cc3e7fa7dd0f87acfabc6968b",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Modify an Okta Network Zone",
-        "sha256": "b1e2d03c73734a939284f846dea8d0c59717275736d683ab676fa33d53e87cf3",
+        "sha256": "e088d4ca612ade27d31a69dd5614c2f742ce616cc3e7fa7dd0f87acfabc6968b",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Modify an Okta Network Zone",
-    "sha256": "f18c885e92e617b8feda9dc5a5cbd8c23e84c073e585485a552b5c4f9c86d1c5",
+    "sha256": "e7a1afdd3aed5b8990f25c5c3ebc89a3d4e1911e68296667f6b6e4cc13e21407",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "e4e31051-ee01-4307-a6ee-b21b186958f4": {
     "min_stack_version": "8.14",
@@ -13735,15 +13796,15 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Service Creation via Local Kerberos Authentication",
-        "sha256": "b0f8db3df27e01d7b12cdd167287aca6d31dcafc2878624cdfc8971185e9c74d",
+        "sha256": "efce8f9ccb0652297ffed54f6d3ccb3c621da9704c8b1a147357fe1b2dec9780",
         "type": "eql",
-        "version": 106
+        "version": 107
       }
     },
     "rule_name": "Service Creation via Local Kerberos Authentication",
-    "sha256": "9eb77e0dda391b5aa9d210c7d318596248ca59b969e138c7cfa6d9a2fcfd72ad",
+    "sha256": "beac001dcd5095010c452fd5a86f0733003a76aa6c8e8f3de2c8d7abef8fa9e1",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "e514d8cd-ed15-4011-84e2-d15147e059f1": {
     "min_stack_version": "8.14",
@@ -13757,9 +13818,9 @@
       }
     },
     "rule_name": "Kerberos Pre-authentication Disabled for User",
-    "sha256": "aad6c2b791f2afc079b2ed0ef7a166717dc6a09cc6de90722d6ebf150ddc70fb",
-    "type": "query",
-    "version": 213
+    "sha256": "4f3219372b857ac80a9bfa981a981b8fca89e436d209e90b51d436bb7e8becbe",
+    "type": "eql",
+    "version": 214
   },
   "e555105c-ba6d-481f-82bb-9b633e7b4827": {
     "rule_name": "MFA Disabled for Google Workspace Organization",
@@ -13775,15 +13836,15 @@
   },
   "e6c1a552-7776-44ad-ae0f-8746cc07773c": {
     "rule_name": "Bash Shell Profile Modification",
-    "sha256": "bc03a7affdb0db7aca8cb74b550750403c0cc22f1f31640dabbcf506dd04b2b3",
+    "sha256": "8893356dd5ca661718d8f5c32e3d5b4e2e31ced5866bad1aac12f2ae4b1837b8",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "e6c98d38-633d-4b3e-9387-42112cd5ac10": {
     "rule_name": "Authorization Plugin Modification",
-    "sha256": "ef208b091fc4ad2aa8c598a1e11c2de761824f498ee049b117285c932936bb8e",
+    "sha256": "abc854ad84c4df75f33b8a3ec0b322047c931d738de30da1996883afbdd7b799",
     "type": "query",
-    "version": 107
+    "version": 108
   },
   "e6e3ecff-03dd-48ec-acbd-54a04de10c68": {
     "min_stack_version": "8.15",
@@ -13791,34 +13852,34 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Possible Okta DoS Attack",
-        "sha256": "5ded2187b0cfe73d588eb8981bab8ec9db75d3cd552a3160b7fe638491e2301e",
+        "sha256": "555778fe474de3773a42ba94313153209ce4209e51a196813715a3ddfa835ff8",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Possible Okta DoS Attack",
-        "sha256": "5ded2187b0cfe73d588eb8981bab8ec9db75d3cd552a3160b7fe638491e2301e",
+        "sha256": "555778fe474de3773a42ba94313153209ce4209e51a196813715a3ddfa835ff8",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Possible Okta DoS Attack",
-    "sha256": "048e2b732c95e535f676081e8685ce53b76cd8569c7d433cc82e6fef1a54b579",
+    "sha256": "d31797a2a9ebd8114c915f01f1b7222689f61769135d5406738283834a175f72",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "e6e8912f-283f-4d0d-8442-e0dcaf49944b": {
     "rule_name": "Screensaver Plist File Modified by Unexpected Process",
-    "sha256": "226d7ec9a8d7ef8ee5497afe3c062dd60f96978b4e83c4327ab07af37b0e5b51",
+    "sha256": "3dbf9bc9fd85cfb35ac80dc541572c5d63b43929630586389dfb4d21d5f3abea",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "e7075e8d-a966-458e-a183-85cd331af255": {
     "rule_name": "Default Cobalt Strike Team Server Certificate",
-    "sha256": "6bbe76d52fd258b99c66bbf69e3f64060fa0a3112a36cd1c55f44d03d2da9d9e",
+    "sha256": "a33b86d48c3d3d62db7a1fa07ff45e3dd2ec92fa332099989635eeb934db5345",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "e707a7be-cc52-41ac-8ab3-d34b38c20005": {
     "rule_name": "Potential Credential Access via Memory Dump File Creation",
@@ -13832,15 +13893,15 @@
       "8.12": {
         "max_allowable_version": 206,
         "rule_name": "Execution of Persistent Suspicious Program",
-        "sha256": "bae068bbb951844f6a723136dec199140d6d35b62406b5deddbe6208895a7478",
+        "sha256": "8e916c6e5e28236cf4e78bb6c9a7cb8991800d108c6dce8a147b6196ae27b89c",
         "type": "eql",
-        "version": 107
+        "version": 108
       }
     },
     "rule_name": "Execution of Persistent Suspicious Program",
-    "sha256": "a7f9e12e26f22539b2c1e4f2c784361d72a1bbc261ff0bc1fa9ba30bb48845a1",
+    "sha256": "745553dd4b4f167afb3f9d8aa2a73cb88e8a9984dbee97b741c011740ea72306",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "e72f87d0-a70e-4f8d-8443-a6407bc34643": {
     "min_stack_version": "8.15",
@@ -13848,28 +13909,28 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Suspicious WMI Event Subscription Created",
-        "sha256": "4f033d8b97bebdd4d3f7dfb51f5465e5283d687187e643b9e5ad76f243122b20",
+        "sha256": "0eb9b50416c959551b3b273ef5326ae8b96145ec4ea717bee0033ea99d133af6",
         "type": "eql",
-        "version": 106
+        "version": 107
       },
       "8.14": {
         "max_allowable_version": 305,
         "rule_name": "Suspicious WMI Event Subscription Created",
-        "sha256": "06bda64b32dbb62509ffcf7e3377fab8e420bc69ab7b80f0984dba9a06b99a0c",
+        "sha256": "123c8d391974a063625df859c1b10d7a95232b0f02f302c5097d70074e697164",
         "type": "eql",
-        "version": 206
+        "version": 207
       }
     },
     "rule_name": "Suspicious WMI Event Subscription Created",
-    "sha256": "c27d3d535d30d3af01b3d9c4fefd1fffd5d4aece3da4eec4fdcdd0ee716bdd22",
+    "sha256": "b11cb97ba4927fbd34141d3a5cc49333cbae82890c27eb7731e165ed71b3cdbc",
     "type": "eql",
-    "version": 306
+    "version": 307
   },
   "e7357fec-6e9c-41b9-b93d-6e4fc40c7d47": {
     "rule_name": "Potential Windows Session Hijacking via CcmExec",
-    "sha256": "0bb32a27d1f4286cf963fe0af6c21dba8716c0bc8a3b250af1d0b62993eda76a",
+    "sha256": "fc6696281aaff38aabf5ef6dfe7b56c731c027f5daa36aa8fa27db356d1836cf",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "e74d645b-fec6-431e-bf93-ca64a538e0de": {
     "rule_name": "Unusual Process For MSSQL Service Accounts",
@@ -13883,22 +13944,22 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Unusual Execution via Microsoft Common Console File",
-        "sha256": "2d88a1a1afbd362333b27616ad60ef7198d3e854a31723b98ad96fb451d7fb35",
+        "sha256": "0bea98ee6e9ce10eac166784de0d4aeceb2b4e690051357201bb91cffc7e5edb",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Unusual Execution via Microsoft Common Console File",
-        "sha256": "8aa16b6d5c72cbd8db236cecb394fdb3419409a9334e5de3e489cba322b17da1",
+        "sha256": "5ff7838c257d23a22ac81dc996fa1bba6e80734971669cbf6c8f5bdfa6314f5f",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Unusual Execution via Microsoft Common Console File",
-    "sha256": "91c9567bb907691834edbcbf81478eea228783238516ba4840d2a6678945a3f7",
+    "sha256": "8b9fb79800f9757717537734e0e8fd81eb27c77c51f3bea4933b4026af77e360",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "e7cb3cfd-aaa3-4d7b-af18-23b89955062c": {
     "min_stack_version": "8.13",
@@ -13906,27 +13967,27 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Potential Linux Credential Dumping via Unshadow",
-        "sha256": "9f5e4df959c1865722b929f62227913e0415b091e5be48dc94f3037768b94393",
+        "sha256": "ecaad70591f430b71f38353b51514e955299f312f6299c043edbe78296d96c47",
         "type": "eql",
-        "version": 8
+        "version": 9
       }
     },
     "rule_name": "Potential Linux Credential Dumping via Unshadow",
-    "sha256": "33f6b8d02db10f4facbc48d16e77be33e52f39438aef54bf79c28fac85947e83",
+    "sha256": "6863009c2b3d1dcd070aa298d0dd85428eda56639d10b0cd9df2fbf806b56ea0",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "e7cd5982-17c8-4959-874c-633acde7d426": {
-    "rule_name": "AWS Route Table Modified or Deleted",
-    "sha256": "811d4c47d79d5e63a6d39a14a0e8c4c6d8bdc81b09f09705f57ce46905ea4112",
-    "type": "query",
-    "version": 207
+    "rule_name": "AWS EC2 Route Table Modified or Deleted",
+    "sha256": "e56e718a9723a794c9e062425a957d4e952f2a9984792aa9df06ea86c7310dda",
+    "type": "new_terms",
+    "version": 208
   },
   "e80ee207-9505-49ab-8ca8-bc57d80e2cab": {
     "rule_name": "Network Connection by Cups or Foomatic-rip Child",
-    "sha256": "5537d2a44f881bfebdb8606aac6d5674c620607d55bb4822209da2cb5f3caa40",
+    "sha256": "a8e2f8106c708db68e63844ac1cc428b8667fe3c36c280e89ff02504ec867eeb",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "e8571d5f-bea1-46c2-9f56-998de2d3ed95": {
     "min_stack_version": "8.14",
@@ -13934,15 +13995,15 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Service Control Spawned via Script Interpreter",
-        "sha256": "23319cac9de2bde953f91039aa5aaf01a9dee132682c44d6c32a15b80a48bc70",
+        "sha256": "32055c8d4af293ff9a8be66666fca76693403db6496116430450aab41050d035",
         "type": "eql",
-        "version": 112
+        "version": 113
       }
     },
     "rule_name": "Service Control Spawned via Script Interpreter",
-    "sha256": "a674e578cfbef5b95a62b11671aeca823f09b5f2f63129f91f2557fa46d972e4",
+    "sha256": "90408a5fd78cdaf27de15d201a1c9a85a6ef0ded0315d91be4d71a8ad7f8ac51",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "e86da94d-e54b-4fb5-b96c-cecff87e8787": {
     "min_stack_version": "8.14",
@@ -13950,22 +14011,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Installation of Security Support Provider",
-        "sha256": "d43ac925cacf9d6a9f783a2368854c53d33a41aad5cc37d722423671a5f4d0b7",
+        "sha256": "b539da6b7c1b1227bdb42936daceee9540ba7d0f3605ee4daa85bd0c836ac05a",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Installation of Security Support Provider",
-        "sha256": "3d579bb92fe8249d3708f287ce73068e3e1eb7d3da4d7457b71e6c95ec5e6491",
+        "sha256": "4921dd59a49f0857c4a5a11360976efc71f083994125f28706e6071dc19c7473",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Installation of Security Support Provider",
-    "sha256": "e863b1547c1a211479f64783701a48f31459decaff80471ecc40d7b3f7d64f0d",
+    "sha256": "d3e972fca563427e3d76bb4395afc5f71c455501294696f9dc6df982b1d28abe",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "e88d1fe9-b2f4-48d4-bace-a026dc745d4b": {
     "min_stack_version": "8.14",
@@ -13973,27 +14034,27 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Host Files System Changes via Windows Subsystem for Linux",
-        "sha256": "f650cdefd5366db74cbb8b10fcdc442ca99580255059225a70906d7069dcc006",
+        "sha256": "e8fd6440c6d6d88986539c259693d1ee14c53bbebd9bce21eab23ced642d5c02",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Host Files System Changes via Windows Subsystem for Linux",
-    "sha256": "a8d0addea981abc201c8075ddf84cc71cf8e889932f1c06e212d64d43a19f083",
+    "sha256": "a50076fcb40d588e056f081e1168588950939d6c95a97f2facfed56882ce6f9e",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "e8c9ff14-fd1e-11ee-a0df-f661ea17fbce": {
     "rule_name": "AWS S3 Bucket Policy Added to Share with External Account",
-    "sha256": "14242eb38154b8a8e1a58bf61c0bfb74b5979a402c8daf3ac16d945e00cfd816",
+    "sha256": "a666b794f171a1a2c008b39794d12cb837d0fee82e293f8dc6601f749a723645",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "e9001ee6-2d00-4d2f-849e-b8b1fb05234c": {
     "rule_name": "Suspicious System Commands Executed by Previously Unknown Executable",
-    "sha256": "53547d9a43a3fc0d757d092bb75810899bd2886e9a0ff67b393c97c069bd4753",
+    "sha256": "b54a9721e854b951bcffd517564dba55d3d9f5a1b13ff4bc738ee5aa7e4f9bc5",
     "type": "new_terms",
-    "version": 107
+    "version": 108
   },
   "e90ee3af-45fc-432e-a850-4a58cf14a457": {
     "min_stack_version": "8.15",
@@ -14001,34 +14062,34 @@
       "8.12": {
         "max_allowable_version": 310,
         "rule_name": "High Number of Okta User Password Reset or Unlock Attempts",
-        "sha256": "568146e376ee07a8ab11dfb397d318d7d05ede6ad35892d78bca3b64ae4df8b4",
+        "sha256": "11687f3cbf71206899bfb40ed8a027202830df829f70f0e59b649de19c51b3a4",
         "type": "threshold",
-        "version": 211
+        "version": 212
       },
       "8.14": {
         "max_allowable_version": 411,
         "rule_name": "High Number of Okta User Password Reset or Unlock Attempts",
-        "sha256": "568146e376ee07a8ab11dfb397d318d7d05ede6ad35892d78bca3b64ae4df8b4",
+        "sha256": "11687f3cbf71206899bfb40ed8a027202830df829f70f0e59b649de19c51b3a4",
         "type": "threshold",
-        "version": 312
+        "version": 313
       }
     },
     "rule_name": "High Number of Okta User Password Reset or Unlock Attempts",
-    "sha256": "d11da02598d181a9b5b98bd81d2ed0fa75917c9272927db866e2ca9fe71a1425",
+    "sha256": "18719e990037ed4bcedb7040cb575b1b244fdea008bf902c36de0c0dc87262d9",
     "type": "threshold",
-    "version": 412
+    "version": 413
   },
   "e919611d-6b6f-493b-8314-7ed6ac2e413b": {
     "rule_name": "AWS EC2 VM Export Failure",
-    "sha256": "ddfa3e022f23c8689c14e4a4abba71826f9ad576159d7e3d70ee93634965dd8c",
+    "sha256": "0cc0882f3f4079767583e56fd8ac76f94fe773a3ad47b80a5c7ef1f07e5afcd2",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "e92c99b6-c547-4bb6-b244-2f27394bc849": {
     "rule_name": "Spike in Bytes Sent to an External Device via Airdrop",
-    "sha256": "97e36f64a18b7742354c75783032d8c937129028e729388f75253413f03292d8",
+    "sha256": "b7a20dbebcf0f6ecd941a69b135191989886cb45781f0e23444e523bfaa03208",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "e94262f2-c1e9-4d3f-a907-aeab16712e1a": {
     "min_stack_version": "8.14",
@@ -14036,34 +14097,34 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Unusual Executable File Creation by a System Critical Process",
-        "sha256": "039641e8c7b1e6c8242b90a66989c99c2f7e958b18bbb211f172b588af3a6f3f",
+        "sha256": "6ef104d85ec9575226338908f304d5def68a7412883399913f6bb68378d6decb",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Unusual Executable File Creation by a System Critical Process",
-        "sha256": "9273914a7b7945fd48d1b65cbaca22cac9b1a363e215a919dfc7d7f2023e6a9b",
+        "sha256": "5f4f414a3ae8185a194ee698b33f60372d7733ed66e23b8ef56fe4c06edb3dbc",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Unusual Executable File Creation by a System Critical Process",
-    "sha256": "3472059c099b888efa866c73f5ebda8a7cdd81a96a7c4c6c01e327c1d1fa2aa6",
+    "sha256": "2ec2b40b6d719512b8aedec3c65efa2e1ce6b38aa2dfb387edf32b43516c9421",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb": {
     "rule_name": "Potential LSA Authentication Package Abuse",
-    "sha256": "85a69d2c3599e4ee1bee8122b9a14c0b9148c3db5d510013e18e96dd0f9ec389",
+    "sha256": "5b5c778062c60175f66184a03ec8cc58deaec9c8d47e50b7e62d75b592eb203e",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "e9b0902b-c515-413b-b80b-a8dcebc81a66": {
     "rule_name": "Spike in Remote File Transfers",
-    "sha256": "f9cfa49163402d6de09bf8956e320315bd0c937785ed3267ad306470bc834a69",
+    "sha256": "8d2b4cd0d07e0114cbfc97e7836712efaedb13d7941b49ba32df06344bed130f",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "e9b4a3c7-24fc-49fd-a00f-9c938031eef1": {
     "rule_name": "Linux Restricted Shell Breakout via busybox Shell Evasion",
@@ -14073,9 +14134,9 @@
   },
   "e9ff9c1c-fe36-4d0d-b3fd-9e0bf4853a62": {
     "rule_name": "Azure Automation Webhook Created",
-    "sha256": "064a5bf18acba039757d18c76b42acec87f1e497cf8143bc705af25765204078",
+    "sha256": "ca8b561fa907119476109df0f7f86007194ffc80c3b614c4f69522d366f15e92",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17": {
     "rule_name": "SSH (Secure Shell) from the Internet",
@@ -14089,15 +14150,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Unusual Process Spawned by a Parent Process",
-        "sha256": "d2146dbc0bf3635a79dd508efbeac1edd36c749e19d592d10ca7e5bdd1be2879",
+        "sha256": "9305b82ec96b801a1ce3d03306069610691b62051ca30252e654c38b624f7c55",
         "type": "machine_learning",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Unusual Process Spawned by a Parent Process",
-    "sha256": "273ab111885b862ada1a91bda7e0c52c082564cfb0bd6c60905f01285ffdc336",
+    "sha256": "263dc5090dd778a47400fbeb93a47512defec5bc3e78d7bdd173ab8dd1c95910",
     "type": "machine_learning",
-    "version": 107
+    "version": 108
   },
   "ea248a02-bc47-4043-8e94-2885b19b2636": {
     "rule_name": "AWS IAM Brute Force of Assume Role Policy",
@@ -14107,21 +14168,21 @@
   },
   "eaa77d63-9679-4ce3-be25-3ba8b795e5fa": {
     "rule_name": "Spike in Firewall Denies",
-    "sha256": "260bc7516505de6ab2ad79dccd957b4dc8c0f76dcbf987df647077cc0ced1f52",
+    "sha256": "fc408da92fc5febf3e95b3e4466fadb5f9c59ff6f98e5b71c5ba830dbebc52f3",
     "type": "machine_learning",
-    "version": 104
+    "version": 105
   },
   "eaef8a35-12e0-4ac0-bc14-81c72b6bd27c": {
     "rule_name": "Suspicious APT Package Manager Network Connection",
-    "sha256": "805fa189545f981d575ddc36086ba698c6cab425b1ecf2c09c8f857aa7db539f",
+    "sha256": "709ead5c81ab3e462057c1d8214a1ba0a83c82b80ff27328133a1e0faf4c29d0",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "eb079c62-4481-4d6e-9643-3ca499df7aaa": {
     "rule_name": "External Alerts",
-    "sha256": "8abb5aaa7b7120ccd0f4b723b4d43ede8ef4179dfd361a78a77fb3e7501947b6",
+    "sha256": "cfe3ec83261ca32ec7fa6c3ec8fe8c6d8b42361b74fc363e99795dcce182badb",
     "type": "query",
-    "version": 103
+    "version": 104
   },
   "eb44611f-62a8-4036-a5ef-587098be6c43": {
     "min_stack_version": "8.14",
@@ -14129,15 +14190,15 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "PowerShell Script with Webcam Video Capture Capabilities",
-        "sha256": "492442b9a011a2f12dba2f025284191a27457dc32fa61c4cdae57c2efe1bf9ad",
+        "sha256": "0df8fef46aadb6e55f99fcb160c20a7c50b5b97687a0ae824409284676656051",
         "type": "query",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "PowerShell Script with Webcam Video Capture Capabilities",
-    "sha256": "452345c390a3f58cffe2ad756b136a031115a28fa4243770374662c6c857f01a",
+    "sha256": "34b8cb6cbafa6c8284ce99c7c6cc95be28e2423a480b5e56d46de73e21ecb72a",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "eb610e70-f9e6-4949-82b9-f1c5bcd37c39": {
     "min_stack_version": "8.14",
@@ -14164,9 +14225,9 @@
   "eb804972-ea34-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Behavior - Prevented - Elastic Defend",
-    "sha256": "ec5e33322a047ec2ab8e5339bcbc0a666083f428226a5c77f0384a4fc1d25e4f",
+    "sha256": "a02516be221389871603168f7a42128228b546471c99d60bbf22ea310f6e54e3",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e": {
     "min_stack_version": "8.13",
@@ -14174,15 +14235,15 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Potential Disabling of SELinux",
-        "sha256": "40ab8ab43acdf3a9d7783d20ac3658086a45ff61e1871fe984d77c6a1d3984ef",
+        "sha256": "68bbdb25d3a0f0d088bd7072fdefec01a701b6549176297cee71b31463d90ffe",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Potential Disabling of SELinux",
-    "sha256": "7c9c059e8f30a4e218760af3d2ca27b7b63469eee383e2e939b224fa3db2c470",
+    "sha256": "ddbc5c95a5cd722eb6547a67e6e8d7f04835cb44907b7480f2c46b5b94bc56c7",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6": {
     "min_stack_version": "8.14",
@@ -14236,40 +14297,40 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Process Execution from an Unusual Directory",
-        "sha256": "410db635d79cd7e1e9e08c48ec74e3d535e371c84cceb06dcf0bca6f5a3c36ce",
+        "sha256": "59220b274ab98c211eafbd5205e41e943cadddbebe78776bd28a88a2b38d017b",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "Process Execution from an Unusual Directory",
-        "sha256": "7b1ad0930e0d399848cb3814f29f4114d11dc749c1117fe69b11dcfda2aa05d4",
+        "sha256": "dae2d05e8c9a23744a3d55ec56c1540501141276c8789e74c7e1aa33e787721d",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Process Execution from an Unusual Directory",
-    "sha256": "b5ef38fb69f464a4b3a78df77efdff1973928840166119bd81ec4834d944cac2",
+    "sha256": "76b8d3439003b72e5e932ff9c74478b5688253f8092575aea6c69d58e043bcc5",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "ec604672-bed9-43e1-8871-cf591c052550": {
     "rule_name": "File Made Executable via Chmod Inside A Container",
-    "sha256": "20c2ee6633bad709523ecb7a36a5e666212d251d264feca7543facf2bb56ea54",
+    "sha256": "c4678239b073c9e1c28fd96f625436ef8f93ab27e0b80d9d2da6d39d0ced459d",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "ec8efb0c-604d-42fa-ac46-ed1cfbc38f78": {
     "rule_name": "Microsoft 365 Inbox Forwarding Rule Created",
-    "sha256": "98615f87ce24445df876a6f771b6899cfdecbd5028d5167fb5f060c7d2cb44df",
+    "sha256": "4572e35abc9f3fb1f7be34775ed498cbbbca8890182cba8ca5beff3a53bf673f",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "ecc0cd54-608e-11ef-ab6d-f661ea17fbce": {
     "rule_name": "Unusual Instance Metadata Service (IMDS) API Request",
-    "sha256": "61702c8dcf0374f8bb444a8a111fb32779c6ef86dbbfa133ec1fdb56321c8db1",
+    "sha256": "5a63abf64de763c9eee2d8689dc1c75693f79b684903c4b6cb6941ea024892e0",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "ecd4857b-5bac-455e-a7c9-a88b66e56a9e": {
     "rule_name": "Executable File with Unusual Extension",
@@ -14279,15 +14340,15 @@
   },
   "ecf2b32c-e221-4bd4-aa3b-c7d59b3bc01d": {
     "rule_name": "AWS RDS Instance/Cluster Stoppage",
-    "sha256": "597f9aec8295f443a639129b9f673f0e3302a48b8ba1f7a3eab0de937bc34d58",
+    "sha256": "35c7505a4a7e2503e09a6d55f986977e180f79e72dfde6b46e17c48fff3342e3",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "ed9ecd27-e3e6-4fd9-8586-7754803f7fc8": {
     "rule_name": "Azure Global Administrator Role Addition to PIM User",
-    "sha256": "05eb2cfe7c6c45d6ae432cf2c83e8d0a56cb0a6c5111004de8625830d13ee06c",
+    "sha256": "31edfa8b99be2305a6bb1447799c69cf2f60e5a834ce4b064a4b4665bea80dd1",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "eda499b8-a073-4e35-9733-22ec71f57f3a": {
     "min_stack_version": "8.14",
@@ -14318,22 +14379,22 @@
       "8.12": {
         "max_allowable_version": 308,
         "rule_name": "Attempt to Deactivate an Okta Application",
-        "sha256": "4a88d4ac8ebf748a1a4f8d50aef2324ce844b7381d83fad2cdbffc4763277b05",
+        "sha256": "16079a140012eb657c5c76c259629f9baab9f15ea6434d1329b8a947a2622c94",
         "type": "query",
-        "version": 209
+        "version": 210
       },
       "8.14": {
         "max_allowable_version": 409,
         "rule_name": "Attempt to Deactivate an Okta Application",
-        "sha256": "4a88d4ac8ebf748a1a4f8d50aef2324ce844b7381d83fad2cdbffc4763277b05",
+        "sha256": "16079a140012eb657c5c76c259629f9baab9f15ea6434d1329b8a947a2622c94",
         "type": "query",
-        "version": 310
+        "version": 311
       }
     },
     "rule_name": "Attempt to Deactivate an Okta Application",
-    "sha256": "7355fba3ce55aec17442765a90407b699e366f736cc86d29b33b49d60ef6041a",
+    "sha256": "f254d125f5da752be3671f52f44af3671f6730739ac5e5fe785f8bd0f831b628",
     "type": "query",
-    "version": 410
+    "version": 411
   },
   "edf8ee23-5ea7-4123-ba19-56b41e424ae3": {
     "min_stack_version": "8.14",
@@ -14341,28 +14402,28 @@
       "8.12": {
         "max_allowable_version": 212,
         "rule_name": "ImageLoad via Windows Update Auto Update Client",
-        "sha256": "d9390521fb8ec490fd84fdba1668ebb433862673b898bc446455d90b71cd13a8",
+        "sha256": "495c9c3c998abfebae7ebc1d58f5d3fbf791ad4eaf2718e83c11d65598b43fe3",
         "type": "eql",
-        "version": 113
+        "version": 114
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "ImageLoad via Windows Update Auto Update Client",
-        "sha256": "bdcf41c9d261562501f02bbc0fdf00741c278f827f8c4b389c9b44351aaa466b",
+        "sha256": "3b0ac08f7d0c601b06e44b9edb38650af8ddbdc85f786151f275fa96f595fe72",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "ImageLoad via Windows Update Auto Update Client",
-    "sha256": "b1477cad6a3940c5331b5aac48248d75f2d9628f206c15ca3a83c52a0f2fde0d",
+    "sha256": "9a796bd4864dce9764f4ff2cbf3bd4ccb3217521e23209f69c4e18ecf9ad41d1",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "edfd5ca9-9d6c-44d9-b615-1e56b920219c": {
     "rule_name": "Linux User Account Creation",
-    "sha256": "4af9d5eb4553ab22a10d185542796bf3827c9c57126d958da584089a9b4181a6",
+    "sha256": "5147bc8232ad7a92a84e036bdd81d4fcbcc9ce09fe2b0a2697ae01769ec50e20",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e": {
     "min_stack_version": "8.15",
@@ -14370,22 +14431,22 @@
       "8.12": {
         "max_allowable_version": 205,
         "rule_name": "Okta FastPass Phishing Detection",
-        "sha256": "4fc8575bfa9aca1a9f10798c799d9b2bd4c64285c239241532c61f81b90bab7c",
+        "sha256": "3a4e694a70d98f4075ad70e8cbc4c5820745c5ea03ab7103f18015a3cc68dc24",
         "type": "query",
-        "version": 106
+        "version": 107
       },
       "8.14": {
         "max_allowable_version": 306,
         "rule_name": "Okta FastPass Phishing Detection",
-        "sha256": "4fc8575bfa9aca1a9f10798c799d9b2bd4c64285c239241532c61f81b90bab7c",
+        "sha256": "3a4e694a70d98f4075ad70e8cbc4c5820745c5ea03ab7103f18015a3cc68dc24",
         "type": "query",
-        "version": 207
+        "version": 208
       }
     },
     "rule_name": "Okta FastPass Phishing Detection",
-    "sha256": "c7814e9adfd30ef636099ce00d44774b41fdd034978678ed1f1da809a6766c54",
+    "sha256": "7ff673016488bafc9ac4a344918957eda1629b68b0dd51bdc773ce2f9ace05a3",
     "type": "query",
-    "version": 307
+    "version": 308
   },
   "ee5300a7-7e31-4a72-a258-250abb8b3aa1": {
     "min_stack_version": "8.14",
@@ -14393,15 +14454,15 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Unusual Print Spooler Child Process",
-        "sha256": "1c4b115ce0bde803fa63edbabb634df01af0720cabb3012ed329a5031cd7c961",
+        "sha256": "0c4cf82321253f33a4bf12dfa7306b7c39b7082304cab83766ef69126f83169e",
         "type": "eql",
-        "version": 109
+        "version": 110
       }
     },
     "rule_name": "Unusual Print Spooler Child Process",
-    "sha256": "986186036dc086ae57af371ae59653ca11d16660a1311a709a7137fa6c7e6fd5",
+    "sha256": "83d9b00ad3282d46a266bd3524f468f382c3f23737c05e7e9196acf838551cdf",
     "type": "eql",
-    "version": 209
+    "version": 210
   },
   "ee53d67a-5f0c-423c-a53c-8084ae562b5c": {
     "rule_name": "Shortcut File Written or Modified on Startup Folder",
@@ -14417,9 +14478,9 @@
   },
   "eea82229-b002-470e-a9e1-00be38b14d32": {
     "rule_name": "Potential Privacy Control Bypass via TCCDB Modification",
-    "sha256": "1650c91ed1f40d868155851c6a47fc4a0d7b9e3acc49ca5a3a94bf02d47454fc",
+    "sha256": "ad6a020e96bacaa9b0609d324df1d4bede5193713d80abfaa29dd4bb5b83370b",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "ef04a476-07ec-48fc-8f3d-5e1742de76d3": {
     "min_stack_version": "8.13",
@@ -14427,15 +14488,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "BPF filter applied using TC",
-        "sha256": "1c7ddc592ac0564b1dd00cf9e28b5abb2f8aab7029e47b5267efa0082a5127a2",
+        "sha256": "446f19bb2ea5d80c1e18160601ba2b38ea8e81328974575d0c5369662901dfac",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "BPF filter applied using TC",
-    "sha256": "6084cde353a59189dfa571e84e654b91e3ede46be8519e25dbf59b69aab4724d",
+    "sha256": "d93beefad79cf7690a39e4923afdc93fe4ed9d5dcd991c142db3b53b8c7edf28",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311": {
     "min_stack_version": "8.13",
@@ -14443,21 +14504,21 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Potential Linux Credential Dumping via Proc Filesystem",
-        "sha256": "5fde0d101ad60721c4369e510760dbc8596c6e42f17cccdf2857b69cd04aeeb7",
+        "sha256": "f4ee5791bd579b8b6592dbca0af0c3eae7553a3f4d087397f873f3621c85d929",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Potential Linux Credential Dumping via Proc Filesystem",
-    "sha256": "207a4a55c909e48b5ef7acf11d3790c83f34a5e398cc4094eeb9346d2dd39c97",
+    "sha256": "a6758e15fce5ea6d93d0095eea2a912b516de9b55a219b77b27a978d7f17f588",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "ef65e82c-d8b4-4895-9824-5f6bc6166804": {
     "rule_name": "Potential Container Escape via Modified notify_on_release File",
-    "sha256": "9bda21518b9733432c642587f1e1a1beb87b1651d0d838fa1cd342d16bbace04",
+    "sha256": "f08d245a0e30752adf439c2153063782f96520a044e2dda10798503db0580fcd",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "ef862985-3f13-4262-a686-5f357bbb9bc2": {
     "min_stack_version": "8.14",
@@ -14477,9 +14538,9 @@
   },
   "ef8cc01c-fc49-4954-a175-98569c646740": {
     "rule_name": "Potential Data Exfiltration Activity to an Unusual Destination Port",
-    "sha256": "90d364f8a22a46e10400502782f9e63b502856dae193ee242c9df80b475350ca",
+    "sha256": "deb097d91aed42823bd3a3204774168f890ba2423ac4e4253b9d060f32f50e79",
     "type": "machine_learning",
-    "version": 4
+    "version": 5
   },
   "f036953a-4615-4707-a1ca-dc53bf69dcd5": {
     "min_stack_version": "8.14",
@@ -14487,21 +14548,21 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Unusual Child Processes of RunDLL32",
-        "sha256": "0713731667d50b24bd145385b0d83cf8936b4173b1eb789f87e15798fb329cbe",
+        "sha256": "23beebafef0bf295f6aaf5f99044dc15f8db23dfc7a6f68d46c1cb7a9416c43b",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Unusual Child Processes of RunDLL32",
-    "sha256": "c27a1557272e16660b29e32abdf339448cda357be42a5df8ff09e7cd7089e867",
+    "sha256": "6f3bb7099a9a769fb898a67560799db56ad58c5624c016b1d46a98b1bd12e651",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "f0493cb4-9b15-43a9-9359-68c23a7f2cf3": {
     "rule_name": "Suspicious HTML File Creation",
-    "sha256": "30a4a9a823ba20654cac348d46d6ed2d266e48a105d74d2b07cd97485f45e644",
+    "sha256": "2d7643f5258ea00499f6a724d37680b18ea9e51cff76a508b397813d06cc2023",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "f06414a6-f2a4-466d-8eba-10f85e8abf71": {
     "min_stack_version": "8.15",
@@ -14509,40 +14570,40 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Administrator Role Assigned to an Okta User",
-        "sha256": "5d3602038f3d411392475d7a76fba8b7ceb34b83667e8c374ee4dd8cf01614a6",
+        "sha256": "27066b5e84a225f2e379be5ede390f38f9c8187a9c43da195fe70a2e028f5ba6",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Administrator Role Assigned to an Okta User",
-        "sha256": "5d3602038f3d411392475d7a76fba8b7ceb34b83667e8c374ee4dd8cf01614a6",
+        "sha256": "27066b5e84a225f2e379be5ede390f38f9c8187a9c43da195fe70a2e028f5ba6",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Administrator Role Assigned to an Okta User",
-    "sha256": "54113f776052fa20104f5a9fcf0ba1657432f62c148fdb06fefd8b06f63651d1",
+    "sha256": "7dec7b69a9ae716233a2cc4ee0bf5ce3e8f108b425d0be073ef6d211e7eaeb3a",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7": {
     "rule_name": "Quarantine Attrib Removed by Unsigned or Untrusted Process",
-    "sha256": "910384ce8b7a90baf6621c861b7a046f4764fa0a712b0a51e2aaf95bc8363a39",
+    "sha256": "f28f5314da6a041075848884c58593ba3bf4868e10c7789f92de570c17b6a730",
     "type": "eql",
-    "version": 109
+    "version": 110
   },
   "f0bc081a-2346-4744-a6a4-81514817e888": {
     "rule_name": "Azure Alert Suppression Rule Created or Modified",
-    "sha256": "1dce5b8c0bd067b1f048753efed2565f84b6d4c289bed2adbc7a6bf3f8a89270",
+    "sha256": "dce40c891055fa59c868c0409223dc95efa62252fab387bc182bf9ad3f30eb55",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "f0eb70e9-71e9-40cd-813f-bf8e8c812cb1": {
     "rule_name": "Execution with Explicit Credentials via Scripting",
-    "sha256": "ac32250e0d57be9cd4a514aa350f9b0b90ef286c6c75fe6f8ab0e6fc775d76cb",
+    "sha256": "ddd5f8f0b1dbde6fb7d9d9802b9190fa54d38d94c423afe4c859794d73da4720",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb": {
     "min_stack_version": "8.13",
@@ -14550,15 +14611,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Potential Remote Code Execution via Web Server",
-        "sha256": "bea6f0f6ac6a7dcc6cc8784ca4831945d99664237de3f781a9336b2a748346f7",
+        "sha256": "c678c2e4d480d9276b6bc7967e6eb21e4cac673058c59d4b70b8be8b00bbf699",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Potential Remote Code Execution via Web Server",
-    "sha256": "8067c8aa2719fd9d74fa030a8d363993b52cd2f7157cfd90c33082869504b004",
+    "sha256": "8f51b11fbb85ef6502fd4aeef70d40c1a0a94600569968410fcbcfe78e864fd2",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "f18a474c-3632-427f-bcf5-363c994309ee": {
     "min_stack_version": "8.13",
@@ -14566,27 +14627,27 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Process Capability Set via setcap Utility",
-        "sha256": "d33378c5ef77b55469ab49d5282bcb0e357dc6b4cf3f8ff308937bc39f50f0e2",
+        "sha256": "8104467acd6f82c9b69239d6bebc8750dcce6da3f4f4efbad4a57197063174ba",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Process Capability Set via setcap Utility",
-    "sha256": "d5f6b2267222943dbe00ff7f33af89e030ceabde1cadb4e0ee50680d0305a6b2",
+    "sha256": "c7c1780ea2c3381899f8df2aca24d636619832fa7d0cc4a7637a1b519513a2b5",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "f1a6d0f4-95b8-11ed-9517-f661ea17fbcc": {
     "rule_name": "Forwarded Google Workspace Security Alert",
-    "sha256": "da7ef3b91f3643cdf38700c894afdb9c990e17ed9711f5e4a7e4133589c98b04",
+    "sha256": "53a99b49697dcd944871a7610cafdbf834659d68f5631056a35cc52f1c8e1aab",
     "type": "query",
-    "version": 3
+    "version": 4
   },
   "f2015527-7c46-4bb9-80db-051657ddfb69": {
     "rule_name": "AWS RDS DB Instance or Cluster Password Modified",
-    "sha256": "4e740008509defdc52f3ce580a43a0c02b9f679ad77ebf0f4136253adef5b1ec",
+    "sha256": "684a674daf52a0659d98f70c6854676100390d6c0cc41568e4450ec8568d1115",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "f243fe39-83a4-46f3-a3b6-707557a102df": {
     "min_stack_version": "8.14",
@@ -14606,9 +14667,9 @@
   },
   "f24bcae1-8980-4b30-b5dd-f851b055c9e7": {
     "rule_name": "Creation of Hidden Login Item via Apple Script",
-    "sha256": "1d2b9d1b4fb9b805f30bc47377d70694f4ecd0704dfc2df0c47459605af6d2b3",
+    "sha256": "ef281309a553487eec147442e89518ebb16d626f9c63c5ffd94663b7a1e6fd89",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "f28e2be4-6eca-4349-bdd9-381573730c22": {
     "min_stack_version": "8.13",
@@ -14616,29 +14677,29 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Potential OpenSSH Backdoor Logging Activity",
-        "sha256": "54bc98f1c6f0db859bc9db57ce3fa7033db199f814bbc55ce03bc6940bd8efe2",
+        "sha256": "d34b536f30334984723914ab4d44bef45a48785b1ce33846ea6fa8169f40a9bf",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "Potential OpenSSH Backdoor Logging Activity",
-    "sha256": "809020a2abcd5cbc4905175fa9c340ce4d03a5badb092749e5582d500fe84741",
+    "sha256": "6779913c9f6aa81caa57d89b94072b01b0638454d4faaa9433f37e902cd65b5a",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "f2c3caa6-ea34-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Malicious File - Detected - Elastic Defend",
-    "sha256": "7b9a35f4a8a0e47cd62338e301fda982b665581e69582f6f07a420516a7c5d81",
+    "sha256": "b483ff55b947e2e93555fb3aa39f1789262e4edb4e5694c10bc19b8a2c486dbf",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "f2c653b7-7daf-4774-86f2-34cdbd1fc528": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Bedrock Invocations without Guardrails Detected by a Single User Over a Session",
-    "sha256": "c38cb3e116786c25852f4790593e82bfaff12642ff456bb3fa6fd5dab8596b3c",
+    "sha256": "42cba0422e9398684922e14a9f8bcb52726504673ccd9369a94911561994ab23",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "f2c7b914-eda3-40c2-96ac-d23ef91776ca": {
     "min_stack_version": "8.14",
@@ -14646,22 +14707,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "SIP Provider Modification",
-        "sha256": "e7285256bf0c38b5fbb2b1c6f458037f9fed88e1e8238438993dd0b6347aa48e",
+        "sha256": "3171aedb786a6c4346ca2d6e875c736ea14d23e12331aeea3c994e5dca963238",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "SIP Provider Modification",
-        "sha256": "d738dfc708658d71ae14be394ef74073c038935186dcd52452963824dcff6832",
+        "sha256": "29662765828508b5d2ddf5905237089fde83513f4c34bd44c93f0e27849d77c3",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "SIP Provider Modification",
-    "sha256": "ee278465be6f3dbb091ce5d5a2f86ef626accfc7c850b1fa069f00a2fd0b4b72",
+    "sha256": "e0ac3c29d4a3e05055331a8c99eae6dec675fdf4637d6585c80557b3dc879681",
     "type": "eql",
-    "version": 310
+    "version": 311
   },
   "f2f46686-6f3c-4724-bd7d-24e31c70f98f": {
     "min_stack_version": "8.14",
@@ -14669,28 +14730,28 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "LSASS Memory Dump Creation",
-        "sha256": "7e795307c7ee80d811f2bdbe317f0b5e563dbd232e6ff795ecb0a1f21dd1e2c4",
+        "sha256": "f8cbd6a379d828f24d80c53ac9f923bccfcf5f6db7532cf8567c55c09446dae2",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "LSASS Memory Dump Creation",
-        "sha256": "14a9d741acb3030e8466bf9a59a206544298e89f5fc3fee49bf83f99a7e052fd",
+        "sha256": "c0268c1e96cb8a7dfec0cb7f803ec42df015cf80a71719b1a544cc4285ed0087",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "LSASS Memory Dump Creation",
-    "sha256": "254a89261a7919cd601e7aa8a8c9aafa993f9a2f38062b4f3f6b1839c39a0993",
+    "sha256": "accf15ffd7f736c713d38e6f024889430d4031685a6588588249bb092332d720",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "f30f3443-4fbb-4c27-ab89-c3ad49d62315": {
     "rule_name": "AWS RDS Instance Creation",
-    "sha256": "3f5bde898da930f0ca76c88c4f89512b9f7ec40d10c291fc472d909c5ef5a166",
+    "sha256": "3bb082fe7f035d7f0edb310d42459b011a6ecb97c9b46e008e1c1434840e95a9",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "f33e68a4-bd19-11ed-b02f-f661ea17fbcc": {
     "rule_name": "Google Workspace Object Copied to External Drive with App Consent",
@@ -14700,9 +14761,9 @@
   },
   "f3403393-1fd9-4686-8f6e-596c58bc00b4": {
     "rule_name": "Machine Learning Detected a DNS Request Predicted to be a DGA Domain",
-    "sha256": "5111cc2b59ff5a00ad2e2d02625d13fb2da0a6e5c8a7c7cf41cb0c023d1f0321",
+    "sha256": "84a652c9dcb5ab611cd8888bcb7def8d9e6ba1a10712c28017fe35cceb6d07de",
     "type": "query",
-    "version": 5
+    "version": 6
   },
   "f3475224-b179-4f78-8877-c2bd64c26b88": {
     "min_stack_version": "8.14",
@@ -14710,46 +14771,46 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "WMI Incoming Lateral Movement",
-        "sha256": "109358ad6d085e83bf9097861e3961e3e5afbbbf94504500826ad12ea1e6cf0e",
+        "sha256": "bf322fd08b8f2bfd47228ee56470b9301a500aa181f75f9594d50ed79033e3a5",
         "type": "eql",
-        "version": 110
+        "version": 111
       }
     },
     "rule_name": "WMI Incoming Lateral Movement",
-    "sha256": "f68bad409924e59b8443d6a7bfa105b2b48cb4d88da36172d95d7094cb3a3375",
+    "sha256": "3ec45777f4c943a7de5082d971bee5996e5cf726ae6f42fc987b77c52f13bf8a",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "f37f3054-d40b-49ac-aa9b-a786c74c58b8": {
     "rule_name": "Sudo Heap-Based Buffer Overflow Attempt",
-    "sha256": "631c70d2bd6a2e4b8162193c9ccb972b673d291a842d7006e0a14643ce29341c",
+    "sha256": "ee7bf6773bfbc573d11e5c0660564ca53d3a9b917ec5f64c87a3b7e9d4b86fa7",
     "type": "threshold",
-    "version": 104
+    "version": 105
   },
   "f3818c85-2207-4b51-8a28-d70fb156ee87": {
     "rule_name": "Suspicious Network Connection via systemd",
-    "sha256": "45c7e70c63f0babc04075bb7fcacaf276c43f3f76f27788e95a22486dc947598",
+    "sha256": "d1171e16d5e8259411aec72aea33cb1c2682fd2d4af82e789944805eceac591d",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "f3e22c8b-ea47-45d1-b502-b57b6de950b3": {
     "rule_name": "Threat Intel URL Indicator Match",
-    "sha256": "cf0a030c5e18e30adb504961ef9b25c02002c86f068800908ed13e0f329267de",
+    "sha256": "d523f9e7b0b0a672bde61148eda10896934ae0f610892a879adf5a29cd789057",
     "type": "threat_match",
-    "version": 7
+    "version": 8
   },
   "f401a0e3-5eeb-4591-969a-f435488e7d12": {
     "min_stack_version": "8.14",
     "rule_name": "Remote Desktop File Opened from Suspicious Path",
-    "sha256": "cf963b5d775862505a178cb58178b33fb23107afcc00e561160961a865e46b4f",
+    "sha256": "903fd6d4ce8c22d0a4ed7c11940e77eca417f1bc8b231482bebb4e46f6aad27d",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "f41296b4-9975-44d6-9486-514c6f635b2d": {
     "rule_name": "Potential curl CVE-2023-38545 Exploitation",
-    "sha256": "a4f60de34a9b8854d098412627c483a602372a1752481e4bb94ee32edabdfeb4",
+    "sha256": "75349fcdfe56a8631cc9346fd2f8623691f57c7e7fa533feab6431c354a3b8e8",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c": {
     "min_stack_version": "8.14",
@@ -14757,28 +14818,28 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Persistence via Microsoft Office AddIns",
-        "sha256": "0a7bcf99db3af18ca1936e60cad4e3c6dcc4b560f8173850784204f8e4a631cc",
+        "sha256": "d8fa297a02bd05755728ee6202070fef2ebc8f2f5ae3d46617d78034d80e24bd",
         "type": "eql",
-        "version": 108
+        "version": 109
       },
       "8.13": {
         "max_allowable_version": 307,
         "rule_name": "Persistence via Microsoft Office AddIns",
-        "sha256": "c065074afa1efd59796f42921ce27c145b88b963e7472fa5c5269c74503e3647",
+        "sha256": "111139bb2a9a56c179012f91b0e217c614e1527fc3eb2a4b713943763e5a7a40",
         "type": "eql",
-        "version": 208
+        "version": 209
       }
     },
     "rule_name": "Persistence via Microsoft Office AddIns",
-    "sha256": "0ceb15eaac8188f45c14c3dd7bead9ba70e09eb4b5f51deb6b9a8c126b63c78b",
+    "sha256": "67cc9ea0dae5af83aac83f80454998408a24eeb1e521ae441963e51278f54b7a",
     "type": "eql",
-    "version": 308
+    "version": 309
   },
   "f48ecc44-7d02-437d-9562-b838d2c41987": {
     "rule_name": "Creation or Modification of Pluggable Authentication Module or Configuration",
-    "sha256": "28451a124942aacc3132dc4aa9cf07779c9879d2e81581d9a09e0715aa18514d",
+    "sha256": "6f77b4339b6982feae60ae38491e22c8bf8931801527efe93368ab2d675017c6",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "f494c678-3c33-43aa-b169-bb3d5198c41d": {
     "min_stack_version": "8.14",
@@ -14792,29 +14853,29 @@
       }
     },
     "rule_name": "Sensitive Privilege SeEnableDelegationPrivilege assigned to a User",
-    "sha256": "a501daeafd36d21146d80fd784cd66a942aba32df467a451a98e26818a2e661b",
+    "sha256": "98da37735724187372bf1f311df3eb82e1dcc9d8792eb8c6faa5d20cd518c69d",
     "type": "query",
-    "version": 213
+    "version": 214
   },
   "f4b857b3-faef-430d-b420-90be48647f00": {
     "min_stack_version": "8.13",
     "rule_name": "OpenSSL Password Hash Generation",
-    "sha256": "effca7dd9c856bc18468aeecb9135470738b7c71ceceb60943c78cbeeb3f8f8c",
+    "sha256": "04b4c9ecf43e0acf3fa6b298371accc63a200e07eb118a4d5edc9430aaca263a",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "f4c2515a-18bb-47ce-a768-1dc4e7b0fe6c": {
     "min_stack_version": "8.13",
     "rule_name": "AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request",
-    "sha256": "e018ec0346e1abac5468b4f741a4a3036311473e101a7ddf11bca9b702e142c0",
+    "sha256": "67cfc341651734d5dc809fca49d66ce14a80f2ba8535da9515f18242adfca0cc",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "f4d1c0ac-aedb-4063-9fa6-cc651eb5e6ee": {
     "rule_name": "DPKG Package Installed by Unusual Parent Process",
-    "sha256": "c9f84cce8696eb7c2dc198d566da5e106e018e6fe6cd9e016fd243ae72c741b4",
+    "sha256": "aacfd52ed0aee2049e2ec00c2475153a185d83bbdd407232e9012a142292ac95",
     "type": "new_terms",
-    "version": 2
+    "version": 3
   },
   "f52362cd-baf1-4b6d-84be-064efc826461": {
     "rule_name": "Linux Restricted Shell Breakout via flock Shell evasion",
@@ -14824,9 +14885,9 @@
   },
   "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73": {
     "rule_name": "Suspicious Data Encryption via OpenSSL Utility",
-    "sha256": "bdf4940185721379f94bfd3a1c76f556b73371c2533f71f9d815eb09cebf35bc",
+    "sha256": "89e1134e735b229a7ad239acdb9c85a68c40b34f96a19fe908c12ded3f7e5410",
     "type": "eql",
-    "version": 6
+    "version": 7
   },
   "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc": {
     "min_stack_version": "8.14",
@@ -14853,9 +14914,9 @@
   },
   "f5488ac1-099e-4008-a6cb-fb638a0f0828": {
     "rule_name": "SSH Connection Established Inside A Running Container",
-    "sha256": "acfdb1c9d79a1ed5b532921e9010c1184da0de54b516f1c0505265cb48c135b7",
+    "sha256": "9d8c510e4b95da8e5072e5d93be80f049c9f4ed253d40845f7ac67920ddf4158",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "f580bf0a-2d23-43bb-b8e1-17548bb947ec": {
     "min_stack_version": "8.14",
@@ -14863,22 +14924,22 @@
       "8.12": {
         "max_allowable_version": 107,
         "rule_name": "Rare SMB Connection to the Internet",
-        "sha256": "0994ac029d0e0256082d0a61be3696ee4a982af12e3efc1a96d975cb575ce7c2",
+        "sha256": "1a52a9efcabc5597110829afe735c6831cc9b2e64ed6169e8e81459e8669c83c",
         "type": "new_terms",
-        "version": 8
+        "version": 9
       },
       "8.13": {
         "max_allowable_version": 207,
         "rule_name": "Rare SMB Connection to the Internet",
-        "sha256": "c40aac172f1cdf1b7ccb004c0801fc47510425f767724967677d2084cdbf562d",
+        "sha256": "0002a051fa57648d20e54eaded6c44a1f3bf1c307e7e8ec68200ff562fd22790",
         "type": "new_terms",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Rare SMB Connection to the Internet",
-    "sha256": "d22f0fbb911966cb407185b46199efd05573dd405193ce51ed521b9b72d30289",
+    "sha256": "b913881e92e1a38bf6737390fd81a1138292cbd48aa0fb8c2d3c85957650ad7a",
     "type": "new_terms",
-    "version": 208
+    "version": 209
   },
   "f5861570-e39a-4b8a-9259-abd39f84cb97": {
     "min_stack_version": "8.14",
@@ -14918,15 +14979,15 @@
       "8.12": {
         "max_allowable_version": 105,
         "rule_name": "Setcap setuid/setgid Capability Set",
-        "sha256": "45c7bf0dabebd2c0f6761522c9e451ba672ebe426611de5c126c314fc0006ffd",
+        "sha256": "3ae5e32591f980bca7b3064fb9a680b9329a75f4ddc4dc888391659a4c1f654f",
         "type": "eql",
-        "version": 6
+        "version": 7
       }
     },
     "rule_name": "Setcap setuid/setgid Capability Set",
-    "sha256": "01204cf3f85db104581872555673b018a1419abdbcce249e52f10ae764026cf8",
+    "sha256": "6ecb726bdefbe3899c1e739affa928cfbfd0e6eba44de225efcc3d904dab6007",
     "type": "eql",
-    "version": 106
+    "version": 107
   },
   "f5d9d36d-7c30-4cdb-a856-9f653c13d4e0": {
     "min_stack_version": "8.14",
@@ -14934,21 +14995,21 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Suspicious Windows Process Cluster Spawned by a Parent Process",
-        "sha256": "6ee5d0b1cbc2f8f3b11a2689ab4c8e4651d061d0f7728c67b6b86642eb5afc60",
+        "sha256": "a3bc6cca188a55aa33021f1b9c7d396bdde78a3350f1c4fabb974a4fcffa5ca4",
         "type": "machine_learning",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Suspicious Windows Process Cluster Spawned by a Parent Process",
-    "sha256": "cd92b6d8bfeeb796c8aa85d4173fc81fada02dcee2eba62947319524f50b8bc3",
+    "sha256": "b133ffedcacb83e511e320e25d6f4afc9f2d638fa12afbe470fab88a6009d07a",
     "type": "machine_learning",
-    "version": 107
+    "version": 108
   },
   "f5fb4598-4f10-11ed-bdc3-0242ac120002": {
     "rule_name": "Masquerading Space After Filename",
-    "sha256": "5f2226e282c0f810754301af6a21ee8303cfc152b5003db4500df84b536cc373",
+    "sha256": "05d412610d0acf976c64885d739c2519d44630cc8036b7dba0c8533c92385d15",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "f638a66d-3bbf-46b1-a52c-ef6f39fb6caf": {
     "rule_name": "Account or Group Discovery via Built-In Tools",
@@ -14981,9 +15042,9 @@
   },
   "f6652fb5-cd8e-499c-8311-2ce2bb6cac62": {
     "rule_name": "AWS RDS DB Instance or Cluster Deletion Protection Disabled",
-    "sha256": "e4f93dc05162bf6cad753a1327db0e023df793034c6204d0b08a1d15f6d23b4b",
+    "sha256": "aa4abbe944c50eb6c464d33d4880bedbb1778ff5139693b5f95e1f81e54a05d4",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "f675872f-6d85-40a3-b502-c0d2ef101e92": {
     "min_stack_version": "8.14",
@@ -15010,15 +15071,15 @@
   },
   "f683dcdf-a018-4801-b066-193d4ae6c8e5": {
     "rule_name": "SoftwareUpdate Preferences Modification",
-    "sha256": "23425b32c0a7615768bc200a5112ac8cddf8adf9387d1c01638d9da18edc500b",
+    "sha256": "076beef00e93e7c5cea8221f52feed6734107ad9cfb9a62a293d50a066132e1d",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "f6d07a70-9ad0-11ef-954f-f661ea17fbcd": {
     "rule_name": "AWS IAM Customer-Managed Policy Attached to Role by Rare User",
-    "sha256": "791121ea6aec69d7039ecb415a62b0a87915433516a225fa0103e30dc1fb3eb9",
+    "sha256": "de4cb537409466e76a7f865cb93e0842a6fc8f04b9402caaa3b8f56928916711",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "f75f65cf-ed04-48df-a7ff-b02a8bfe636e": {
     "rule_name": "System Hosts File Access",
@@ -15028,9 +15089,9 @@
   },
   "f766ffaf-9568-4909-b734-75d19b35cbf4": {
     "rule_name": "Azure Service Principal Credentials Added",
-    "sha256": "93799b4dd788cc7cc2a439cc2a75f129676cafe866903105bfe880aa4a466103",
+    "sha256": "901f5b0b8cf2e223bd55f2b15863c0285e7df7dbae24b8ae528572bd52df13a6",
     "type": "query",
-    "version": 102
+    "version": 103
   },
   "f772ec8a-e182-483c-91d2-72058f76a44c": {
     "rule_name": "AWS CloudWatch Alarm Deletion",
@@ -15040,15 +15101,15 @@
   },
   "f7769104-e8f9-4931-94a2-68fc04eadec3": {
     "rule_name": "SSH Authorized Keys File Modified Inside a Container",
-    "sha256": "7447ba66f5bb3a7f75ebfa0ec16f2c79965e3653b03fc3f3a06ec4e7dc27ece8",
+    "sha256": "dbb02018892869ad01ea50413f348fb8681007ab55495ec2669108a301956156",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "f7a1c536-9ac0-11ef-9911-f661ea17fbcd": {
     "rule_name": "AWS IAM Create User via Assumed Role on EC2 Instance",
-    "sha256": "9d9ea4b2bef0475b57635433aa6c30663d72eb3226baf7e94587e17374f9c08e",
+    "sha256": "135091eba79744ed7a55ef7e0825fb4a5189f443b6940d9f322b755d28b98d0f",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "f7c4dc5a-a58d-491d-9f14-9b66507121c0": {
     "min_stack_version": "8.14",
@@ -15056,28 +15117,28 @@
       "8.12": {
         "max_allowable_version": 211,
         "rule_name": "Persistent Scripts in the Startup Directory",
-        "sha256": "3e8f291e2a3c067b9b355896116b130d4aea64f67e03fe8b2c4551ddfb9c83ac",
+        "sha256": "3bb11d5684b0514f8d1a5326d1645b8787ea37ae7731db6df5e7d94945f6ef1c",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 311,
         "rule_name": "Persistent Scripts in the Startup Directory",
-        "sha256": "19dabb4cdeb3093420fb56b9c94ca6687ea7ee3479e605b8b9f331cdff2466c3",
+        "sha256": "4cbd3242743b94fc54ec1eff6658bdf2a9009dad93fccbc3354272cc5c10196e",
         "type": "eql",
-        "version": 212
+        "version": 213
       }
     },
     "rule_name": "Persistent Scripts in the Startup Directory",
-    "sha256": "07caba511c046edeb032f0a4b75979d94cf1cadf75a7bfea159e175815bb0c48",
+    "sha256": "0265f205075afb8a44fcc9339b9b8e7819b11ee960a7fcadff4ef19c40407944",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "f7c70f2e-4616-439c-85ac-5b98415042fe": {
     "rule_name": "Potential Privilege Escalation via Linux DAC permissions",
-    "sha256": "c019dc62df736fd44d9e738556bb88927bb5a3381f6dd541d60087ba788d3255",
+    "sha256": "6a6d4fc7401921ef468189f6dbd0c74591dd1d15fcab4c0f5b4033610123be2c",
     "type": "new_terms",
-    "version": 3
+    "version": 4
   },
   "f81ee52c-297e-46d9-9205-07e66931df26": {
     "min_stack_version": "8.14",
@@ -15085,34 +15146,34 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "Microsoft Exchange Worker Spawning Suspicious Processes",
-        "sha256": "7f50567407f055ba5fe3ae2e6d27cdcffac7fd9f9eb3dedda702f6f9a3fb15ec",
+        "sha256": "e36c1fdb2b34568b5431017b6d35a86a116bc34c7b9af52fbfeaf4548233dac3",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "Microsoft Exchange Worker Spawning Suspicious Processes",
-        "sha256": "c4a613fb04e9f97b6a884009449a139ee5a135556512ca5bf96bb5b803db7d8d",
+        "sha256": "a577211254c57b0fba47713de661ab81bc197366995a8d14d939f8667dde3ffa",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "Microsoft Exchange Worker Spawning Suspicious Processes",
-    "sha256": "41f949b2f55eaabf986b67891e7037a89ce1a7964a42ef6e88352b92d52778bb",
+    "sha256": "fc3a25445b0ecc88878661c840092042b33a21a6b66a2307253219ea04c67913",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "f85ce03f-d8a8-4c83-acdc-5c8cd0592be7": {
     "rule_name": "Suspicious Child Process of Adobe Acrobat Reader Update Service",
-    "sha256": "7041f9420e055d9a272d6c1c7c3ab02fa9843c80df047af4545b3a625f70fa87",
+    "sha256": "402f5404fef876bbbd2aba0a471857bb32c2a7c711af599817c9834d0db5c2be",
     "type": "query",
-    "version": 106
+    "version": 107
   },
   "f86cd31c-5c7e-4481-99d7-6875a3e31309": {
     "rule_name": "Printer User (lp) Shell Execution",
-    "sha256": "187045fe170ec5d73a01ae484c2beb785ba6d685cf6973c52d6dd63393600eaa",
+    "sha256": "deffcca6a713e80f7c6197c17ee1be6a9f98b582e6c922548acf9ab45a49f882",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "f874315d-5188-4b4a-8521-d1c73093a7e4": {
     "min_stack_version": "8.14",
@@ -15140,9 +15201,9 @@
   "f87e6122-ea34-11ee-a417-f661ea17fbce": {
     "min_stack_version": "8.16",
     "rule_name": "Malicious File - Prevented - Elastic Defend",
-    "sha256": "9b4dc0fb3aa575631ab1f19f6059c644319158dc055b3ebf6dac4148d593c119",
+    "sha256": "67ffe83c5432e13fcf6b7e4cf476f32cfa6c44e604a32fe07f2cbb1ac508042b",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "f8822053-a5d2-46db-8c96-d460b12c36ac": {
     "min_stack_version": "8.14",
@@ -15150,15 +15211,15 @@
       "8.12": {
         "max_allowable_version": 103,
         "rule_name": "Potential Active Directory Replication Account Backdoor",
-        "sha256": "2a62a3a177beecf69edfd14fc1bbccd14a17f2f6228349c6766b2dc90ca8fa03",
+        "sha256": "de3cf59b7dd66998abe201a8eaf36dbba367e448780f8d30c428d89610b5c18f",
         "type": "query",
-        "version": 4
+        "version": 5
       }
     },
     "rule_name": "Potential Active Directory Replication Account Backdoor",
-    "sha256": "9302b94451cee85bf6f7911e5a81caad7dad04e6d5d9271549085ee41f25cfe5",
+    "sha256": "bed1ed023c04637d3664efd5fbb73d3aa0cfea24257dfb18a925fea3d2cbef3f",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "f909075d-afc7-42d7-b399-600b94352fd9": {
     "min_stack_version": "8.14",
@@ -15166,15 +15227,15 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Untrusted DLL Loaded by Azure AD Sync Service",
-        "sha256": "d8dfe4f7a77d80cdf2454af910950a75588c1c7ad2eb770140cdf8c992dcf6ea",
+        "sha256": "e26f15abdf56aa1b61415ba7dc51da814455d36335a30451a9089c7e28074d99",
         "type": "eql",
-        "version": 1
+        "version": 2
       }
     },
     "rule_name": "Untrusted DLL Loaded by Azure AD Sync Service",
-    "sha256": "c4508dc7b6251d648197e8d7704c8fdafc973a1a99006c1475d76e67e7d195d3",
+    "sha256": "f38f93c88e156a79c010dfad2f862d22927fc7fef7c08ca2dfa59a780b3d8e9b",
     "type": "eql",
-    "version": 101
+    "version": 102
   },
   "f94e898e-94f1-4545-8923-03e4b2866211": {
     "min_stack_version": "8.13",
@@ -15194,15 +15255,15 @@
   },
   "f9590f47-6bd5-4a49-bd49-a2f886476fb9": {
     "rule_name": "Unusual Linux Network Configuration Discovery",
-    "sha256": "d2f746819d1c581d86f596e696374d72b6b6ef60f9710488f0f34085b80a3e59",
+    "sha256": "d11d9b7a7104ede9ec52c99b7a22fda51997f927c44ba71a8317a0870bf39b4d",
     "type": "machine_learning",
-    "version": 105
+    "version": 106
   },
   "f95972d3-c23b-463b-89a8-796b3f369b49": {
     "rule_name": "Ingress Transfer via Windows BITS",
-    "sha256": "85e0e9eb2f56d40ea5aa97a05e3c9ef70749ffbf72276dfe626c72d1889217c6",
+    "sha256": "a65eed2cc5b097a57b4e7baac0a286e05e9272a546e2fa4ef98c84b45efbaccc",
     "type": "eql",
-    "version": 8
+    "version": 9
   },
   "f97504ac-1053-498f-aeaa-c6d01e76b379": {
     "min_stack_version": "8.14",
@@ -15210,22 +15271,22 @@
       "8.12": {
         "max_allowable_version": 101,
         "rule_name": "Browser Extension Install",
-        "sha256": "8d12e1186966462c8fa942c5ea6e8bb556922c22f3a8426371112487df44ca7a",
+        "sha256": "13264d82b596b30f4a39bca88800139df7d59f7e5714ac3294aecb8adb693f2b",
         "type": "eql",
-        "version": 2
+        "version": 3
       },
       "8.13": {
         "max_allowable_version": 201,
         "rule_name": "Browser Extension Install",
-        "sha256": "33fea2e19640fd39808aae6bf7267174995cc0a7e7973f07a4b21fbb2b842970",
+        "sha256": "2813c84680c133570b552af8010cab5df5b2cf9ce045b7cb05716d286729bcdf",
         "type": "eql",
-        "version": 102
+        "version": 103
       }
     },
     "rule_name": "Browser Extension Install",
-    "sha256": "cdd8f7c92285ec6406bbb7e06fef02eb1458895deda96a9bbd299be408be2026",
+    "sha256": "420b3c2fb3cad25f5312065eb38e2944b8220eac1111dba2dd1088b95141b687",
     "type": "eql",
-    "version": 202
+    "version": 203
   },
   "f9790abf-bd0c-45f9-8b5f-d0b74015e029": {
     "min_stack_version": "8.14",
@@ -15233,15 +15294,15 @@
       "8.12": {
         "max_allowable_version": 109,
         "rule_name": "Privileged Account Brute Force",
-        "sha256": "e5f51f4e2b82a0b05641ba03fe55a1433a719fe509d21bb8023368ef4e81425e",
+        "sha256": "a3e155da55738446b14a3519a8631b9d6a3f2a2420e7abea9743574cfa5a699f",
         "type": "eql",
-        "version": 10
+        "version": 11
       }
     },
     "rule_name": "Privileged Account Brute Force",
-    "sha256": "8237fdea989fedadcbe0c3d264d0f2e33c15879386f11721c8effccb0b5a1d28",
+    "sha256": "d609cef02e743a187baf0068f42fe95b28bef7bee1d26bb067e3d09188bf7281",
     "type": "eql",
-    "version": 110
+    "version": 111
   },
   "f994964f-6fce-4d75-8e79-e16ccc412588": {
     "min_stack_version": "8.15",
@@ -15249,22 +15310,22 @@
       "8.12": {
         "max_allowable_version": 307,
         "rule_name": "Suspicious Activity Reported by Okta User",
-        "sha256": "dcd8ed2631e7ec313bd453ed2a9634447c11194385e6c1af66ddf01b0c22eb7b",
+        "sha256": "fa7f7c30177462dd01a22cc1653006645eec2ec9550c0e05cf9b058786f7fe47",
         "type": "query",
-        "version": 208
+        "version": 209
       },
       "8.14": {
         "max_allowable_version": 408,
         "rule_name": "Suspicious Activity Reported by Okta User",
-        "sha256": "dcd8ed2631e7ec313bd453ed2a9634447c11194385e6c1af66ddf01b0c22eb7b",
+        "sha256": "fa7f7c30177462dd01a22cc1653006645eec2ec9550c0e05cf9b058786f7fe47",
         "type": "query",
-        "version": 309
+        "version": 310
       }
     },
     "rule_name": "Suspicious Activity Reported by Okta User",
-    "sha256": "aacb2192034b6b4b84c04bf19680030dac7c1101a41ba402d20ac154cf89f317",
+    "sha256": "9f8a0e0868d43b262c98653adb7bed57c23c2509b0fec88ebeb33b1a92853293",
     "type": "query",
-    "version": 409
+    "version": 410
   },
   "fa01341d-6662-426b-9d0c-6d81e33c8a9d": {
     "min_stack_version": "8.14",
@@ -15272,34 +15333,34 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Remote File Copy to a Hidden Share",
-        "sha256": "b5403c097f3e0017c48a4a4c0745a2c73e8cf2922e3c43377e79ecc1dd37eeca",
+        "sha256": "38cd36c0e10b5e71de73e548f13243d29e06b1bab2ca10c74ae875da1606664d",
         "type": "eql",
-        "version": 112
+        "version": 113
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Remote File Copy to a Hidden Share",
-        "sha256": "c57ede22981de8ec65a677f491d04e110c3dcbe758924fc37fc34e2b031677a2",
+        "sha256": "2ec223a448f81f94a8f428864b7dc4f7b173fb01a997740f6f29143c0496219c",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Remote File Copy to a Hidden Share",
-    "sha256": "e2887448f525e4d2fc06229b8d743d4dca3c5ec090ff66e1b0395b0a14a6ffe1",
+    "sha256": "4300b10c7504d0440412581634a019e1a6e58f0db412301ee1b20b04516532bf",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "fa210b61-b627-4e5e-86f4-17e8270656ab": {
     "rule_name": "Potential External Linux SSH Brute Force Detected",
-    "sha256": "6dda8a2bc03a2f1abf5953add4cec3b8260ed538e2600de67de2100cad5ddcda",
+    "sha256": "c8d1d95ef6525a3da18e35d890b332565c8b7453a7c89f16c87080264772d9ac",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "fa3a59dc-33c3-43bf-80a9-e8437a922c7f": {
     "rule_name": "Potential Reverse Shell via Suspicious Binary",
-    "sha256": "9be49e4bfd023d805ed674227d4aa1c27340b638a40b63092a2d82f22f29d52c",
+    "sha256": "cd83e2dee4122108d811abf45e532d0dc27fdac8ec1673c2ad306e85c97819f2",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "fa488440-04cc-41d7-9279-539387bf2a17": {
     "min_stack_version": "8.14",
@@ -15307,22 +15368,22 @@
       "8.12": {
         "max_allowable_version": 108,
         "rule_name": "Suspicious Antimalware Scan Interface DLL",
-        "sha256": "f58df538eeccfc02fa924db986802d071a12e0f586a6d6af10a2da58c19243cc",
+        "sha256": "e416bd900c26017a9a2e60990ee7ae09ced3df13618bbbc45b29fb2340de74d1",
         "type": "eql",
-        "version": 10
+        "version": 11
       },
       "8.13": {
         "max_allowable_version": 312,
         "rule_name": "Suspicious Antimalware Scan Interface DLL",
-        "sha256": "e76797913ea8f33de2a02341ab5af40b4efd31ccdadbb67daf8fcdf5281830bc",
+        "sha256": "34eeb28ee7412555964397a4969d1d55098b05a4107dd4330ea8ac5dd242d54e",
         "type": "eql",
-        "version": 213
+        "version": 214
       }
     },
     "rule_name": "Suspicious Antimalware Scan Interface DLL",
-    "sha256": "d31107882201846433a5c59aa2d72a82cb14836b79e86eb8a93521116638d30a",
+    "sha256": "d4eaa3dfb8b078f3a464ad91d4dcd5424f2faf343c977d6dd7df44cc08e87065",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "fac52c69-2646-4e79-89c0-fd7653461010": {
     "min_stack_version": "8.13",
@@ -15330,15 +15391,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Potential Disabling of AppArmor",
-        "sha256": "e045c3b1003a5042d8b759b06796c80d5f32b4a56185301e5de5bcc2f1d4544e",
+        "sha256": "dcc5486dac299e23f474eb39e2b40231213ec061f4460cc66cbd25bc8ea1b927",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Potential Disabling of AppArmor",
-    "sha256": "01508640f0055cb89a305cbdf1ef43cd6f104545bfdc21eea76eaaf2e7e7909d",
+    "sha256": "dd0c697b12d206fc9f3004381077e6f7a2367ed6acc0112544ccd443afccb2f3",
     "type": "eql",
-    "version": 107
+    "version": 108
   },
   "fb01d790-9f74-4e76-97dd-b4b0f7bf6435": {
     "rule_name": "Potential Masquerading as System32 DLL",
@@ -15352,15 +15413,15 @@
       "8.12": {
         "max_allowable_version": 207,
         "rule_name": "Network Connection via Registration Utility",
-        "sha256": "cb733e3ad55b691ce6c736d0ab0c7b2f050a61f7c333533ad68e45882396c78d",
+        "sha256": "b4eed2ddeb40f2bbedc702c4789e5748c0f303fb263208a2bdcd2974c12346b5",
         "type": "eql",
-        "version": 108
+        "version": 109
       }
     },
     "rule_name": "Network Connection via Registration Utility",
-    "sha256": "8aae81ad83c8f0921e01112594259350cacae84e8b7a5991c5774c2b12228d7c",
+    "sha256": "c04bf7494ed4c20a8a87bbe9bb3f2876b8e92b7af292dfac1b2d2f847593dcad",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "fb0afac5-bbd6-49b0-b4f8-44e5381e1587": {
     "min_stack_version": "8.13",
@@ -15368,15 +15429,15 @@
       "8.12": {
         "max_allowable_version": 203,
         "rule_name": "High Number of Cloned GitHub Repos From PAT",
-        "sha256": "3fcf7a11e62e1413f109707eddf5ca8210aa4788b88623b7f1a905fb84193234",
+        "sha256": "1b149111089ed10df74c8975a4801b321f429cbc00bddf77eebd2f154d5355e0",
         "type": "threshold",
-        "version": 104
+        "version": 105
       }
     },
     "rule_name": "High Number of Cloned GitHub Repos From PAT",
-    "sha256": "aa706a6df1832c500f882ba46028eb2732a866b5e6335c33fd62c18d90a7d870",
+    "sha256": "babeac41d262653f7ef7c8bddf78a7573fb7894ae7b8c2c9b3f48fc07ef6452c",
     "type": "threshold",
-    "version": 204
+    "version": 205
   },
   "fb9937ce-7e21-46bf-831d-1ad96eac674d": {
     "rule_name": "Auditd Max Failed Login Attempts",
@@ -15386,15 +15447,15 @@
   },
   "fbd44836-0d69-4004-a0b4-03c20370c435": {
     "rule_name": "AWS Configuration Recorder Stopped",
-    "sha256": "c7844572d3cc0d0be4f3674e5a404de4a1b409abe2c02b40ca56300b06425004",
+    "sha256": "7953f99ece9b3629d330947f9c59294d7504c35d5eb9415e8410833f95063b4d",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "fc5105ce-2584-48b6-a0cf-9ace7eeffd3c": {
     "rule_name": "Process Started with Executable Stack",
-    "sha256": "817c1bcd002aee4e4e20b0ec867435b39e734957b1032925a405161c91e1ff2d",
+    "sha256": "0463c0b25ecbc17c558c90dfd80f29d64776de9fba2451a8768448d09293b378",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "fc7c0fa4-8f03-4b3e-8336-c5feab0be022": {
     "min_stack_version": "8.14",
@@ -15402,22 +15463,22 @@
       "8.12": {
         "max_allowable_version": 208,
         "rule_name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer",
-        "sha256": "66652b44a53ed252944d30e221056e1a86dd85654176778bffc526603112d74e",
+        "sha256": "59543020be10655d8e81766d6a80fb95792cda6820556f739905cb54943ddbce",
         "type": "eql",
-        "version": 109
+        "version": 110
       },
       "8.13": {
         "max_allowable_version": 308,
         "rule_name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer",
-        "sha256": "4ad908e9c0e001298a239314cbd4fc39fb76e0789a62456d4601e31ea266b35e",
+        "sha256": "80e05f76dd4e8c2e94bdbd3924f85a5877d9ff5a47c410d308b96f7a1d390525",
         "type": "eql",
-        "version": 209
+        "version": 210
       }
     },
     "rule_name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer",
-    "sha256": "db69f7867e43c1d9991d02ca50a537f1688974ffa821585058e225fa254dfed5",
+    "sha256": "afa60af2586a1e3458855aa64f4d3fbbfe063c3f35b3abc5a840d616f77d9841",
     "type": "eql",
-    "version": 309
+    "version": 310
   },
   "fc909baa-fb34-4c46-9691-be276ef4234c": {
     "min_stack_version": "8.13",
@@ -15437,9 +15498,9 @@
   },
   "fcf733d5-7801-4eb0-92ac-8ffacf3658f2": {
     "rule_name": "User or Group Creation/Modification",
-    "sha256": "d1ea785176a27ff76f628305fa1d57041f59595f8b6e09f99b4b4349c18f1811",
+    "sha256": "e492a1d379ef0524d4b531024a7edf8a09e7b8174850fd8fd2d8824d76499df7",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "fd01b949-81be-46d5-bcf8-284395d5f56d": {
     "min_stack_version": "8.13",
@@ -15447,21 +15508,21 @@
       "8.12": {
         "max_allowable_version": 203,
         "rule_name": "GitHub App Deleted",
-        "sha256": "fd7912580b3ee17ae242b79e0c474ed025239a8690cf03c7095cfb0e32458960",
+        "sha256": "c0689f3c0e7636572f0800557c0480309dbcf71e0107dc51b0ed362728a0c927",
         "type": "eql",
-        "version": 104
+        "version": 105
       }
     },
     "rule_name": "GitHub App Deleted",
-    "sha256": "e753f36a6cb3de3d832b482c3fe3daf064a993d627e5b844c6f2993f5bd15de7",
+    "sha256": "77d5e70dceb83e72c91dec0a125b56e67e4f66b20ca31374060260c91887c03d",
     "type": "eql",
-    "version": 204
+    "version": 205
   },
   "fd332492-0bc6-11ef-b5be-f661ea17fbcc": {
     "rule_name": "AWS Systems Manager SecureString Parameter Request with Decryption Flag",
-    "sha256": "6e4722f7391334da9fa02d2bfe859e94a1110c6b78b728f62607aaa9380b59e9",
+    "sha256": "7c1af1a785726996f19edad02af0353a331e9ccd7a6095127460e2ee4da6beb0",
     "type": "new_terms",
-    "version": 2
+    "version": 3
   },
   "fd3fc25e-7c7c-4613-8209-97942ac609f6": {
     "rule_name": "Linux Restricted Shell Breakout via the expect command",
@@ -15475,22 +15536,22 @@
       "8.12": {
         "max_allowable_version": 210,
         "rule_name": "Potential Application Shimming via Sdbinst",
-        "sha256": "9f7d06cfbaaf01ad88f6a276c277892a422e7537769e0d96e7070b2598e9ad63",
+        "sha256": "fb02d9d052a80cb71ebc3d197b2737a8bb72f875dc6f26fcb777715dc8ea8007",
         "type": "eql",
-        "version": 111
+        "version": 112
       },
       "8.13": {
         "max_allowable_version": 310,
         "rule_name": "Potential Application Shimming via Sdbinst",
-        "sha256": "0c0fb67b6f1fbc64b54c4eaaaf3982e6abd871234c9d741e32cf6111a4b95348",
+        "sha256": "003cbead1025ca8c3bb1f33eddf4a98de00f555cb184077b194142cc838263b0",
         "type": "eql",
-        "version": 211
+        "version": 212
       }
     },
     "rule_name": "Potential Application Shimming via Sdbinst",
-    "sha256": "3a5c29d43ebbadfb3a010e164c997dcdbc2c550226c3129d9f7256ad4204f204",
+    "sha256": "8d5354802a1da8218bdca789c1118dd3c0e75072f015978e3ce65b239357204c",
     "type": "eql",
-    "version": 312
+    "version": 313
   },
   "fd70c98a-c410-42dc-a2e3-761c71848acf": {
     "min_stack_version": "8.14",
@@ -15498,22 +15559,22 @@
       "8.12": {
         "max_allowable_version": 209,
         "rule_name": "Suspicious CertUtil Commands",
-        "sha256": "65a47d83fe08648f0df1cee5903ebfd3630543555b6fd161876fa448da9c527c",
+        "sha256": "13dd1c7c1c9bea325d7f705da1527335b7e0e12d8f5e7d942ed99c6b9d1a7a5d",
         "type": "eql",
-        "version": 110
+        "version": 111
       },
       "8.13": {
         "max_allowable_version": 309,
         "rule_name": "Suspicious CertUtil Commands",
-        "sha256": "d5f199269d0b8d8ffcb51d4a5be03858a06c561d4d7b5e76ccdb0730fbf5212a",
+        "sha256": "2ab5b41ea028baf2c8143494762615137f2d9daec219a470c3ac43a8dc70d0d5",
         "type": "eql",
-        "version": 210
+        "version": 211
       }
     },
     "rule_name": "Suspicious CertUtil Commands",
-    "sha256": "d283778b33a2eb881ef6542154d6a7a4f20f42620f533ab95ac6e3d92989605a",
+    "sha256": "9e178f0e88993fc08a6e3bf41eaf0502281774f9ebbfe9477e09a20b55e8fc8f",
     "type": "eql",
-    "version": 311
+    "version": 312
   },
   "fd7a6052-58fa-4397-93c3-4795249ccfa2": {
     "min_stack_version": "8.14",
@@ -15521,22 +15582,22 @@
       "8.12": {
         "max_allowable_version": 317,
         "rule_name": "Svchost spawning Cmd",
-        "sha256": "e120819a00740e66d735aed46354c8c204941e187fffe5705afac9bc20b2c37f",
+        "sha256": "fd2168d3b0db808329e092b89905660cf80f6a564f9e3218506dfba05e409c61",
         "type": "new_terms",
-        "version": 218
+        "version": 219
       },
       "8.13": {
         "max_allowable_version": 417,
         "rule_name": "Svchost spawning Cmd",
-        "sha256": "3496b237c65ce8b5c66a99b52546e49a3564913f15df60b8ab5ff3831bd56e7a",
+        "sha256": "89907452efa6d5a092c9819fec02d0a27a824e7e526e5a031f271cd0a9cce5be",
         "type": "new_terms",
-        "version": 318
+        "version": 319
       }
     },
     "rule_name": "Svchost spawning Cmd",
-    "sha256": "2140d944bef1c61a87c150671d805d24438ca8fe7e109ef377a97dbc5a4efd83",
+    "sha256": "e648c831b55c6701ce80a615623526f8eb2024dd98dd5a6caaa49692191e85d8",
     "type": "new_terms",
-    "version": 418
+    "version": 419
   },
   "fd9484f2-1c56-44ae-8b28-dc1354e3a0e8": {
     "rule_name": "Image Loaded with Invalid Signature",
@@ -15546,9 +15607,9 @@
   },
   "fda1d332-5e08-4f27-8a9b-8c802e3292a6": {
     "rule_name": "System Binary Moved or Copied",
-    "sha256": "49225541197b4b6b4988a3f6f4b5e6540977b229a825bfea0d1292a82a942d39",
+    "sha256": "3f455b9a9fc20d9dca4d989e3236437d2b7c702d96e34fe01c0e21181bd9cc34",
     "type": "eql",
-    "version": 13
+    "version": 14
   },
   "fddff193-48a3-484d-8d35-90bb3d323a56": {
     "min_stack_version": "8.14",
@@ -15556,15 +15617,15 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "PowerShell Kerberos Ticket Dump",
-        "sha256": "e706f825293f97ffcf09c0d6cf29360f290b2af6f4fd63321077a785996970b3",
+        "sha256": "87b8915f4df4e07283d519a5459b89600a2e9018c07136f10a454968ecec7522",
         "type": "query",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "PowerShell Kerberos Ticket Dump",
-    "sha256": "d2f0a42229c44c3071f0ff420fc676660dd1a831a53634858ff9c59b0df0e7d1",
+    "sha256": "21800d17e1a701df364ecf5e4dc921c47a9978bd53f4290052756476349613b3",
     "type": "query",
-    "version": 107
+    "version": 108
   },
   "fe25d5bc-01fa-494a-95ff-535c29cc4c96": {
     "min_stack_version": "8.14",
@@ -15607,9 +15668,9 @@
   },
   "feafdc51-c575-4ed2-89dd-8e20badc2d6c": {
     "rule_name": "Potential Masquerading as Business App Installer",
-    "sha256": "6daf457d7f6fb492b6a132e9f2ef7980cedfe5de8d41148a55b6265379ba80f5",
+    "sha256": "6d71e2f5b064aa990886b9f8855595def2146202b93e657c62c021e3bc852c84",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "fec7ccb7-6ed9-4f98-93ab-d6b366b063a0": {
     "rule_name": "Execution via MS VisualStudio Pre/Post Build Events",
@@ -15642,45 +15703,45 @@
   },
   "fef62ecf-0260-4b71-848b-a8624b304828": {
     "rule_name": "Potential Process Name Stomping with Prctl",
-    "sha256": "6d66bac41360553f30a7ec77711cac7525469a4649853c093e54807182e05880",
+    "sha256": "4f8d4f17d7899a44961b0ed15bd61e32234c08c800dddbae9b75aa238bf40541",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "ff013cb4-274d-434a-96bb-fe15ddd3ae92": {
     "rule_name": "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet",
-    "sha256": "719015ef6c70c2739f12adb7f4e21683f10083d6e8cee6deabba37fcb821f02b",
+    "sha256": "7c706cb36925b68e3326c38052f0bc6a5afdfc8ef02a33dc200e92fae09dbb2f",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "ff0d807d-869b-4a0d-a493-52bc46d2f1b1": {
     "rule_name": "Potential DGA Activity",
-    "sha256": "a6828508851318616e927d9f819f6d7c5130b830e0f3eba41135daf75ac99758",
+    "sha256": "ef8f045d4a373ebb67741cef329ed0e2b3a356b64978bd6dcad9716fb2f3f592",
     "type": "machine_learning",
-    "version": 5
+    "version": 6
   },
   "ff10d4d8-fea7-422d-afb1-e5a2702369a9": {
     "rule_name": "Cron Job Created or Modified",
-    "sha256": "b0c6daed3da044ef0e0ce21a69c8b2b1a79c9e7b050b3d2d21597432dc235d90",
+    "sha256": "2bb9047a12faecde8952e7f0bfe8c12187345c8e1016fdd19c1ebcfdb379f298",
     "type": "eql",
-    "version": 14
+    "version": 15
   },
   "ff320c56-f8fa-11ee-8c44-f661ea17fbce": {
     "rule_name": "AWS S3 Bucket Expiration Lifecycle Configuration Added",
-    "sha256": "7842115a7191021a44e61d69bdc1563edc6e9d471a1237af41d228647df07824",
+    "sha256": "cb20be6b7c6db1a5ba68b0ab829e75e5faad09e13d4ad4db8d1d303a36958a26",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "ff4599cb-409f-4910-a239-52e4e6f532ff": {
     "rule_name": "LSASS Process Access via Windows API",
-    "sha256": "7d8c295d9d5382ec04a6755af94ef4b2f9e3a87942594dc7a1708854f48db9bf",
+    "sha256": "af8119ce553fafb567f949620657a037808e29169ff198277765c4f54f6aea09",
     "type": "eql",
-    "version": 10
+    "version": 11
   },
   "ff4dd44a-0ac6-44c4-8609-3f81bc820f02": {
     "rule_name": "Microsoft 365 Exchange Transport Rule Creation",
-    "sha256": "24df1fab9f47005a3dcf144bdd7993c237e1da4de8b6ed8ee44d4513417e0f88",
+    "sha256": "fd7869fa1dfb7814d85e599eddf43e2fe64eeff6d58e4bc655b81add4f748fe5",
     "type": "query",
-    "version": 206
+    "version": 207
   },
   "ff6cf8b9-b76c-4cc1-ac1b-4935164d1029": {
     "min_stack_version": "8.14",
@@ -15688,28 +15749,28 @@
       "8.12": {
         "max_allowable_version": 100,
         "rule_name": "Alternate Data Stream Creation/Execution at Volume Root Directory",
-        "sha256": "b84b07ea9bb5fca4cc1522b6f29f121b0a4dc4e0b59d3c48a6b7a2cab83f18bb",
+        "sha256": "142aa8456d0c3151257b8d40bb29b00d7880561940ea1366b6c850725a7fa90b",
         "type": "eql",
-        "version": 1
+        "version": 2
       },
       "8.13": {
         "max_allowable_version": 200,
         "rule_name": "Alternate Data Stream Creation/Execution at Volume Root Directory",
-        "sha256": "a5dc5c08ba531d44f22ea6769d5c2df16f15453f794a715ed59b46054ce95996",
+        "sha256": "593b01d8d7d60109ab9ad569f65be57c3c9e8efb4590d58f871e61d7ba6a8cfa",
         "type": "eql",
-        "version": 101
+        "version": 102
       }
     },
     "rule_name": "Alternate Data Stream Creation/Execution at Volume Root Directory",
-    "sha256": "fdeb2235369b54f09b8e618dfa7db46fc187a691bc5b60955e67e9bfa1d1a008",
+    "sha256": "1b182aabc1a25362770238d8e6fbd5d91def7ad420cbd29f0ec914985f603673",
     "type": "eql",
-    "version": 201
+    "version": 202
   },
   "ff9b571e-61d6-4f6c-9561-eb4cca3bafe1": {
     "rule_name": "GCP Firewall Rule Deletion",
-    "sha256": "6ea6272c4b6fd3f4e7e5dfdd1e521af24e89ac9633ee8ee964f52fa09e28d068",
+    "sha256": "dbdeafa2e40515c24f4df798e5a2d653973541813b5f25cad1c52cf8e334f69f",
     "type": "query",
-    "version": 104
+    "version": 105
   },
   "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b": {
     "min_stack_version": "8.16",
@@ -15717,14 +15778,14 @@
       "8.12": {
         "max_allowable_version": 106,
         "rule_name": "Potential Sudo Token Manipulation via Process Injection",
-        "sha256": "a7acb15e762a822b94eadf4a2caebe464a6f3cf2f67bfbcebcacba6c928d5366",
+        "sha256": "b3468a2a0f4b606f04c16270c18b6b7d2a77491078aa852a13f671f64b328173",
         "type": "eql",
-        "version": 7
+        "version": 8
       }
     },
     "rule_name": "Potential Sudo Token Manipulation via Process Injection",
-    "sha256": "d9a50180875a16c7d3cfedadf27a0c3bb75bd18b950d188993f9ba0f43f504ca",
+    "sha256": "b3a0fb9a91e96e465bf2e1a9c90fbdfcd2446a6bd3d40d9b7b245f49e82a8155",
     "type": "eql",
-    "version": 107
+    "version": 108
   }
 }
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index b687b7c05..92c3db8e4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "0.4.7"
+version = "0.4.8"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"