diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index 28ab8b992..414de5a88 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -64,7 +64,7 @@ } }, "rule_name": "AWS Redshift Cluster Creation", - "sha256": "4b8809bf7107aa3e8169d82047acb52c422c663b159574d29a8176d7a9fb6dca", + "sha256": "4b8809bf7107aa3e8169d82047acb52c422c663b159574d29a8176d7a9fb6dca", "type": "query", "version": 206 }, @@ -489,6 +489,13 @@ "type": "threat_match", "version": 204 }, + "0cd2f3e6-41da-40e6-b28b-466f688f00a6": { + "min_stack_version": "8.13", + "rule_name": "AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a Session", + "sha256": "b124621df90ec8e22a42cdf417ec79eeb7daa3d5e543cac43100cdb28f24f252", + "type": "esql", + "version": 1 + }, "0ce6487d-8069-4888-9ddd-61b52490cebc": { "min_stack_version": "8.8", "previous": { @@ -939,6 +946,13 @@ "type": "query", "version": 109 }, + "17261da3-a6d0-463c-aac8-ea1718afcd20": { + "min_stack_version": "8.13", + "rule_name": "AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User", + "sha256": "277c989e76a6733738b5108d8b11929cb28245277d6e555651e95d9817f2af48", + "type": "esql", + "version": 1 + }, "1781d055-5c66-4adf-9c59-fc0fa58336a5": { "min_stack_version": "8.3", "rule_name": "Unusual Windows Username", @@ -3007,6 +3021,13 @@ "type": "query", "version": 206 }, + "4f855297-c8e0-4097-9d97-d653f7e471c4": { + "min_stack_version": "8.13", + "rule_name": "Unusual High Confidence Misconduct Blocks Detected", + "sha256": "809afd6116ccf0d6766b68605bfab88cb8d1b2c472a38b8dff1b7cf128110b94", + "type": "esql", + "version": 1 + }, "4fe9d835-40e1-452d-8230-17c147cafad8": { "min_stack_version": "8.3", "rule_name": "Execution via TSClient Mountpoint", @@ -3656,6 +3677,13 @@ "type": "eql", "version": 100 }, + "5f0234fd-7f21-42af-8391-511d5fd11d5c": { + "min_stack_version": "8.13", + "rule_name": "AWS S3 Bucket Enumeration or Brute Force", + "sha256": "929a9ca39ab9fb396533d10f723899fbaf9225968c94ae0f32e20a189d2c7827", + "type": "esql", + "version": 1 + }, "60884af6-f553-4a6c-af13-300047455491": { "min_stack_version": "8.3", "rule_name": "Azure Command Execution on Virtual Machine", @@ -6676,6 +6704,13 @@ "type": "eql", "version": 2 }, + "b1773d05-f349-45fb-9850-287b8f92f02d": { + "min_stack_version": "8.13", + "rule_name": "Potential Abuse of Resources by High Token Count and Large Response Sizes", + "sha256": "6a40ebf3c73e6c53af80cb80bd9a27f9b1048603919e041e0c114c02154787a6", + "type": "esql", + "version": 1 + }, "b1c14366-f4f8-49a0-bcbb-51d2de8b0bb8": { "rule_name": "Potential Persistence via Cron Job", "sha256": "0c030fdda99d067a509f80bd3faff91ee4d8414e5074a9ef6cf7bf5fc97fcbed", @@ -9382,6 +9417,13 @@ "type": "query", "version": 110 }, + "f4c2515a-18bb-47ce-a768-1dc4e7b0fe6c": { + "min_stack_version": "8.13", + "rule_name": "AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request", + "sha256": "ed5ccf8325568487fa6a05a27f41c8db181f2d419f3dd29514ecc2c7950669c3", + "type": "esql", + "version": 1 + }, "f52362cd-baf1-4b6d-84be-064efc826461": { "rule_name": "Linux Restricted Shell Breakout via flock Shell evasion", "sha256": "9a30702aaa4b583d4dfed22529c75be33a32d661580c7885d29a45fb627ec6b7",