diff --git a/rules/integrations/o365/credential_access_microsoft_365_potential_password_spraying_attack.toml b/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml
similarity index 95%
rename from rules/integrations/o365/credential_access_microsoft_365_potential_password_spraying_attack.toml
rename to rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml
index 7b2baeefe..8a55c136c 100644
--- a/rules/integrations/o365/credential_access_microsoft_365_potential_password_spraying_attack.toml
+++ b/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml
@@ -1,8 +1,9 @@
 [metadata]
 creation_date = "2020/12/01"
 integration = ["o365"]
-maturity = "production"
-updated_date = "2024/09/05"
+maturity = "deprecated"
+deprecation_date = "2025/01/17"
+updated_date = "2025/01/17"
 
 [rule]
 author = ["Elastic"]
diff --git a/rules/cross-platform/execution_suspicious_jar_child_process.toml b/rules/_deprecated/execution_suspicious_jar_child_process.toml
similarity index 98%
rename from rules/cross-platform/execution_suspicious_jar_child_process.toml
rename to rules/_deprecated/execution_suspicious_jar_child_process.toml
index c4e9ce9e8..78fdaec6f 100644
--- a/rules/cross-platform/execution_suspicious_jar_child_process.toml
+++ b/rules/_deprecated/execution_suspicious_jar_child_process.toml
@@ -1,8 +1,9 @@
 [metadata]
 creation_date = "2021/01/19"
 integration = ["endpoint"]
-maturity = "production"
-updated_date = "2024/10/18"
+maturity = "deprecated"
+deprecation_date = "2025/01/17"
+updated_date = "2025/01/17"
 
 [rule]
 author = ["Elastic"]