From 336cdb6ce9eeeafda77489da5c47c99b478b72b3 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon Date: Wed, 4 Nov 2026 14:50:16 -0500 Subject: [PATCH] Map 8.x Security prebuilt rule pages to their 9.x rule pages 990 rule pages linked from the 8.19 prebuilt rule reference had no entry in v3-mapping.json, so their "latest documentation" banner linked to /docs. 137 existing rule entries pointed to 9.x pages that now return 404 because the rule was renamed, moved, or deprecated. - Add 949 entries for rules whose title matches a live 9.x rule page. - Add 41 entries for rules not yet published in 9.x, pointing to the prebuilt rules reference. - Fix 92 stale entries to point to the rule's current 9.x page, matched by title or by rule_id through detection-rules history. - Point 45 entries for deprecated rules to the prebuilt rules reference. Every target was checked against www.elastic.co and returns 200. Co-Authored-By: Claude Opus 5.5 --- .../asciidoctor/lib/chunker/v3-mapping.json | 1264 +++++++++++++++-- 1 file changed, 1127 insertions(+), 137 deletions(-) diff --git a/resources/asciidoctor/lib/chunker/v3-mapping.json b/resources/asciidoctor/lib/chunker/v3-mapping.json index e7f47cd8b0a7..cd39df12361c 100644 --- a/resources/asciidoctor/lib/chunker/v3-mapping.json +++ b/resources/asciidoctor/lib/chunker/v3-mapping.json @@ -11047,6 +11047,7 @@ "/en/security/*/account-or-group-discovery-via-built-in-tools.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_of_accounts_or_groups_via_builtin_tools", "/en/security/*/account-password-reset-remotely.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_remote_password_reset", "/en/security/*/actions-api-overview.html": "/docs/api/doc/kibana/group/endpoint-connectors", + "/en/security/*/active-directory-discovery-using-adexplorer.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_ad_explorer_execution", "/en/security/*/active-directory-forced-authentication-from-linux-host-smb-named-pipes.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_forced_authentication_pipes", "/en/security/*/active-directory-group-modification-by-system.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_group_modification_by_system", "/en/security/*/add-exceptions.html": "/docs/solutions/security/detect-and-alert/add-manage-exceptions", @@ -11058,12 +11059,12 @@ "/en/security/*/administrator-role-assigned-to-an-okta-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user", "/en/security/*/adminsdholder-backdoor.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_ad_adminsdholder", "/en/security/*/adminsdholder-sdprop-exclusion-added.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_sdprop_exclusion_dsheuristics", - "/en/security/*/adobe-hijack-persistence.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_adobe_hijack_persistence", + "/en/security/*/adobe-hijack-persistence.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/advanced-behavioral-detections.html": "/docs/solutions/security/advanced-entity-analytics/advanced-behavioral-detections", "/en/security/*/advanced-entity-analytics-overview.html": "/docs/solutions/security/advanced-entity-analytics", "/en/security/*/advanced-settings.html": "/docs/solutions/security/get-started/configure-advanced-settings", "/en/security/*/adversary-behavior-detected-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/endgame_adversary_behavior_detected", - "/en/security/*/agent-spoofing-mismatched-agent-id.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_agent_spoofing_mismatched_id", + "/en/security/*/agent-spoofing-mismatched-agent-id.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/agent-spoofing-multiple-hosts-using-same-agent.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts", "/en/security/*/agent-tamper-protection.html": "/docs/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation", "/en/security/*/agentless-integrations.html": "/docs/solutions/security/get-started/agentless-integrations", @@ -11071,6 +11072,10 @@ "/en/security/*/ai-for-security.html": "/docs/solutions/security/ai", "/en/security/*/alert-schema.html": "/docs/reference/security/fields-and-object-schemas/alert-schema", "/en/security/*/alert-suppression.html": "/docs/solutions/security/detect-and-alert/suppress-detection-alerts", + "/en/security/*/alerts-from-multiple-integrations-by-destination-address.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_dstip", + "/en/security/*/alerts-from-multiple-integrations-by-source-address.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_srcip", + "/en/security/*/alerts-from-multiple-integrations-by-user-name.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_user", + "/en/security/*/alerts-in-different-att-ck-tactics-by-host.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_risky_host_esql", "/en/security/*/alerts-run-osquery.html": "/docs/solutions/security/investigate/run-osquery-from-alerts", "/en/security/*/alerts-ui-manage.html": "/docs/solutions/security/detect-and-alert/manage-detection-alerts", "/en/security/*/alerts-ui-monitor.html": "/docs/solutions/security/detect-and-alert/monitor-rule-executions", @@ -11080,8 +11085,37 @@ "/en/security/*/anomalous-linux-compiler-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/resource_development_ml_linux_anomalous_compiler_activity", "/en/security/*/anomalous-process-for-a-linux-population.html": "/docs/reference/security/prebuilt-rules/rules/ml/persistence_ml_linux_anomalous_process_all_hosts", "/en/security/*/anomalous-process-for-a-windows-population.html": "/docs/reference/security/prebuilt-rules/rules/ml/persistence_ml_windows_anomalous_process_all_hosts", + "/en/security/*/anomalous-react-server-components-flight-data-patterns.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_anomalous_rsc_flight_data_patterns", "/en/security/*/anomalous-windows-process-creation.html": "/docs/reference/security/prebuilt-rules/rules/ml/persistence_ml_windows_anomalous_process_creation", "/en/security/*/anonymization-fields-api-find.html": "/docs/api/doc/kibana/operation/operation-findanonymizationfields", + "/en/security/*/anthropic-activity-from-a-suspicious-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/command_and_control_anthropic_suspicious_user_agent", + "/en/security/*/anthropic-admin-api-key-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_admin_api_key_created", + "/en/security/*/anthropic-admin-api-key-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/impact_anthropic_admin_api_key_deleted", + "/en/security/*/anthropic-admin-role-assigned-to-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_admin_role_assigned_to_user", + "/en/security/*/anthropic-compliance-api-key-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_compliance_api_key_created", + "/en/security/*/anthropic-compliance-api-logging-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/defense_evasion_anthropic_compliance_api_logging_disabled", + "/en/security/*/anthropic-compliance-audit-log-export-accessed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/collection_anthropic_compliance_audit_log_export_accessed", + "/en/security/*/anthropic-excessive-chat-access-failures.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/discovery_anthropic_excessive_chat_access_failures", + "/en/security/*/anthropic-excessive-chat-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/impact_anthropic_excessive_chat_creation", + "/en/security/*/anthropic-excessive-chat-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/defense_evasion_anthropic_excessive_chat_deletion", + "/en/security/*/anthropic-excessive-chat-snapshot-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/exfiltration_anthropic_excessive_chat_snapshot_creation", + "/en/security/*/anthropic-extra-usage-spend-limit-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/impact_anthropic_extra_usage_spend_limit_deleted", + "/en/security/*/anthropic-high-file-upload-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/exfiltration_anthropic_high_file_upload_activity", + "/en/security/*/anthropic-magic-link-second-factor-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/defense_evasion_anthropic_magic_link_second_factor_disabled", + "/en/security/*/anthropic-mcp-server-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_mcp_server_created", + "/en/security/*/anthropic-multiple-authentication-failures.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/credential_access_anthropic_multiple_authentication_failures", + "/en/security/*/anthropic-organization-data-export-accessed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/collection_anthropic_organization_data_export_accessed", + "/en/security/*/anthropic-organization-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/impact_anthropic_organization_destructive_action", + "/en/security/*/anthropic-organization-domain-boundary-changed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_organization_domain_boundary_changed", + "/en/security/*/anthropic-organization-ip-restriction-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/defense_evasion_anthropic_organization_ip_restriction_deleted", + "/en/security/*/anthropic-organization-member-and-group-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/discovery_anthropic_organization_member_group_enumeration", + "/en/security/*/anthropic-organization-user-invite-sent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_organization_user_invite_sent", + "/en/security/*/anthropic-primary-owner-transferred.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/privilege_escalation_anthropic_primary_owner_transferred", + "/en/security/*/anthropic-sensitive-claude-project-role-assigned-to-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/persistence_anthropic_sensitive_project_role_assigned_to_user", + "/en/security/*/anthropic-sso-disabled-or-connection-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/defense_evasion_anthropic_sso_disabled_or_connection_removed", + "/en/security/*/apparmor-policy-interface-access.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_apparmor_policy_access", + "/en/security/*/apparmor-policy-violation-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_apparmor_policy_violation", + "/en/security/*/apparmor-profile-compilation-via-apparmor-parser.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_apparmor_profile_compilation", "/en/security/*/apple-script-execution-followed-by-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_scripting_osascript_exec_followed_by_netcon", "/en/security/*/apple-scripting-execution-with-administrator-privileges.html": "/docs/reference/security/prebuilt-rules/rules/macos/privilege_escalation_applescript_with_admin_privs", "/en/security/*/application-added-to-google-workspace-domain.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_application_added_to_google_workspace_domain", @@ -11106,6 +11140,7 @@ "/en/security/*/attack-discovery-ai-assistant-incident-reporting.html": "/docs/solutions/security/ai/identify-investigate-document-threats", "/en/security/*/attack-discovery.html": "/docs/solutions/security/ai/attack-discovery", "/en/security/*/attempt-to-clear-kernel-ring-buffer.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_clear_kernel_ring_buffer", + "/en/security/*/attempt-to-clear-logs-via-journalctl.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_journalctl_clear_logs", "/en/security/*/attempt-to-create-okta-api-token.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_attempt_to_create_okta_api_token", "/en/security/*/attempt-to-deactivate-an-okta-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application", "/en/security/*/attempt-to-deactivate-an-okta-network-zone.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone", @@ -11122,6 +11157,7 @@ "/en/security/*/attempt-to-enable-the-root-account.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_enable_root_account", "/en/security/*/attempt-to-establish-vscode-remote-tunnel.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_tunnel_vscode", "/en/security/*/attempt-to-install-kali-linux-via-wsl.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_kalilinux", + "/en/security/*/attempt-to-install-or-run-kali-linux-via-wsl.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_kalilinux", "/en/security/*/attempt-to-install-root-certificate.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_install_root_certificate", "/en/security/*/attempt-to-modify-an-okta-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application", "/en/security/*/attempt-to-modify-an-okta-network-zone.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone", @@ -11134,160 +11170,352 @@ "/en/security/*/attempt-to-unload-elastic-endpoint-security-kernel-extension.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_unload_endpointsecurity_kext", "/en/security/*/attempted-bypass-of-okta-mfa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa", "/en/security/*/attempted-private-key-access.html": "/docs/reference/security/prebuilt-rules/rules_building_block/credential_access_win_private_key_access", - "/en/security/*/attempts-to-brute-force-a-microsoft-365-user-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/credential_access_microsoft_365_brute_force_user_account_attempt", + "/en/security/*/attempts-to-brute-force-a-microsoft-365-user-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force", "/en/security/*/attempts-to-brute-force-an-okta-user-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account", "/en/security/*/authentication-via-unusual-pam-grantor.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_unusual_pam_grantor", "/en/security/*/authorization-plugin-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_credential_access_authorization_plugin_creation", "/en/security/*/automated-response-actions.html": "/docs/solutions/security/endpoint-response-actions/automated-response-actions", "/en/security/*/automatic-import.html": "/docs/solutions/security/get-started/automatic-import", + "/en/security/*/aws-access-token-used-from-multiple-addresses.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses", + "/en/security/*/aws-account-closed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_aws_account_closed", + "/en/security/*/aws-api-activity-from-uncommon-s3-client-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_s3_uncommon_client_user_agent", + "/en/security/*/aws-assumerolewithwebidentity-from-kubernetes-sa-and-external-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_assume_role_with_web_identity_kubernetes_sa_from_external_asn", + "/en/security/*/aws-attempt-to-leave-organization.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_organizations_leave_organization", + "/en/security/*/aws-audit-or-security-service-tampering-via-cli.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_aws_audit_and_security_service_tampering_via_cli", + "/en/security/*/aws-backup-recovery-point-deleted-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_backup_recovery_point_deleted", + "/en/security/*/aws-backup-resource-enumeration-via-long-term-access-key.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_backup_enumeration_via_long_term_access_key", + "/en/security/*/aws-backup-vault-deleted-or-vault-lock-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_backup_vault_deleted_or_lock_removed", + "/en/security/*/aws-batch-job-submitted-with-container-override-by-unusual-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_batch_job_submitted_container_override_unusual_identity", + "/en/security/*/aws-bedrock-agent-created-by-iam-user-or-root.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_agent_created", + "/en/security/*/aws-bedrock-agent-or-action-group-manipulation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_agent_or_action_group_manipulation", + "/en/security/*/aws-bedrock-agentcore-execution-role-used-outside-its-runtime.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_execution_role_used_outside_runtime", + "/en/security/*/aws-bedrock-agentcore-gateway-tool-invocation-failure-burst.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-bedrock-agentcore-resource-created-with-iam-execution-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_resource_created_with_role", + "/en/security/*/aws-bedrock-agentcore-runtime-prompt-containing-credentials.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_containing_credentials", + "/en/security/*/aws-bedrock-agentcore-runtime-prompt-targeting-credentials-or-instance-metadata.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_credential_harvesting", + "/en/security/*/aws-bedrock-agentcore-with-public-network-browser-or-code-interpreter-sandbox.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_public_network_execution_role", + "/en/security/*/aws-bedrock-api-key-phantom-user-activity-outside-bedrock.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_activity_outside_bedrock", + "/en/security/*/aws-bedrock-api-key-used-for-destructive-or-anti-recovery-action.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_bedrock_api_key_destructive_action", + "/en/security/*/aws-bedrock-automated-reasoning-safety-policy-tampering.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_bedrock_automated_reasoning_safety_policy_tampering", "/en/security/*/aws-bedrock-detected-multiple-attempts-to-use-denied-models-by-a-single-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_attempts_to_use_denied_models_by_user", "/en/security/*/aws-bedrock-detected-multiple-validation-exception-errors-by-a-single-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_validation_exception_errors_by_single_user", + "/en/security/*/aws-bedrock-foundation-model-access-enabled-or-entitlement-granted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_enabled_or_entitlement_granted", + "/en/security/*/aws-bedrock-foundation-model-enumeration-followed-by-invocation-via-long-term-key.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_bedrock_model_recon_and_invocation_via_long_term_key", + "/en/security/*/aws-bedrock-guardrail-deleted-or-weakened.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_bedrock_guardrail_deleted_or_weakened", "/en/security/*/aws-bedrock-guardrails-detected-multiple-policy-violations-within-a-single-blocked-request.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_in_single_request", "/en/security/*/aws-bedrock-guardrails-detected-multiple-violations-by-a-single-user-over-a-session.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_by_single_user", + "/en/security/*/aws-bedrock-high-frequency-single-model-inference-api-probing.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_bedrock_high_frequency_inference_api_probing", + "/en/security/*/aws-bedrock-high-risk-filesystem-or-execution-tool-invocation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/execution_bedrock_high_risk_tool_invocation", "/en/security/*/aws-bedrock-invocations-without-guardrails-detected-by-a-single-user-over-a-session.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_execution_without_guardrails", + "/en/security/*/aws-bedrock-knowledge-base-or-rag-data-source-tampering.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_bedrock_knowledge_base_or_rag_data_source_poisoning", + "/en/security/*/aws-bedrock-model-invocation-logging-disabled-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_bedrock_model_invocation_logging_disabled_or_modified", + "/en/security/*/aws-bedrock-model-prompt-or-completion-containing-credentials.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/credential_access_aws_bedrock_credentials_in_model_prompt_or_completion", + "/en/security/*/aws-bedrock-provisioned-model-throughput-tampering.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_bedrock_provisioned_model_throughput_tampering", + "/en/security/*/aws-bedrock-resource-based-policy-modified-or-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_modified_or_deleted", + "/en/security/*/aws-bedrock-third-party-or-external-knowledge-base-associated-to-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_third_party_or_external_knowledge_base_associated_to_agent", + "/en/security/*/aws-bedrock-unauthorized-foundation-model-access-attempt.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_denied_attempt", + "/en/security/*/aws-bedrock-unauthorized-resource-based-policy-modification-attempt.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_denied_attempt", + "/en/security/*/aws-bedrock-untrusted-model-imported-or-marketplace-endpoint-registered.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_bedrock_untrusted_model_imported_or_marketplace_endpoint_registered", "/en/security/*/aws-cli-command-with-custom-endpoint-url.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_aws_cli_endpoint_url_used", + "/en/security/*/aws-cli-configuration-modified-by-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_aws_cli_config_modified_by_unusual_process", + "/en/security/*/aws-cloudshell-environment-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_cloudshell_environment_created", "/en/security/*/aws-cloudtrail-log-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/collection_cloudtrail_logging_created", "/en/security/*/aws-cloudtrail-log-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted", + "/en/security/*/aws-cloudtrail-log-evasion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_evasion", "/en/security/*/aws-cloudtrail-log-suspended.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended", "/en/security/*/aws-cloudtrail-log-updated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_cloudtrail_logging_updated", + "/en/security/*/aws-cloudtrail-management-events-disabled-via-puteventselectors.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_cloudtrail_management_events_disabled_via_eventselectors", "/en/security/*/aws-cloudwatch-alarm-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion", "/en/security/*/aws-cloudwatch-log-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_cloudwatch_log_group_deletion", "/en/security/*/aws-cloudwatch-log-stream-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_cloudwatch_log_stream_deletion", + "/en/security/*/aws-cognito-unauthenticated-identity-pool-credentials-issued.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_cognito_unauthenticated_identity_pool_credentials_issued", "/en/security/*/aws-config-resource-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_config_service_rule_deletion", "/en/security/*/aws-configuration-recorder-stopped.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_configuration_recorder_stopped", + "/en/security/*/aws-credentials-searched-for-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_aws_creds_search_inside_container", + "/en/security/*/aws-credentials-used-from-github-actions-and-non-ci-cd-infrastructure.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_github_actions_oidc_credentials_used_from_suspicious_network", "/en/security/*/aws-deletion-of-rds-instance-or-cluster.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion", - "/en/security/*/aws-discovery-api-calls-via-cli-from-a-single-resource.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ec2_multiple_discovery_api_calls_via_cli", + "/en/security/*/aws-detective-graph-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_detective_graph_deleted", + "/en/security/*/aws-discovery-api-calls-from-vpn-asn-for-the-first-time-by-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls", + "/en/security/*/aws-discovery-api-calls-via-cli-from-a-single-resource.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli", + "/en/security/*/aws-dynamodb-scan-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user", + "/en/security/*/aws-dynamodb-table-exported-to-s3.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3", "/en/security/*/aws-ec2-admin-credential-fetch-via-assumed-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance", + "/en/security/*/aws-ec2-ami-shared-with-another-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account", + "/en/security/*/aws-ec2-createkeypair-by-new-principal-from-non-cloud-as-organization.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_new_terms_ec2_create_keypair_unusual_source_as", "/en/security/*/aws-ec2-deprecated-ami-discovery.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery", + "/en/security/*/aws-ec2-ebs-snapshot-access-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed", "/en/security/*/aws-ec2-ebs-snapshot-shared-or-made-public.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account", "/en/security/*/aws-ec2-encryption-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_ec2_disable_ebs_encryption", + "/en/security/*/aws-ec2-export-task.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_export_task", "/en/security/*/aws-ec2-full-network-packet-capture-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected", "/en/security/*/aws-ec2-instance-connect-ssh-public-key-uploaded.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/lateral_movement_ec2_instance_connect_ssh_public_key_uploaded", "/en/security/*/aws-ec2-instance-console-login-via-assumed-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/lateral_movement_ec2_instance_console_login", "/en/security/*/aws-ec2-instance-interaction-with-iam-service.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_iam_instance_request_to_iam_service", - "/en/security/*/aws-ec2-multi-region-describeinstances-api-calls.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ec2_multi_region_describe_instances", + "/en/security/*/aws-ec2-instance-profile-associated-with-running-instance.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_ec2_instance_profile_associated_with_running_instance", + "/en/security/*/aws-ec2-lolbin-execution-via-ssm-sendcommand.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm", + "/en/security/*/aws-ec2-multi-region-describeinstances-api-calls.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_ec2_multi_region_describe_instances", + "/en/security/*/aws-ec2-nacl-entry-created-or-replaced-allowing-all-traffic-by-new-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity", "/en/security/*/aws-ec2-network-access-control-list-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_ec2_network_acl_creation", "/en/security/*/aws-ec2-network-access-control-list-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion", + "/en/security/*/aws-ec2-role-getcalleridentity-from-new-source-as-organization.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity_ec2_role_new_source_as", + "/en/security/*/aws-ec2-route-table-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_route_table_created", "/en/security/*/aws-ec2-route-table-modified-or-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_ec2_route_table_modified_or_deleted", "/en/security/*/aws-ec2-security-group-configuration-change.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection", - "/en/security/*/aws-ec2-snapshot-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_snapshot_change_activity", + "/en/security/*/aws-ec2-serial-console-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_serial_console_access_enabled", + "/en/security/*/aws-ec2-snapshot-activity.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-ec2-stop-start-and-user-data-modification-correlation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_ec2_stop_start_with_user_data_modification", + "/en/security/*/aws-ec2-unauthorized-admin-credential-fetch-via-assumed-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance", "/en/security/*/aws-ec2-user-data-retrieval-for-ec2-instance.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance", - "/en/security/*/aws-ec2-vm-export-failure.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_vm_export_failure", - "/en/security/*/aws-efs-file-system-or-mount-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted", - "/en/security/*/aws-elasticache-security-group-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_elasticache_security_group_creation", - "/en/security/*/aws-elasticache-security-group-modified-or-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted", + "/en/security/*/aws-ec2-vm-export-failure.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-ecr-repository-or-registry-policy-granted-public-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ecr_repository_policy_granted_public_access", + "/en/security/*/aws-efs-file-system-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_efs_filesystem_deleted", + "/en/security/*/aws-efs-file-system-or-mount-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_efs_filesystem_deleted", + "/en/security/*/aws-eks-access-entry-created-then-deleted-by-same-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted", + "/en/security/*/aws-eks-access-entry-granted-cluster-admin-policy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy", + "/en/security/*/aws-eks-access-entry-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_eks_access_entry_modified", + "/en/security/*/aws-eks-control-plane-logging-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_eks_control_plane_logging_disabled", + "/en/security/*/aws-elasticache-security-group-created.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-elasticache-security-group-modified-or-deleted.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/aws-eventbridge-rule-disabled-or-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted", + "/en/security/*/aws-first-occurrence-of-sts-getfederationtoken-request-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_sts_get_federation_token", + "/en/security/*/aws-getfederationtoken-followed-by-console-login-via-federation-exchange.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_get_federation_token_followed_by_console_login_via_federation_exchange", + "/en/security/*/aws-guardduty-detection-suppression.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_guardduty_finding_suppression", "/en/security/*/aws-guardduty-detector-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion", + "/en/security/*/aws-guardduty-member-account-manipulation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_guardduty_member_manipulation", + "/en/security/*/aws-guardduty-publishing-destination-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_guardduty_publishing_destination_deleted", + "/en/security/*/aws-guardduty-threat-intelligence-set-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_guardduty_threat_intel_set_deleted", + "/en/security/*/aws-iam-account-password-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_iam_account_password_policy_deleted", "/en/security/*/aws-iam-administratoraccess-policy-attached-to-group.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group", "/en/security/*/aws-iam-administratoraccess-policy-attached-to-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role", "/en/security/*/aws-iam-administratoraccess-policy-attached-to-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user", + "/en/security/*/aws-iam-api-calls-via-temporary-session-tokens.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_api_calls_via_user_session_token", "/en/security/*/aws-iam-assume-role-policy-update.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy", - "/en/security/*/aws-iam-brute-force-of-assume-role-policy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force", + "/en/security/*/aws-iam-brute-force-of-assume-role-policy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy", "/en/security/*/aws-iam-compromisedkeyquarantine-policy-attached-to-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_iam_compromisedkeyquarantine_policy_attached_to_user", "/en/security/*/aws-iam-create-user-via-assumed-role-on-ec2-instance.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance", + "/en/security/*/aws-iam-credentials-added-to-a-bedrock-api-key-phantom-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_credentials_added", "/en/security/*/aws-iam-customer-managed-policy-attached-to-role-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role", + "/en/security/*/aws-iam-customer-managed-policy-version-created-or-default-version-set.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_version_created_or_set_default", "/en/security/*/aws-iam-deactivation-of-mfa-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_iam_deactivate_mfa_device", "/en/security/*/aws-iam-group-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_group_creation", "/en/security/*/aws-iam-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_iam_group_deletion", + "/en/security/*/aws-iam-inline-policy-added-to-a-group.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_inline_policy_added_to_group", "/en/security/*/aws-iam-login-profile-added-for-root.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_create_login_profile_for_root", "/en/security/*/aws-iam-login-profile-added-to-user.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_aws_iam_login_profile_added_to_user", + "/en/security/*/aws-iam-login-profile-created-or-modified-for-an-iam-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_login_profile_created_or_modified", + "/en/security/*/aws-iam-long-term-access-key-first-seen-from-source-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_iam_long_term_access_key_first_seen_from_source_ip", + "/en/security/*/aws-iam-oidc-provider-created-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_oidc_provider_created", "/en/security/*/aws-iam-password-recovery-requested.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_password_recovery", + "/en/security/*/aws-iam-permission-boundary-or-guardrail-policy-deleted-by-unusual-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_iam_managed_policy_deleted_unusual_identity", + "/en/security/*/aws-iam-permissions-boundary-modified-or-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_permissions_boundary_modified", + "/en/security/*/aws-iam-principal-enumeration-via-updateassumerolepolicy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy", "/en/security/*/aws-iam-roles-anywhere-profile-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_roles_anywhere_profile_created", "/en/security/*/aws-iam-roles-anywhere-trust-anchor-created-with-external-ca.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca", + "/en/security/*/aws-iam-saml-provider-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_saml_provider_created", "/en/security/*/aws-iam-saml-provider-updated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_saml_provider_updated", + "/en/security/*/aws-iam-sensitive-operations-via-lambda-execution-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_iam_privilege_operations_via_lambda_execution_role", "/en/security/*/aws-iam-user-addition-to-group.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_iam_user_addition_to_group", + "/en/security/*/aws-iam-user-console-login-from-multiple-geolocations.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_console_login_iam_user_multiple_geolocations", + "/en/security/*/aws-iam-user-console-login-without-mfa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_iam_user_console_login_without_mfa", "/en/security/*/aws-iam-user-created-access-keys-for-another-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user", + "/en/security/*/aws-iam-user-self-created-access-key-subsequently-used.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_user_self_created_access_key_subsequently_used", + "/en/security/*/aws-iam-virtual-mfa-device-registration-attempt-with-session-token.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device", "/en/security/*/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion", + "/en/security/*/aws-kms-imported-key-material-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_kms_imported_key_material_deleted", + "/en/security/*/aws-kms-key-policy-updated-via-putkeypolicy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_kms_key_policy_put", + "/en/security/*/aws-lambda-event-source-mapping-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_lambda_event_source_mapping_created", "/en/security/*/aws-lambda-function-created-or-updated.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_aws_lambda_function_updated", + "/en/security/*/aws-lambda-function-deletion-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_lambda_function_deleted", + "/en/security/*/aws-lambda-function-high-frequency-invocation-by-a-single-principal.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_lambda_high_frequency_invocation", + "/en/security/*/aws-lambda-function-invoked-by-an-unusual-principal.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_lambda_function_invoked_by_unusual_principal", + "/en/security/*/aws-lambda-function-invoked-cross-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_lambda_function_invoked_cross_account", + "/en/security/*/aws-lambda-function-invoked-from-an-unusual-source-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_lambda_function_invoked_from_unusual_source_asn", + "/en/security/*/aws-lambda-function-policy-updated-to-allow-cross-account-invocation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_lambda_cross_account_invocation_backdoor", "/en/security/*/aws-lambda-function-policy-updated-to-allow-public-invocation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal", + "/en/security/*/aws-lambda-function-url-created-with-public-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_lambda_function_url_public_access", "/en/security/*/aws-lambda-layer-added-to-existing-function.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_lambda_external_layer_added_to_function", + "/en/security/*/aws-lambda-layer-shared-externally.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_lambda_layer_shared_externally", + "/en/security/*/aws-lateral-movement-from-kubernetes-sa-via-assumerolewithwebidentity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/lateral_movement_k8_assumed_web_identity_session_with_multi_phase_api_use", "/en/security/*/aws-management-console-brute-force-of-root-user-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_root_console_failure_brute_force", "/en/security/*/aws-management-console-root-login.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_console_login_root", - "/en/security/*/aws-rds-cluster-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_rds_cluster_creation", + "/en/security/*/aws-organizations-delegated-administrator-registered.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_organizations_delegated_admin_registered", + "/en/security/*/aws-potential-cryptomining-via-ecs-task-definition-deployment.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_ecs_cryptomining_task_definition_deployment", + "/en/security/*/aws-rare-source-as-organization-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_aws_api_unusual_asn", + "/en/security/*/aws-rds-cluster-creation.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/aws-rds-db-instance-made-public.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_rds_instance_made_public", + "/en/security/*/aws-rds-db-instance-or-cluster-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion", "/en/security/*/aws-rds-db-instance-or-cluster-deletion-protection-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled", "/en/security/*/aws-rds-db-instance-or-cluster-password-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_rds_db_instance_password_modified", "/en/security/*/aws-rds-db-instance-restored.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_rds_instance_restored", "/en/security/*/aws-rds-db-snapshot-created.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_aws_rds_snapshot_created", "/en/security/*/aws-rds-db-snapshot-shared-with-another-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account", - "/en/security/*/aws-rds-instance-cluster-stoppage.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_rds_instance_cluster_stoppage", - "/en/security/*/aws-rds-instance-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_rds_instance_creation", - "/en/security/*/aws-rds-security-group-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_rds_group_creation", - "/en/security/*/aws-rds-security-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_rds_group_deletion", + "/en/security/*/aws-rds-instance-cluster-stoppage.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-rds-instance-creation.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-rds-security-group-creation.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-rds-security-group-deletion.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/aws-rds-snapshot-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_rds_snapshot_deleted", "/en/security/*/aws-rds-snapshot-export.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_rds_snapshot_export", - "/en/security/*/aws-redshift-cluster-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_redshift_instance_creation", - "/en/security/*/aws-root-login-without-mfa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_root_login_without_mfa", + "/en/security/*/aws-redshift-cluster-creation.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/aws-root-console-login-password-spraying.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_root_console_password_spraying", + "/en/security/*/aws-root-login-without-mfa.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/aws-route-53-domain-transfer-lock-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled", "/en/security/*/aws-route-53-domain-transferred-to-another-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account", + "/en/security/*/aws-route-53-private-hosted-zone-associated-with-a-vpc.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc", + "/en/security/*/aws-route-53-resolver-query-log-configuration-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion", "/en/security/*/aws-route-table-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_route_table_created", "/en/security/*/aws-route53-private-hosted-zone-associated-with-a-vpc.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc", + "/en/security/*/aws-s3-bucket-acl-modified-to-allow-public-access-by-new-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/collection_s3_bucket_acl_public_access_new_identity", "/en/security/*/aws-s3-bucket-configuration-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion", "/en/security/*/aws-s3-bucket-enumeration-or-brute-force.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force", "/en/security/*/aws-s3-bucket-expiration-lifecycle-configuration-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_s3_bucket_lifecycle_expiration_added", + "/en/security/*/aws-s3-bucket-mfa-delete-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_mfa_delete_disabled", + "/en/security/*/aws-s3-bucket-policy-added-to-allow-public-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_public_access", "/en/security/*/aws-s3-bucket-policy-added-to-share-with-external-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access", "/en/security/*/aws-s3-bucket-replicated-to-another-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account", "/en/security/*/aws-s3-bucket-server-access-logging-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_s3_bucket_server_access_logging_disabled", + "/en/security/*/aws-s3-credential-file-retrieved-from-bucket.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_credentials_in_s3_bucket", "/en/security/*/aws-s3-object-encryption-using-external-kms-key.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key", "/en/security/*/aws-s3-object-versioning-suspended.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_object_versioning_disabled", + "/en/security/*/aws-s3-static-site-javascript-file-uploaded.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_static_site_js_file_uploaded", "/en/security/*/aws-s3-unauthenticated-bucket-access-by-rare-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/collection_s3_unauthenticated_bucket_access_by_rare_source", + "/en/security/*/aws-sagemaker-execution-role-passed-by-unusual-principal.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_sagemaker_execution_role_passed_by_unusual_principal", + "/en/security/*/aws-sagemaker-notebook-lifecycle-configuration-with-suspicious-script-content.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_sagemaker_lifecycle_config_suspicious_script_content", + "/en/security/*/aws-secrets-manager-rapid-secrets-retrieval.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager", + "/en/security/*/aws-security-hub-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_securityhub_disabled", + "/en/security/*/aws-sensitive-iam-operations-performed-via-cloudshell.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_sensitive_operations_via_cloudshell", + "/en/security/*/aws-service-quota-increase-requested-by-rare-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/resource_development_service_quota_increase_by_rare_identity", "/en/security/*/aws-service-quotas-multi-region-getservicequota-requests.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests", - "/en/security/*/aws-signin-single-factor-console-login-with-federated-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_signin_console_login_no_mfa", - "/en/security/*/aws-sns-email-subscription-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user", + "/en/security/*/aws-ses-account-email-sending-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/resource_development_ses_account_sending_enabled", + "/en/security/*/aws-ses-email-identity-verified-then-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted", + "/en/security/*/aws-ses-enumeration-via-long-term-access-key.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ses_enumeration_via_long_term_access_key", + "/en/security/*/aws-ses-full-access-policy-attached-to-iam-entity-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_ses_fullaccess_policy_attached_by_unusual_user", + "/en/security/*/aws-sign-in-console-login-with-federated-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_signin_console_login_federated_user", + "/en/security/*/aws-sign-in-root-password-recovery-requested.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_password_recovery", + "/en/security/*/aws-sign-in-token-created.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_aws_signin_token_created", + "/en/security/*/aws-signin-single-factor-console-login-with-federated-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_signin_console_login_federated_user", + "/en/security/*/aws-sns-email-subscription-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user", + "/en/security/*/aws-sns-rare-protocol-subscription-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user", "/en/security/*/aws-sns-topic-created-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/resource_development_sns_topic_created_by_rare_user", + "/en/security/*/aws-sns-topic-message-publish-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user", "/en/security/*/aws-sqs-queue-purge.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_sqs_purge_queue", + "/en/security/*/aws-ssm-agent-registered-via-hybrid-activation.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_aws_ssm_agent_registered_via_hybrid_activation", "/en/security/*/aws-ssm-command-document-created-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_ssm_command_document_created_by_rare_user", + "/en/security/*/aws-ssm-inventory-reconnaissance-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ssm_inventory_reconnaissance", "/en/security/*/aws-ssm-sendcommand-execution-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user", "/en/security/*/aws-ssm-sendcommand-with-run-shell-command-parameters.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters", + "/en/security/*/aws-ssm-session-manager-child-process-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_aws_ssm_session_manager_child_process", + "/en/security/*/aws-ssm-session-started-to-ec2-instance.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/lateral_movement_aws_ssm_start_session_to_ec2_instance", "/en/security/*/aws-sts-assumerole-with-new-mfa-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_sts_assume_role_with_new_mfa", "/en/security/*/aws-sts-assumeroot-by-rare-user-and-member-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account", "/en/security/*/aws-sts-getcalleridentity-api-called-for-the-first-time.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity", - "/en/security/*/aws-sts-getsessiontoken-abuse.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse", + "/en/security/*/aws-sts-getfederationtoken-with-administratoraccess-in-request.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_sts_get_federation_token_administrator_access", + "/en/security/*/aws-sts-getsessiontoken-abuse.html": "/docs/reference/security/prebuilt-rules/rules_building_block/privilege_escalation_sts_getsessiontoken_abuse", + "/en/security/*/aws-sts-getsessiontoken-usage.html": "/docs/reference/security/prebuilt-rules/rules_building_block/privilege_escalation_sts_getsessiontoken_abuse", "/en/security/*/aws-sts-role-assumption-by-service.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_role_assumption_by_service", "/en/security/*/aws-sts-role-assumption-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_role_assumption_by_user", "/en/security/*/aws-sts-role-chaining.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_sts_role_chaining", + "/en/security/*/aws-suspicious-user-agent-fingerprint.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/initial_access_suspicious_user_agent_detected_in_cloudtrail", "/en/security/*/aws-systems-manager-securestring-parameter-request-with-decryption-flag.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_retrieve_secure_string_parameters_via_ssm", "/en/security/*/aws-vpc-flow-logs-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion", "/en/security/*/aws-waf-access-control-list-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_waf_acl_deletion", "/en/security/*/aws-waf-rule-or-rule-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion", - "/en/security/*/azure-active-directory-high-risk-sign-in.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_azure_active_directory_high_risk_signin", - "/en/security/*/azure-active-directory-high-risk-user-sign-in-heuristic.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed", - "/en/security/*/azure-active-directory-powershell-sign-in.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_azure_active_directory_powershell_signin", - "/en/security/*/azure-ad-global-administrator-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_global_administrator_role_assigned", - "/en/security/*/azure-alert-suppression-rule-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_suppression_rule_created", - "/en/security/*/azure-application-credential-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_azure_application_credential_modification", - "/en/security/*/azure-automation-account-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_automation_account_created", - "/en/security/*/azure-automation-runbook-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_automation_runbook_created_or_modified", - "/en/security/*/azure-automation-runbook-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_azure_automation_runbook_deleted", - "/en/security/*/azure-automation-webhook-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_automation_webhook_created", - "/en/security/*/azure-blob-container-access-level-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_blob_container_access_mod", - "/en/security/*/azure-blob-permissions-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_azure_blob_permissions_modified", - "/en/security/*/azure-command-execution-on-virtual-machine.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_command_virtual_machine", - "/en/security/*/azure-diagnostic-settings-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_azure_diagnostic_settings_deletion", - "/en/security/*/azure-entra-id-password-spraying-non-interactive-sfa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_password_spraying_non_interactive_sfa", - "/en/security/*/azure-entra-id-rare-app-id-for-principal-authentication.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_rare_app_id_for_principal_auth", - "/en/security/*/azure-entra-id-rare-authentication-requirement-for-principal-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_rare_authentication_requirement_for_principal_user", - "/en/security/*/azure-entra-mfa-totp-brute-force-attempts.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_entra_totp_brute_force_attempts", - "/en/security/*/azure-entra-sign-in-brute-force-against-microsoft-365-accounts.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_signin_brute_force_microsoft_365", - "/en/security/*/azure-entra-sign-in-brute-force-microsoft-365-accounts-by-repeat-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_signin_brute_force_microsoft_365_repeat_source", - "/en/security/*/azure-event-hub-authorization-rule-created-or-updated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/collection_update_event_hub_auth_rule", + "/en/security/*/azcopy-or-azure-storage-explorer-usage-on-unusual-host.html": "/docs/reference/security/prebuilt-rules/rules/windows/exfiltration_azcopy_storageexplorer", + "/en/security/*/azure-active-directory-high-risk-sign-in.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin", + "/en/security/*/azure-active-directory-high-risk-user-sign-in-heuristic.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in", + "/en/security/*/azure-active-directory-powershell-sign-in.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_powershell_signin", + "/en/security/*/azure-ad-global-administrator-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned", + "/en/security/*/azure-ad-graph-access-with-suspicious-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_aad_graph_suspicious_user_agent", + "/en/security/*/azure-ad-graph-access-with-unusual-client-and-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_aad_graph_unusual_client_for_user", + "/en/security/*/azure-ad-graph-access-with-unusual-user-and-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_aad_graph_unusual_asn", + "/en/security/*/azure-ad-graph-high-4xx-error-ratio-from-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_aad_graph_high_4xx_ratio_by_user", + "/en/security/*/azure-ad-graph-potential-enumeration-roadrecon.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_aad_graph_roadrecon_aiohttp_enumeration", + "/en/security/*/azure-aks-api-server-proxying-request-to-kubelet.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/lateral_movement_azure_aks_api_server_proxy_to_kubelet", + "/en/security/*/azure-aks-attempted-user-exec-into-pod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_aks_user_exec_into_pod", + "/en/security/*/azure-aks-certificate-signing-request-created-or-approved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_aks_csr_created_or_approved", + "/en/security/*/azure-aks-coredns-or-kube-dns-configuration-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_aks_coredns_configmap_modified", + "/en/security/*/azure-aks-ephemeral-container-added-to-pod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_aks_ephemeral_container_added", + "/en/security/*/azure-aks-kubelet-proxy-to-command-execution-endpoint.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_aks_kubelet_proxy_command_endpoint", + "/en/security/*/azure-aks-kubernetes-events-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_azure_aks_events_deleted", + "/en/security/*/azure-aks-potential-api-enumeration-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_azure_aks_api_request_failure_burst", + "/en/security/*/azure-aks-secret-get-or-list-with-suspicious-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_aks_secret_access_suspicious_user_agent", + "/en/security/*/azure-aks-service-account-token-created-via-tokenrequest-api.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_aks_service_account_token_requested", + "/en/security/*/azure-aks-suspicious-self-subject-review-by-service-account-or-node-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_azure_aks_suspicious_self_subject_review", + "/en/security/*/azure-alert-suppression-rule-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created", + "/en/security/*/azure-application-credential-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_application_credential_modification", + "/en/security/*/azure-arc-cluster-credential-access-by-identity-from-unusual-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source", + "/en/security/*/azure-automation-account-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_automation_account_created", + "/en/security/*/azure-automation-runbook-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_automation_runbook_created_or_modified", + "/en/security/*/azure-automation-runbook-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_automation_runbook_deleted", + "/en/security/*/azure-automation-webhook-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_automation_webhook_created", + "/en/security/*/azure-blob-container-access-level-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_storage_blob_container_access_modification", + "/en/security/*/azure-blob-permissions-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified", + "/en/security/*/azure-blob-storage-container-access-level-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_storage_blob_container_access_modification", + "/en/security/*/azure-blob-storage-permissions-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified", + "/en/security/*/azure-command-execution-on-virtual-machine.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_compute_vm_command_executed", + "/en/security/*/azure-compute-restore-point-collection-deleted-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_compute_restore_point_collection_deleted", + "/en/security/*/azure-compute-restore-point-collections-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_compute_restore_point_collections_deleted", + "/en/security/*/azure-compute-snapshot-deletion-by-unusual-user-and-resource-group.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion", + "/en/security/*/azure-compute-snapshot-deletions-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletions", + "/en/security/*/azure-compute-vm-command-executed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_compute_vm_command_executed", + "/en/security/*/azure-diagnostic-settings-alert-suppression-rule-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created", + "/en/security/*/azure-diagnostic-settings-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion", + "/en/security/*/azure-diagnostic-settings-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion", + "/en/security/*/azure-entra-id-password-spraying-non-interactive-sfa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity", + "/en/security/*/azure-entra-id-rare-app-id-for-principal-authentication.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth", + "/en/security/*/azure-entra-id-rare-authentication-requirement-for-principal-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user", + "/en/security/*/azure-entra-mfa-totp-brute-force-attempts.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts", + "/en/security/*/azure-entra-sign-in-brute-force-against-microsoft-365-accounts.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365", + "/en/security/*/azure-entra-sign-in-brute-force-microsoft-365-accounts-by-repeat-source.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/azure-event-hub-authorization-rule-created-or-updated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_event_hub_created_or_updated", + "/en/security/*/azure-event-hub-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_event_hub_deletion", "/en/security/*/azure-event-hub-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_event_hub_deletion", - "/en/security/*/azure-external-guest-user-invitation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_external_guest_user_invite", - "/en/security/*/azure-firewall-policy-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_firewall_policy_deletion", - "/en/security/*/azure-frontdoor-web-application-firewall-waf-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_frontdoor_firewall_policy_deletion", - "/en/security/*/azure-full-network-packet-capture-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_full_network_packet_capture_detected", - "/en/security/*/azure-global-administrator-role-addition-to-pim-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_pim_user_added_global_admin", - "/en/security/*/azure-key-vault-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_key_vault_modified", + "/en/security/*/azure-external-guest-user-invitation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite", + "/en/security/*/azure-firewall-policy-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion", + "/en/security/*/azure-frontdoor-web-application-firewall-waf-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion", + "/en/security/*/azure-full-network-packet-capture-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected", + "/en/security/*/azure-global-administrator-role-addition-to-pim-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin", + "/en/security/*/azure-key-vault-excessive-secret-or-key-retrieved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_key_vault_excessive_retrieval", + "/en/security/*/azure-key-vault-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_key_vault_modified_by_unusual_user", + "/en/security/*/azure-key-vault-unusual-secret-key-usage.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_key_vault_retrieval_from_rare_identity", "/en/security/*/azure-kubernetes-events-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted", "/en/security/*/azure-kubernetes-pods-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_kubernetes_pod_deleted", - "/en/security/*/azure-kubernetes-rolebindings-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/privilege_escalation_azure_kubernetes_rolebinding_created", + "/en/security/*/azure-kubernetes-rolebindings-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created", + "/en/security/*/azure-kubernetes-services-aks-kubernetes-events-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted", + "/en/security/*/azure-kubernetes-services-aks-kubernetes-pods-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_kubernetes_pod_deleted", + "/en/security/*/azure-kubernetes-services-aks-kubernetes-rolebindings-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created", "/en/security/*/azure-network-watcher-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_network_watcher_deletion", "/en/security/*/azure-openai-insecure-output-handling.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure_openai/azure_openai_insecure_output_handling_detection", - "/en/security/*/azure-privilege-identity-management-role-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_privileged_identity_management_role_modified", - "/en/security/*/azure-resource-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_resource_group_deletion", - "/en/security/*/azure-service-principal-addition.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_azure_service_principal_addition", - "/en/security/*/azure-service-principal-credentials-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_service_principal_credentials_added", + "/en/security/*/azure-privilege-identity-management-role-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified", + "/en/security/*/azure-rbac-built-in-administrator-roles-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/privilege_escalation_azure_rbac_administrator_roles_assigned", + "/en/security/*/azure-recovery-services-resource-deleted.html": "/docs/reference/security/prebuilt-rules/rules_building_block/impact_azure_recovery_services_deletion", + "/en/security/*/azure-resource-group-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_resources_resource_group_deletion", + "/en/security/*/azure-resource-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_resources_resource_group_deletion", + "/en/security/*/azure-run-command-correlated-with-process-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_azure_vm_run_command_powershell_unrestricted_script", + "/en/security/*/azure-run-command-script-child-process.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_azure_run_command_script_child_process", + "/en/security/*/azure-service-principal-addition.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_service_principal_created", + "/en/security/*/azure-service-principal-credentials-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added", + "/en/security/*/azure-service-principal-sign-in-followed-by-arc-cluster-credential-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_service_principal_signin_then_arc_credential_listing", + "/en/security/*/azure-storage-account-blob-public-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/collection_azure_storage_account_blob_public_access_enabled", + "/en/security/*/azure-storage-account-deletion-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_storage_account_deletion", + "/en/security/*/azure-storage-account-deletions-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/impact_azure_storage_account_deletion_multiple", "/en/security/*/azure-storage-account-key-regenerated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_storage_account_key_regenerated", + "/en/security/*/azure-storage-account-keys-accessed-by-privileged-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_storage_account_keys_accessed", + "/en/security/*/azure-storage-anonymous-blob-access-to-unusual-resource.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource", + "/en/security/*/azure-storage-blob-retrieval-via-azcopy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/exfiltration_azure_storage_blob_download_azcopy_sas_token", + "/en/security/*/azure-virtual-machine-configuration-modified.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_azure_vm_configuration_modified", + "/en/security/*/azure-vm-boot-diagnostics-retrieved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_vm_boot_diagnostics_retrieved_unusual_principal", + "/en/security/*/azure-vm-extension-crud-operation-with-unusual-source-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_vm_extension_crud_unusual_source", + "/en/security/*/azure-vm-extension-deployment-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_azure_vm_extension_deployment_by_interactive_user", + "/en/security/*/azure-vm-managed-run-command-created-or-updated-with-unusual-principal.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_vm_managed_run_command_unusual_identity", + "/en/security/*/azure-vm-serial-console-connection-with-unusual-user-and-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/lateral_movement_azure_vm_serial_console_connect", + "/en/security/*/azure-vnet-firewall-front-door-waf-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion", + "/en/security/*/azure-vnet-firewall-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion", + "/en/security/*/azure-vnet-full-network-packet-capture-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected", + "/en/security/*/azure-vnet-network-watcher-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_network_watcher_deletion", + "/en/security/*/azure-wireserver-http-request-from-unexpected-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent", + "/en/security/*/azure-wireserver-openssl-certificate-decrypt-or-linuxtransport-generation.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt", + "/en/security/*/azure-wireserver-unusual-process-connection.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection", + "/en/security/*/backup-deletion-with-wbadmin.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin", "/en/security/*/base16-or-base32-encoding-decoding-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity", "/en/security/*/base64-decoded-payload-piped-to-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_interpreter_launched_from_decoded_payload", "/en/security/*/bash-shell-profile-modification.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/persistence_shell_profile_modification", @@ -11297,29 +11525,38 @@ "/en/security/*/benchmark-rules.html": "/docs/solutions/security/cloud/benchmarks", "/en/security/*/binary-content-copy-via-cmd-exe.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_cmd_copy_binary_contents", "/en/security/*/binary-executed-from-shared-memory-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_process_started_in_shared_memory_directory", + "/en/security/*/binfmt-configuration-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_binfmt_configuration_file_creation", "/en/security/*/bitsadmin-activity.html": "/docs/reference/security/prebuilt-rules/rules_building_block/command_and_control_bitsadmin_activity", "/en/security/*/blocklist-api.html": "/docs/api/doc/kibana/group/endpoint-security-exceptions-api", "/en/security/*/blocklist.html": "/docs/solutions/security/manage-elastic-defend/blocklist", "/en/security/*/boot-file-copy.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_boot_file_copy", "/en/security/*/bpf-filter-applied-using-tc.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_tc_bpf_filter", + "/en/security/*/bpf-program-or-map-load-via-bpftool.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_bpf_program_or_map_load", + "/en/security/*/bpf-program-tampering-via-bpftool.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_bpf_program_tampering", "/en/security/*/browser-extension-install.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_browser_extension_install", + "/en/security/*/browser-process-spawned-from-an-unusual-parent.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_browsers_unusual_parent", "/en/security/*/building-block-rule.html": "/docs/solutions/security/detect-and-alert/about-building-block-rules", "/en/security/*/bulk-actions-anonymization-fields-api.html": "/docs/api/doc/kibana/operation/operation-performanonymizationfieldsbulkaction", "/en/security/*/bulk-actions-prompts-api.html": "/docs/api/doc/kibana/operation/operation-performpromptsbulkaction", "/en/security/*/bulk-actions-rules-api.html": "/docs/api/doc/kibana/operation/operation-performrulesbulkaction", "/en/security/*/bypass-uac-via-event-viewer.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_uac_bypass_event_viewer", - "/en/security/*/cap-sys-admin-assigned-to-binary.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_cap_sys_admin_added_to_new_binary", + "/en/security/*/cap-sys-admin-assigned-to-binary.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/case-permissions.html": "/docs/solutions/security/investigate/cases-requirements", "/en/security/*/cases-api-overview.html": "/docs/api/doc/kibana/group/endpoint-cases", "/en/security/*/cases-manage-settings.html": "/docs/solutions/security/investigate/configure-case-settings", "/en/security/*/cases-open-manage.html": "/docs/solutions/security/investigate/open-manage-cases", "/en/security/*/cases-overview.html": "/docs/solutions/security/investigate/cases", + "/en/security/*/cassandra-javascript-udf-creation.html": "/docs/reference/security/prebuilt-rules/rules/network/execution_cassandra_javascript_udf_creation", "/en/security/*/chat-complete-api.html": "/docs/api/doc/kibana/operation/operation-chatcomplete", "/en/security/*/chkconfig-service-add.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_chkconfig_service_add", + "/en/security/*/chroot-execution-in-container-context-on-linux.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_chroot_execution_container_context", + "/en/security/*/claude-cowork-vm-boot-image-tamper.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_claude_cowork_vm_boot_image_tamper", "/en/security/*/clearing-windows-console-history.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_clearing_windows_console_history", "/en/security/*/clearing-windows-event-logs.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_clearing_windows_event_logs", + "/en/security/*/cloud-instance-metadata-credential-path-http-request.html": "/docs/reference/security/prebuilt-rules/rules/network/credential_access_cloud_imds_credential_http_request", "/en/security/*/cloud-nat-sec-posture-dashboard.html": "/docs/solutions/security/dashboards/cloud-security-posture-dashboard", "/en/security/*/cloud-native-security-overview.html": "/docs/solutions/security/cloud", + "/en/security/*/cloud-offensive-framework-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/discovery_cloud_offensive_framework_execution", "/en/security/*/cloud-posture-dashboard.html": "/docs/solutions/security/dashboards/cloud-security-posture-dashboard", "/en/security/*/cloud-workload-protection.html": "/docs/solutions/security/cloud/cloud-workload-protection-for-vms", "/en/security/*/cobalt-strike-command-and-control-beacon.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_cobalt_strike_beacon", @@ -11328,6 +11565,8 @@ "/en/security/*/command-and-scripting-interpreter-via-windows-scripts.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_powershell_susp_args_via_winscript", "/en/security/*/command-execution-via-forfiles.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_indirect_exec_forfiles", "/en/security/*/command-execution-via-solarwinds-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell", + "/en/security/*/command-line-obfuscation-via-whitespace-padding.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_whitespace_padding_command_line", + "/en/security/*/command-obfuscation-via-unicode-modifier-letters.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_obf_args_unicode_modified_letters", "/en/security/*/command-prompt-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_command_prompt_connecting_to_the_internet", "/en/security/*/command-shell-activity-started-via-rundll32.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_command_shell_via_rundll32", "/en/security/*/component-object-model-hijacking.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_suspicious_com_hijack_registry", @@ -11337,10 +11576,13 @@ "/en/security/*/conhost-spawned-by-suspicious-parent-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_via_hidden_shell_conhost", "/en/security/*/connect-to-byo-llm.html": "/docs/solutions/security/ai/connect-to-own-local-llm", "/en/security/*/connect-to-vertex.html": "/docs/solutions/security/ai/connect-to-google-vertex", + "/en/security/*/connection-to-common-large-language-model-endpoints.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_common_llm_endpoint", "/en/security/*/connection-to-commonly-abused-free-ssl-certificate-providers.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_encrypted_channel_freesslcert", "/en/security/*/connection-to-commonly-abused-web-services.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_common_webservices", "/en/security/*/connection-to-external-network-via-telnet.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_telnet_network_activity_external", "/en/security/*/connection-to-internal-network-via-telnet.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_telnet_network_activity_internal", + "/en/security/*/container-management-utility-run-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_container_management_binary_launched_inside_container", + "/en/security/*/container-runtime-cli-execution-with-suspicious-arguments.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_container_runtime_cli_suspicious_arguments", "/en/security/*/control-panel-process-with-unusual-arguments.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_control_panel_suspicious_args", "/en/security/*/conversation-api-create.html": "/docs/api/doc/kibana/operation/operation-createconversation", "/en/security/*/conversation-api-delete.html": "/docs/api/doc/kibana/operation/operation-deleteconversation", @@ -11354,18 +11596,20 @@ "/en/security/*/creation-of-hidden-launch-agent-or-daemon.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation", "/en/security/*/creation-of-hidden-login-item-via-apple-script.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_creation_hidden_login_item_osascript", "/en/security/*/creation-of-hidden-shared-object-file.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_hidden_shared_object", - "/en/security/*/creation-of-kernel-module.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_creation_of_kernel_module", + "/en/security/*/creation-of-kernel-module.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/creation-of-settingcontent-ms-files.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_settingcontent_ms_file_creation", "/en/security/*/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_gpo_schtask_service_creation", "/en/security/*/creation-or-modification-of-domain-backup-dpapi-private-key.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_domain_backup_dpapi_private_keys", "/en/security/*/creation-or-modification-of-pluggable-authentication-module-or-configuration.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_pluggable_authentication_module_creation", "/en/security/*/creation-or-modification-of-root-certificate.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_create_mod_root_certificate", + "/en/security/*/credential-access-via-trufflehog-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_trufflehog_execution", "/en/security/*/credential-acquisition-via-registry-hive-dumping.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dump_registry_hives", "/en/security/*/credential-dumping-detected-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/credential_access_endgame_cred_dumping_detected", "/en/security/*/credential-dumping-prevented-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/credential_access_endgame_cred_dumping_prevented", "/en/security/*/credential-manipulation-detected-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected", "/en/security/*/credential-manipulation-prevented-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented", "/en/security/*/cron-job-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_cron_job_creation", + "/en/security/*/crowdstrike-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/crowdstrike_external_alerts", "/en/security/*/cspm-benchmark-rules.html": "/docs/solutions/security/cloud/benchmarks", "/en/security/*/cspm-findings-page.html": "/docs/solutions/security/cloud/findings-page", "/en/security/*/cspm-get-started-azure.html": "/docs/solutions/security/cloud/get-started-with-cspm-for-azure", @@ -11376,41 +11620,65 @@ "/en/security/*/cspm-security-posture-faq.html": "/docs/solutions/security/cloud/cspm-frequently-asked-questions-faq", "/en/security/*/cspm.html": "/docs/solutions/security/cloud/cloud-security-posture-management", "/en/security/*/cupsd-or-foomatic-rip-shell-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_cupsd_foomatic_rip_shell_execution", + "/en/security/*/curl-execution-via-shell-profile.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_curl_execution_via_shell_profile", + "/en/security/*/curl-or-wget-egress-network-connection-via-lolbin.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_curl_or_wget_executed_via_lolbin", + "/en/security/*/curl-or-wget-execution-from-container-context.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_auditd_curl_wget_from_container", + "/en/security/*/curl-or-wget-spawned-via-node-js.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent", "/en/security/*/curl-socks-proxy-activity-from-unusual-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_curl_socks_proxy_detected", "/en/security/*/cyberark-privileged-access-security-error.html": "/docs/reference/security/prebuilt-rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_error_audit_event_promotion", "/en/security/*/cyberark-privileged-access-security-recommended-monitor.html": "/docs/reference/security/prebuilt-rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion", "/en/security/*/d-bus-service-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_dbus_service_creation", "/en/security/*/dashboards-overview.html": "/docs/solutions/security/dashboards", + "/en/security/*/data-encrypted-via-openssl-utility.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_data_encrypted_via_openssl", "/en/security/*/data-quality-dash.html": "/docs/solutions/security/dashboards/data-quality-dashboard", "/en/security/*/data-views-in-sec.html": "/docs/solutions/security/get-started/data-views-elastic-security", "/en/security/*/decline-in-host-based-traffic.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_low_count_events_for_a_host_name", "/en/security/*/default-cobalt-strike-team-server-certificate.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_cobalt_strike_default_teamserver_cert", "/en/security/*/delayed-execution-via-ping.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_delayed_via_ping_lolbas_unsigned", + "/en/security/*/delegated-managed-service-account-modification-by-an-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_badsuccessor_dmsa_abuse", "/en/security/*/delete-criticality-api-delete.html": "/docs/api/doc/kibana/operation/operation-deleteassetcriticalityrecord", "/en/security/*/delete-volume-usn-journal-with-fsutil.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil", "/en/security/*/deleting-backup-catalogs-with-wbadmin.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin", "/en/security/*/deploy-elastic-endpoint-ven.html": "/docs/solutions/security/configure-elastic-defend/enable-access-for-macos-ventura-higher", "/en/security/*/deploy-elastic-endpoint.html": "/docs/solutions/security/configure-elastic-defend/enable-access-for-macos-monterey", "/en/security/*/deploy-with-mdm.html": "/docs/solutions/security/configure-elastic-defend/deploy-on-macos-with-mdm", - "/en/security/*/deprecated-suspicious-file-creation-in-etc-for-persistence.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_etc_file_creation", + "/en/security/*/deprecated-m365-exchange-dlp-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed", + "/en/security/*/deprecated-m365-security-compliance-potential-ransomware-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity", + "/en/security/*/deprecated-m365-security-compliance-unusual-volume-of-file-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion", + "/en/security/*/deprecated-m365-security-compliance-user-restricted-from-sending-email.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email", + "/en/security/*/deprecated-m365-teams-external-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled", + "/en/security/*/deprecated-m365-teams-guest-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_teams_guest_access_enabled", + "/en/security/*/deprecated-microsoft-exchange-transport-agent-install-script.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_transport_agent_exchange", + "/en/security/*/deprecated-powershell-script-with-discovery-capabilities.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_posh_generic", + "/en/security/*/deprecated-powershell-script-with-remote-execution-capabilities-via-winrm.html": "/docs/reference/security/prebuilt-rules/rules_building_block/lateral_movement_posh_winrm_activity", + "/en/security/*/deprecated-suspicious-file-creation-in-etc-for-persistence.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/deprecated-tls-version-or-weak-cipher-negotiated-externally.html": "/docs/reference/security/prebuilt-rules/rules/network/credential_access_tls_deprecated_or_weak_cipher_negotiation", + "/en/security/*/deprecated-unusual-discovery-activity-by-user.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_signal_unusual_user_host", + "/en/security/*/detection-alert-on-a-process-exhibiting-cpu-spike.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/impact_alert_from_a_process_with_cpu_spike", "/en/security/*/detection-engine-overview.html": "/docs/solutions/security/detect-and-alert", "/en/security/*/detection-entity-dashboard.html": "/docs/solutions/security/dashboards/entity-analytics-dashboard", "/en/security/*/detection-response-dashboard.html": "/docs/solutions/security/dashboards/detection-response-dashboard", "/en/security/*/detections-logsdb-index-mode-impact.html": "/docs/solutions/security/detect-and-alert/using-logsdb-index-mode-with-elastic-security", "/en/security/*/detections-permissions-section.html": "/docs/solutions/security/detect-and-alert/detections-requirements", "/en/security/*/detections-ui-exceptions.html": "/docs/solutions/security/detect-and-alert/rule-exceptions", + "/en/security/*/direct-process-execution-via-background-utility.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_setsid_nohup_disown_direct_process_execution", "/en/security/*/directory-creation-in-bin-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_directory_creation_in_bin", "/en/security/*/disable-windows-event-and-security-logs-using-built-in-tools.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_disabling_windows_logs", "/en/security/*/disable-windows-firewall-rules-via-netsh.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh", + "/en/security/*/disabling-lsa-protection-via-registry-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_lsass_ppl_disabled_registry", "/en/security/*/disabling-user-account-control-via-registry-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_disable_uac_registry", "/en/security/*/disabling-windows-defender-security-settings-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_disabling_windows_defender_powershell", + "/en/security/*/discovery-command-output-written-to-suspicious-file.html": "/docs/reference/security/prebuilt-rules/rules/macos/collection_discovery_output_written_to_suspicious_file", "/en/security/*/discovery-of-domain-groups.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_of_domain_groups", "/en/security/*/discovery-of-internet-capabilities-via-built-in-tools.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_internet_capabilities", + "/en/security/*/dmsa-account-creation-by-an-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_dmsa_creation_by_unusual_user", "/en/security/*/dnf-package-manager-plugin-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_dnf_package_manager_plugin_file_creation", "/en/security/*/dns-global-query-block-list-modified-or-disabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist", "/en/security/*/dns-over-https-enabled-via-registry.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_dns_over_https_enabled", - "/en/security/*/dns-tunneling.html": "/docs/reference/security/prebuilt-rules/rules/ml/command_and_control_ml_packetbeat_dns_tunneling", + "/en/security/*/dns-request-for-ip-lookup-service-via-unsigned-binary.html": "/docs/reference/security/prebuilt-rules/rules/macos/discovery_dns_request_for_ip_lookup_service", + "/en/security/*/dns-tunneling.html": "/docs/reference/security/prebuilt-rules/rules/ml/command_and_control_ml_dns_tunneling", "/en/security/*/docker-escape-via-nsenter.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_docker_escape_via_nsenter", + "/en/security/*/docker-release-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_docker_release_file_creation", "/en/security/*/docker-socket-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_docker_socket_discovery", "/en/security/*/domain-added-to-google-workspace-trusted-domains.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/defense_evasion_domain_added_to_google_workspace_trusted_domains", "/en/security/*/downloaded-shortcut-files.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_downloaded_shortcut_files", @@ -11419,17 +11687,25 @@ "/en/security/*/dracut-module-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_dracut_module_creation", "/en/security/*/dumping-account-hashes-via-built-in-commands.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_dumping_hashes_bi_cmds", "/en/security/*/dumping-of-keychain-content-via-security-command.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_dumping_keychain_security", + "/en/security/*/dylib-injection-via-process-environment-variables.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_dylib_injection_via_env_vars", + "/en/security/*/dynamic-iex-reconstruction-via-method-string-access.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction", "/en/security/*/dynamic-linker-copy.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_dynamic_linker_backup", "/en/security/*/dynamic-linker-creation-or-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_dynamic_linker_file_creation", + "/en/security/*/dynamic-linker-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_dynamic_linker_file_creation", "/en/security/*/dynamic-linker-ld-so-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_ld_so_creation", "/en/security/*/ec2-ami-shared-with-another-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account", - "/en/security/*/eggshell-backdoor-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_pentest_eggshell_remote_admin_tool", + "/en/security/*/eggshell-backdoor-execution.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/egress-connection-from-entrypoint-in-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_egress_connection_from_entrypoint_in_container", + "/en/security/*/eks-authentication-configuration-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_kubernetes_eks_aws_auth_configmap_modified", "/en/security/*/elastic-agent-service-terminated.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_elastic_agent_service_terminated", + "/en/security/*/elastic-defend-alert-followed-by-telemetry-loss.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_missing_events_after_alert", + "/en/security/*/elastic-defend-and-email-alerts-correlation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_email_elastic_defend_correlation", + "/en/security/*/elastic-defend-and-network-security-alerts-correlation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host", "/en/security/*/elastic-endpoint-deploy-reqs.html": "/docs/solutions/security/configure-elastic-defend/elastic-defend-requirements", + "/en/security/*/elastic-security-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/elastic_security_external_alerts", "/en/security/*/emond-rules-creation-or-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_emond_rules_file_creation", "/en/security/*/enable-host-network-discovery-via-netsh.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_enable_network_discovery_with_netsh", - "/en/security/*/encoded-executable-stored-in-the-registry.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_hide_encoded_executable_registry", + "/en/security/*/encoded-executable-stored-in-the-registry.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/encrypting-files-with-winrar-or-7z.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_winrar_encryption", "/en/security/*/endpoint-artifacts.html": "/docs/solutions/security/manage-elastic-defend/optimize-elastic-defend", "/en/security/*/endpoint-command-ref.html": "/docs/reference/security/endpoint-command-reference", @@ -11443,7 +11719,86 @@ "/en/security/*/endpoint-self-protection.html": "/docs/solutions/security/manage-elastic-defend/elastic-endpoint-self-protection-features", "/en/security/*/entity-risk-scoring.html": "/docs/solutions/security/advanced-entity-analytics/entity-risk-scoring", "/en/security/*/entity-store.html": "/docs/solutions/security/advanced-entity-analytics/entity-store", - "/en/security/*/entra-id-device-code-auth-with-broker-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_device_code_auth_with_broker_client", + "/en/security/*/entra-id-actor-token-user-impersonation-abuse.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse", + "/en/security/*/entra-id-adrs-token-request-by-microsoft-authentication-broker.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_suspicious_adrs_token_request", + "/en/security/*/entra-id-aitm-phishing-kit-chain-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_device_registration_to_prt_chain", + "/en/security/*/entra-id-application-credential-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_application_credential_modification", + "/en/security/*/entra-id-application-self-assigned-to-privileged-role.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/entra-id-concurrent-sign-in-with-suspicious-properties.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_suspicious_signin", + "/en/security/*/entra-id-conditional-access-mfa-bypass-with-unusual-user-client-and-source-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_entra_id_ca_mfa_bypass_first_party_graph", + "/en/security/*/entra-id-conditional-access-policy-cap-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_conditional_access_policy_modified", + "/en/security/*/entra-id-custom-domain-added-or-verified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/resource_development_entra_id_custom_domain_added_and_verified", + "/en/security/*/entra-id-device-bound-prt-from-unusual-device-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_prt_from_unusual_device_ip", + "/en/security/*/entra-id-device-bound-prt-replay-via-first-party-app-from-unusual-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_prt_cookie_replay_unusual_ip", + "/en/security/*/entra-id-device-code-auth-with-broker-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client", + "/en/security/*/entra-id-device-registration-with-phishing-kit-default-os-build.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_phishing_kit_default_os_build_device_registration", + "/en/security/*/entra-id-device-registration-with-roadtools-default-os-build.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_roadtools_default_device_registration", + "/en/security/*/entra-id-device-with-roadtools-default-os-build-entity-analytics.html": "/docs/reference/security/prebuilt-rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_roadtools_default_os_build", + "/en/security/*/entra-id-domain-federation-configuration-change.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/privilege_escalation_entra_id_tenant_domain_federation_via_audit_logs", + "/en/security/*/entra-id-elevated-access-to-user-access-administrator.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access", + "/en/security/*/entra-id-external-authentication-methods-eam-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_graph_eam_addition_or_modification", + "/en/security/*/entra-id-external-guest-user-invited.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite", + "/en/security/*/entra-id-federated-identity-credential-issuer-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_service_principal_federated_issuer_modified", + "/en/security/*/entra-id-global-administrator-role-assigned-pim-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin", + "/en/security/*/entra-id-global-administrator-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned", + "/en/security/*/entra-id-guest-account-promoted-to-member.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_guest_account_promoted_to_member", + "/en/security/*/entra-id-high-risk-sign-in.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin", + "/en/security/*/entra-id-high-risk-user-sign-in-heuristic.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in", + "/en/security/*/entra-id-illicit-consent-grant-via-registered-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application", + "/en/security/*/entra-id-kali365-default-user-agent-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_kali365_user_agent", + "/en/security/*/entra-id-mfa-disabled-for-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user", + "/en/security/*/entra-id-mfa-totp-brute-force-attempted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts", + "/en/security/*/entra-id-microsoft-authentication-broker-drs-sign-in-from-suspicious-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_microsoft_auth_broker_drs_signin_from_suspicious_asn", + "/en/security/*/entra-id-microsoft-authentication-broker-sign-in-to-unusual-resource.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_unusual_resource", + "/en/security/*/entra-id-microsoft-authentication-broker-sign-in-with-non-standard-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_nonstandard_user_agent", + "/en/security/*/entra-id-multiple-device-registrations-by-a-single-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_multiple_device_registrations", + "/en/security/*/entra-id-oauth-application-redirect-uri-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_oauth_app_redirect_uri_modified", + "/en/security/*/entra-id-oauth-authorization-code-grant-for-unusual-user-app-and-resource.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_oauth_auth_code_grant_unusual_app_resource_user", + "/en/security/*/entra-id-oauth-device-code-flow-with-concurrent-sign-ins.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin", + "/en/security/*/entra-id-oauth-device-code-grant-by-microsoft-authentication-broker.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client", + "/en/security/*/entra-id-oauth-device-code-grant-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth", + "/en/security/*/entra-id-oauth-device-code-phishing-via-aitm.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm", + "/en/security/*/entra-id-oauth-device-code-sign-in-to-azure-ad-graph-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_device_code_signin_aad_graph_enum", + "/en/security/*/entra-id-oauth-flow-by-microsoft-authentication-broker-to-device-registration-service-drs.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs", + "/en/security/*/entra-id-oauth-phishing-via-first-party-microsoft-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_oauth_phishing_via_first_party_microsoft_application", + "/en/security/*/entra-id-oauth-prt-issuance-to-non-managed-device-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device", + "/en/security/*/entra-id-oauth-ropc-grant-login-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt", + "/en/security/*/entra-id-oauth-user-impersonation-scope-for-unusual-user-and-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope", + "/en/security/*/entra-id-oauth-user-impersonation-to-microsoft-graph.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses", + "/en/security/*/entra-id-phishing-kit-default-os-build-entity-analytics.html": "/docs/reference/security/prebuilt-rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_phishing_kit_default_os_build", + "/en/security/*/entra-id-potential-aitm-sign-in-via-officehome-tycoon2fa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_tycoon_entra_id", + "/en/security/*/entra-id-powershell-sign-in.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_powershell_signin", + "/en/security/*/entra-id-privileged-identity-management-pim-role-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified", + "/en/security/*/entra-id-privileged-role-assigned-to-another-account.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/entra-id-protection-admin-confirmed-compromise.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise", + "/en/security/*/entra-id-protection-alerts-for-user-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_protection_alerts_for_user", + "/en/security/*/entra-id-protection-risk-detection-sign-in-risk.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_protection_sign_in_risk_detected", + "/en/security/*/entra-id-protection-risk-detection-user-risk.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_protection_user_risk_detected", + "/en/security/*/entra-id-protection-risk-detection.html": "/docs/reference/security/prebuilt-rules/rules_building_block/entra_id_identity_protection_risk_detections", + "/en/security/*/entra-id-protection-user-alert-and-device-registration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg", + "/en/security/*/entra-id-register-device-with-phishing-kit-or-roadtools-user-agent.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/entra-id-register-device-with-unusual-user-agent-azure-ad-join.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_register_device_unusual_user_agent", + "/en/security/*/entra-id-ropc-authentication-with-unknown-client-id.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_ropc_unknown_client_id", + "/en/security/*/entra-id-service-principal-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_service_principal_created", + "/en/security/*/entra-id-service-principal-credentials-created-by-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added", + "/en/security/*/entra-id-service-principal-federated-credential-authentication-by-unusual-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_federated_login_by_unusual_client", + "/en/security/*/entra-id-service-principal-with-unusual-source-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_service_principal_signin_unusual_source_asn", + "/en/security/*/entra-id-sharepoint-or-onedrive-accessed-by-unusual-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/collection_entra_id_sharepoint_access_from_unusual_application", + "/en/security/*/entra-id-sign-in-bloodhound-suite-user-agent-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_bloodhound_user_agents_detected", + "/en/security/*/entra-id-sign-in-brute-force-attempted-microsoft-365.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365", + "/en/security/*/entra-id-sign-in-teamfiltration-user-agent-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_entra_id_teamfiltration_user_agents_detected", + "/en/security/*/entra-id-temporary-access-pass-created-for-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_temporary_access_pass_created", + "/en/security/*/entra-id-unusual-cloud-device-registration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_suspicious_cloud_device_registration", + "/en/security/*/entra-id-user-added-as-registered-application-owner.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application", + "/en/security/*/entra-id-user-added-as-service-principal-owner.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal", + "/en/security/*/entra-id-user-reported-suspicious-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_user_reported_risk", + "/en/security/*/entra-id-user-sign-in-brute-force-attempted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity", + "/en/security/*/entra-id-user-sign-in-via-unusual-legacy-authentication-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_unusual_legacy_auth_client_signin", + "/en/security/*/entra-id-user-sign-in-with-unusual-authentication-type.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user", + "/en/security/*/entra-id-user-sign-in-with-unusual-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth", + "/en/security/*/entra-id-user-sign-in-with-unusual-non-managed-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_user_signed_in_from_unusual_device", + "/en/security/*/entra-id-windows-hello-for-business-credential-registered.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_whfb_credential_registration", + "/en/security/*/entra-id-windows-hello-or-passkey-sign-in-from-unregistered-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/defense_evasion_entra_id_whfb_key_from_unregistered_device", "/en/security/*/enumerating-domain-trusts-via-dsquery-exe.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_enumerating_domain_trusts_via_dsquery", "/en/security/*/enumerating-domain-trusts-via-nltest-exe.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_enumerating_domain_trusts_via_nltest", "/en/security/*/enumeration-command-spawned-via-wmiprvse.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_enumeration_via_wmiprvse", @@ -11458,9 +11813,34 @@ "/en/security/*/es-threat-intel-integrations.html": "/docs/solutions/security/get-started/enable-threat-intelligence-integrations", "/en/security/*/es-ui-overview.html": "/docs/solutions/security/get-started/elastic-security-ui", "/en/security/*/esql-queries-assistant.html": "/docs/solutions/security/ai/generate-customize-learn-about-esorql-queries", + "/en/security/*/esxi-account-granted-admin-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/persistence_esxi_admin_role_assigned", + "/en/security/*/esxi-attempt-to-force-install-a-vmware-vib-package.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_forced_vib_install_attempt", + "/en/security/*/esxi-audit-records-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_audit_records_disabled", + "/en/security/*/esxi-curl-or-wget-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/command_and_control_esxi_curl_or_wget", "/en/security/*/esxi-discovery-via-find.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_esxi_software_via_find", "/en/security/*/esxi-discovery-via-grep.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_esxi_software_via_grep", + "/en/security/*/esxi-execinstalledonly-protection-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_execinstalledonly_protection_disabled", + "/en/security/*/esxi-file-made-executable-with-chmod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_chmod_executable", + "/en/security/*/esxi-firewall-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_firewall_disabled", + "/en/security/*/esxi-host-logs-deleted-with-rm.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_host_logs_deleted", + "/en/security/*/esxi-host-prepared-for-an-unsigned-install.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_ssh_execinstalledonly_forced_vib", + "/en/security/*/esxi-local-account-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/persistence_esxi_account_created", + "/en/security/*/esxi-lockdown-mode-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_lockdown_mode_disabled", + "/en/security/*/esxi-multiple-logon-failures-by-user-and-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/credential_access_esxi_multiple_logon_failures", + "/en/security/*/esxi-payload-executed-against-datastore.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/execution_esxi_payload_executed_against_datastore", + "/en/security/*/esxi-root-password-accepted-from-remote-host.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/initial_access_esxi_root_password_accepted", + "/en/security/*/esxi-root-password-changed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/persistence_esxi_root_password_changed", + "/en/security/*/esxi-shell-command-obfuscation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_shell_command_obfuscation", + "/en/security/*/esxi-ssh-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/lateral_movement_esxi_ssh_enabled", + "/en/security/*/esxi-ssh-session-from-vpxuser.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/lateral_movement_esxi_vpxuser_ssh_session", + "/en/security/*/esxi-syslog-remote-host-reset.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_syslog_loghost_reset", + "/en/security/*/esxi-system-and-account-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/discovery_esxi_system_and_account_enumeration", "/en/security/*/esxi-timestomping-using-touch-command.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch", + "/en/security/*/esxi-virtual-disk-files-enumerated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/discovery_esxi_virtual_disk_enumeration", + "/en/security/*/esxi-virtual-machine-powered-off.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/impact_esxi_vm_powered_off", + "/en/security/*/esxi-virtual-machine-process-killed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/impact_esxi_vm_process_killed", + "/en/security/*/esxi-virtual-machine-process-list.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/discovery_esxi_vm_process_list", + "/en/security/*/esxi-virtual-machine-snapshot-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/impact_esxi_snapshot_removed", "/en/security/*/event-filters-api.html": "/docs/api/doc/kibana/group/endpoint-security-exceptions-api", "/en/security/*/event-filters.html": "/docs/solutions/security/manage-elastic-defend/event-filters", "/en/security/*/exceptions-api-create-container.html": "/docs/api/doc/kibana/operation/operation-createexceptionlist", @@ -11481,10 +11861,12 @@ "/en/security/*/exceptions-api-update-container.html": "/docs/api/doc/kibana/operation/operation-updateexceptionlist", "/en/security/*/exceptions-api-update-item.html": "/docs/api/doc/kibana/operation/operation-updateexceptionlistitem", "/en/security/*/excessive-aws-s3-object-encryption-with-sse-c.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c", + "/en/security/*/excessive-sudo-authentication-failures-via-macos-security-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/macos/privilege_escalation_excessive_sudo_failures_macos_security_events", "/en/security/*/exchange-mailbox-export-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_mailbox_export_winlog", "/en/security/*/exclude-cold-frozen-data-individual-rules.html": "/docs/solutions/security/detect-and-alert/exclude-cold-frozen-data-from-individual-rules", "/en/security/*/executable-bit-set-for-potential-persistence-script.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_potential_persistence_script_executable_bit_set", "/en/security/*/executable-file-creation-with-multiple-extensions.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_file_creation_mult_extension", + "/en/security/*/executable-file-download-via-wget.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_executable_download_via_wget", "/en/security/*/executable-file-with-unusual-extension.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension", "/en/security/*/executable-masquerading-as-kernel-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_kthreadd_masquerading", "/en/security/*/execute-api.html": "/docs/api/doc/kibana/operation/operation-endpointexecuteaction", @@ -11494,13 +11876,15 @@ "/en/security/*/execution-of-an-unsigned-service.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_unsigned_service_executable", "/en/security/*/execution-of-com-object-via-xwizard.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_com_object_xwizard", "/en/security/*/execution-of-file-written-or-modified-by-microsoft-office.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_ms_office_written_file", - "/en/security/*/execution-of-file-written-or-modified-by-pdf-reader.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_pdf_written_file", + "/en/security/*/execution-of-file-written-or-modified-by-pdf-reader.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/execution-of-persistent-suspicious-program.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_runtime_run_key_startup_susp_procs", "/en/security/*/execution-via-electron-child-process-node-js-module.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_defense_evasion_electron_app_childproc_node_js", + "/en/security/*/execution-via-github-actions-runner.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_via_github_actions_runner", "/en/security/*/execution-via-local-sxs-shared-module.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_shared_modules_local_sxs_dll", "/en/security/*/execution-via-microsoft-dotnet-clickonce-host.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon", "/en/security/*/execution-via-ms-visualstudio-pre-post-build-events.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent", "/en/security/*/execution-via-mssql-xp-cmdshell-stored-procedure.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure", + "/en/security/*/execution-via-openclaw-agent.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_openclaw_agent_child_process", "/en/security/*/execution-via-tsclient-mountpoint.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_execution_from_tsclient_mup", "/en/security/*/execution-via-windows-command-debugging-utility.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_lolbas_win_cdb_utility", "/en/security/*/execution-via-windows-subsystem-for-linux.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_child_process", @@ -11510,6 +11894,7 @@ "/en/security/*/exploit-prevented-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/execution_endgame_exploit_prevented", "/en/security/*/exporting-exchange-mailbox-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_email_powershell_exchange_mailbox", "/en/security/*/external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/external_alerts", + "/en/security/*/external-ip-address-discovery-via-curl.html": "/docs/reference/security/prebuilt-rules/rules/macos/discovery_external_ip_address_discovery_via_curl", "/en/security/*/external-ip-lookup-from-non-browser-process.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_post_exploitation_external_ip_lookup", "/en/security/*/external-user-added-to-google-workspace-group.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group", "/en/security/*/file-and-directory-permissions-modification.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_file_permission_modification", @@ -11517,19 +11902,26 @@ "/en/security/*/file-creation-by-cups-or-foomatic-rip-child.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_cupsd_foomatic_rip_file_creation", "/en/security/*/file-creation-execution-and-self-deletion-in-suspicious-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_file_execution_followed_by_deletion", "/en/security/*/file-creation-in-var-log-via-suspicious-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_var_log_file_creation_by_unsual_process", + "/en/security/*/file-creation-in-world-writable-directory-by-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_file_creation_world_writeable_dir_by_unusual_process", "/en/security/*/file-creation-time-changed.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_timestomp_sysmon", "/en/security/*/file-deletion-via-shred.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_file_deletion_via_shred", + "/en/security/*/file-downloaded-by-curl-wget-and-piped-to-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_payload_downloaded_by_curl_wget_and_piped_to_interpreter", "/en/security/*/file-made-immutable-by-chattr.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_chattr_immutable_file", "/en/security/*/file-or-directory-deletion-command.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_generic_deletion", "/en/security/*/file-permission-modification-in-writable-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_file_mod_writable_dir", "/en/security/*/file-staged-in-root-folder-of-recycle-bin.html": "/docs/reference/security/prebuilt-rules/rules_building_block/collection_files_staged_in_recycle_bin_root", + "/en/security/*/file-system-debugger-launched-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_debugfs_launched_inside_container", "/en/security/*/file-transfer-or-listener-established-via-netcat.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_file_transfer_or_listener_established_via_netcat", + "/en/security/*/file-transfer-utility-launched-from-unusual-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched", "/en/security/*/file-with-right-to-left-override-character-rtlo-created-executed.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_right_to_left_override", + "/en/security/*/file-with-suspicious-double-extension-created-by-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_file_double_dangerous_extension", "/en/security/*/file-with-suspicious-extension-downloaded.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_download_susp_extension", "/en/security/*/finder-sync-plugin-registered-and-enabled.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_finder_sync_plugin_pluginkit", "/en/security/*/findings-page.html": "/docs/solutions/security/cloud/findings-page-2", "/en/security/*/first-occurrence-github-event-for-a-personal-access-token-pat.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_github_new_event_action_for_pat", - "/en/security/*/first-occurrence-of-entra-id-auth-via-devicecode-protocol.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_first_time_seen_device_code_auth", + "/en/security/*/first-occurrence-of-a-php-fatal-error-on-a-web-server.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/first-occurrence-of-a-web-server-segmentation-fault.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/first-occurrence-of-entra-id-auth-via-devicecode-protocol.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth", "/en/security/*/first-occurrence-of-github-repo-interaction-from-a-new-ip.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_github_repo_interaction_from_new_ip", "/en/security/*/first-occurrence-of-github-user-interaction-with-private-repo.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_github_new_repo_interaction_for_user", "/en/security/*/first-occurrence-of-ip-address-for-github-personal-access-token-pat.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_github_new_ip_address_for_pat", @@ -11540,21 +11932,51 @@ "/en/security/*/first-occurrence-of-sts-getfederationtoken-request-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_sts_get_federation_token", "/en/security/*/first-occurrence-of-user-agent-for-a-github-personal-access-token-pat.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_github_new_user_agent_for_pat", "/en/security/*/first-occurrence-of-user-agent-for-a-github-user.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_github_new_user_agent_for_user", + "/en/security/*/first-seen-external-mqtt-broker-connection.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_first_seen_external_mqtt_broker", + "/en/security/*/first-seen-network-flow-exporter-followed-by-suspicious-source-activity.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_first_seen_network_flow_exporter_followed_by_suspicious_source_activity", + "/en/security/*/first-seen-network-flow-exporter.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_first_seen_network_flow_exporter", + "/en/security/*/first-seen-sonicwall-remote-access-login-by-user-and-source.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_first_seen_sonicwall_remote_access_identity_source", "/en/security/*/first-time-aws-cloudformation-stack-creation-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack", + "/en/security/*/first-time-aws-cloudformation-stack-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack", + "/en/security/*/first-time-destructive-mongodb-command-from-a-client-ip.html": "/docs/reference/security/prebuilt-rules/rules/network/impact_destructive_mongodb_command", + "/en/security/*/first-time-fortigate-administrator-login.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_newly_observed_fortigate_admin_logon", + "/en/security/*/first-time-gcp-vertex-ai-agent-engine-sandbox-code-execution-by-user-and-source-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp_vertexai/execution_gcp_vertexai_agent_engine_sandbox_code_execution", + "/en/security/*/first-time-python-accessed-sensitive-credential-files.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_python_sensitive_file_access_first_occurrence", + "/en/security/*/first-time-python-created-a-launchagent-or-launchdaemon.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_python_launch_agent_or_daemon_creation_first_occurrence", + "/en/security/*/first-time-python-spawned-a-shell-on-host.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_python_shell_spawn_first_occurrence", + "/en/security/*/first-time-seen-account-performing-dcsync.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dcsync_newterm_subjectuser", "/en/security/*/first-time-seen-aws-secret-value-accessed-in-secrets-manager.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue", - "/en/security/*/first-time-seen-commonly-abused-remote-access-tool-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_new_terms_commonly_abused_rat_execution", + "/en/security/*/first-time-seen-commonly-abused-remote-access-tool-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_new_terms_commonly_abused_rmm", + "/en/security/*/first-time-seen-dns-query-to-rmm-domain.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_dns_rmm_domains_non_browser", "/en/security/*/first-time-seen-driver-loaded.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_driver_newterm_imphash", "/en/security/*/first-time-seen-google-workspace-oauth-login-from-third-party-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application", + "/en/security/*/first-time-seen-memcached-writer.html": "/docs/reference/security/prebuilt-rules/rules/network/impact_first_time_seen_memcached_writer", "/en/security/*/first-time-seen-newcredentials-logon-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_newcreds_logon_rare_process", + "/en/security/*/first-time-seen-nfs-auth-sys-root-uid-access.html": "/docs/reference/security/prebuilt-rules/rules/network/collection_nfs_auth_sys_root_uid_access", + "/en/security/*/first-time-seen-remote-monitoring-and-management-tool.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_new_terms_commonly_abused_rmm", "/en/security/*/first-time-seen-removable-device.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_exfiltration_first_time_seen_usb", + "/en/security/*/first-time-seen-rmm-service-hostname-from-network-dns.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/first-time-seen-rmm-signer-across-the-environment.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_new_terms_rmm_signer", "/en/security/*/firsttime-seen-account-performing-dcsync.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dcsync_newterm_subjectuser", + "/en/security/*/fortigate-administrator-account-creation-from-unusual-source.html": "/docs/reference/security/prebuilt-rules/rules/network/persistence_fortigate_admin_creation_unusual_source", + "/en/security/*/fortigate-administrator-login-from-multiple-ip-addresses.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_fortigate_admin_login_multi_srcip", + "/en/security/*/fortigate-configuration-file-downloaded.html": "/docs/reference/security/prebuilt-rules/rules/network/collection_fortigate_config_download", + "/en/security/*/fortigate-forticloud-sso-login-from-unusual-source.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_fortigate_sso_login_from_unusual_source", + "/en/security/*/fortigate-overly-permissive-firewall-policy-created.html": "/docs/reference/security/prebuilt-rules/rules/network/defense_evasion_fortigate_overly_permissive_firewall_policy", + "/en/security/*/fortigate-socks-traffic-from-an-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_socks_fortigate_endpoint", + "/en/security/*/fortigate-ssl-vpn-login-followed-by-siem-alert-by-user.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert", + "/en/security/*/fortigate-sso-login-followed-by-administrator-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/network/persistence_fortigate_sso_login_followed_by_admin_creation", + "/en/security/*/fortigate-super-admin-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/network/persistence_fortigate_super_admin_account_creation", "/en/security/*/forwarded-google-workspace-security-alert.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/google_workspace_alert_center_promotion", + "/en/security/*/full-disk-access-permission-check.html": "/docs/reference/security/prebuilt-rules/rules/macos/discovery_full_disk_access_check", "/en/security/*/full-user-mode-dumps-enabled-system-wide.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_generic_localdumps", + "/en/security/*/gatekeeper-override-and-execution.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_gatekeeper_override_and_execution", "/en/security/*/gcp-firewall-rule-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created", "/en/security/*/gcp-firewall-rule-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted", "/en/security/*/gcp-firewall-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_modified", "/en/security/*/gcp-iam-custom-role-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation", "/en/security/*/gcp-iam-role-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/impact_gcp_iam_role_deletion", + "/en/security/*/gcp-iam-service-account-impersonation-role-granted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_service_account_impersonation_role_grant", "/en/security/*/gcp-iam-service-account-key-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_iam_service_account_key_deletion", "/en/security/*/gcp-logging-bucket-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_logging_bucket_deletion", "/en/security/*/gcp-logging-sink-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_logging_sink_deletion", @@ -11563,6 +11985,7 @@ "/en/security/*/gcp-pub-sub-subscription-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_subscription_deletion", "/en/security/*/gcp-pub-sub-topic-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/collection_gcp_pub_sub_topic_creation", "/en/security/*/gcp-pub-sub-topic-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_topic_deletion", + "/en/security/*/gcp-secret-manager-listsecrets-across-multiple-projects.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_secret_manager_listsecrets_across_multiple_projects", "/en/security/*/gcp-service-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_service_account_created", "/en/security/*/gcp-service-account-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/impact_gcp_service_account_deleted", "/en/security/*/gcp-service-account-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/impact_gcp_service_account_disabled", @@ -11570,9 +11993,18 @@ "/en/security/*/gcp-storage-bucket-configuration-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_configuration_modified", "/en/security/*/gcp-storage-bucket-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/impact_gcp_storage_bucket_deleted", "/en/security/*/gcp-storage-bucket-permissions-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_permissions_modified", + "/en/security/*/gcp-vertex-ai-high-generatecontent-volume-from-single-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp_vertexai/collection_gcp_vertexai_high_generatecontent_volume_from_single_ip", + "/en/security/*/gcp-vertex-ai-publisher-model-config-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp_vertexai/defense_evasion_gcp_vertexai_publisher_model_config_modified", "/en/security/*/gcp-virtual-private-cloud-network-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_network_deleted", "/en/security/*/gcp-virtual-private-cloud-route-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_created", "/en/security/*/gcp-virtual-private-cloud-route-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_deleted", + "/en/security/*/genai-cli-started-with-unsafe-permission-bypass.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_genai_cli_unsafe_permission_bypass", + "/en/security/*/genai-or-mcp-server-child-process-execution.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_mcp_server_child_process", + "/en/security/*/genai-process-accessing-sensitive-files.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access", + "/en/security/*/genai-process-compiling-or-generating-executables.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables", + "/en/security/*/genai-process-connection-to-suspicious-top-level-domain.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection", + "/en/security/*/genai-process-connection-to-unusual-domain.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_genai_process_unusual_domain", + "/en/security/*/genai-process-performing-encoding-chunking-prior-to-network-activity.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity", "/en/security/*/get-action-api.html": "/docs/api/doc/kibana/operation/operation-endpointgetactionsdetails", "/en/security/*/get-endpoint-api.html": "/docs/api/doc/kibana/operation/operation-getendpointmetadata", "/en/security/*/get-file-api.html": "/docs/api/doc/kibana/operation/operation-endpointgetfileaction", @@ -11582,46 +12014,115 @@ "/en/security/*/git-hook-command-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_git_hook_execution", "/en/security/*/git-hook-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_git_hook_file_creation", "/en/security/*/git-hook-egress-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_git_hook_netcon", + "/en/security/*/git-repository-or-file-download-to-suspicious-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_git_repo_or_file_download_to_sus_dir", + "/en/security/*/github-actions-unusual-bot-push-to-repository.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/initial_access_github_actions_bot_first_push_to_repo", + "/en/security/*/github-actions-workflow-modification-blocked.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/initial_access_github_actions_workflow_injection_blocked", + "/en/security/*/github-activity-on-a-private-repository-from-an-unusual-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/impact_github_repository_activity_from_unusual_ip", "/en/security/*/github-app-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/execution_github_app_deleted", + "/en/security/*/github-authentication-token-access-via-node-js.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_gh_auth_via_nodejs", + "/en/security/*/github-exfiltration-via-high-number-of-repository-clones-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/exfiltration_high_number_of_cloning_by_user", + "/en/security/*/github-oauth-application-authorized.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/persistence_github_oauth_application_authorized", "/en/security/*/github-owner-role-granted-to-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/persistence_organization_owner_role_granted", "/en/security/*/github-pat-access-revoked.html": "/docs/reference/security/prebuilt-rules/rules_building_block/impact_github_pat_access_revoked", + "/en/security/*/github-private-repository-turned-public.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/exfiltration_github_private_repository_turned_public", "/en/security/*/github-protected-branch-settings-changed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/defense_evasion_github_protected_branch_settings_changed", "/en/security/*/github-repo-created.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_github_repo_created", "/en/security/*/github-repository-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/impact_github_repository_deleted", + "/en/security/*/github-secret-scanning-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/defense_evasion_secret_scanning_disabled", "/en/security/*/github-ueba-multiple-alerts-from-a-github-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account", "/en/security/*/github-user-blocked-from-organization.html": "/docs/reference/security/prebuilt-rules/rules_building_block/impact_github_user_blocked_from_organization", + "/en/security/*/gke-admission-webhook-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_admission_webhook_created_or_modified", + "/en/security/*/gke-anonymous-endpoint-permission-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_anonymous_endpoint_permission_enumeration", + "/en/security/*/gke-anonymous-pod-create-update-patch.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_anonymous_pod_create_update_patch", + "/en/security/*/gke-anonymous-request-authorized-by-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/initial_access_gcp_gke_anonymous_request_authorized", + "/en/security/*/gke-api-request-failure-burst-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_api_request_failure_burst", + "/en/security/*/gke-api-request-impersonating-privileged-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_api_request_impersonating_privileged_identity", + "/en/security/*/gke-api-server-proxying-request-to-kubelet.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_api_proxy_to_node", + "/en/security/*/gke-certificate-signing-request-api-client-signer-requested.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_certificate_signing_request_api_client_signer_requested", + "/en/security/*/gke-certificate-signing-request-self-approved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_certificate_signing_request_self_approved", + "/en/security/*/gke-client-certificate-signing-request-created-or-approved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_client_certificate_signing_request_created_or_approved", + "/en/security/*/gke-cluster-admin-role-binding-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_cluster_admin_role_binding", + "/en/security/*/gke-container-created-with-excessive-linux-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_excessive_linux_capabilities", + "/en/security/*/gke-coredns-or-kube-dns-configuration-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/impact_gcp_gke_coredns_or_kube_dns_configuration_modified", + "/en/security/*/gke-creation-of-a-rolebinding-referencing-a-serviceaccount.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_role_binding_referencing_service_account", + "/en/security/*/gke-creation-or-modification-of-sensitive-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_sensitive_role_created_or_modified", + "/en/security/*/gke-endpoint-permission-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_endpoint_permission_enumeration", + "/en/security/*/gke-ephemeral-container-added-to-pod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_ephemeral_container_added_to_pod", + "/en/security/*/gke-exposed-service-created-with-type-nodeport.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_gke_exposed_service_created_with_type_nodeport", + "/en/security/*/gke-forbidden-creation-request.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_forbidden_creation_request", + "/en/security/*/gke-forbidden-request-from-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_forbidden_request_from_unusual_user_agent", + "/en/security/*/gke-multi-resource-discovery.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_multi_resource_discovery", + "/en/security/*/gke-pod-created-with-a-sensitive-hostpath-volume.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_hostpath_volume", + "/en/security/*/gke-pod-created-with-hostipc.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_ipc", + "/en/security/*/gke-pod-created-with-hostnetwork.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_network", + "/en/security/*/gke-pod-created-with-hostpid.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_pid", + "/en/security/*/gke-pod-exec-cloud-instance-metadata-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_pod_exec_cloud_instance_metadata", + "/en/security/*/gke-pod-exec-potential-reverse-shell.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_pod_exec_potential_reverse_shell", + "/en/security/*/gke-pod-exec-sensitive-file-or-credential-path-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_pod_exec_sensitive_file_access", + "/en/security/*/gke-pod-exec-with-curl-or-wget-to-https.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_pod_exec_curl_wget_https", + "/en/security/*/gke-privileged-pod-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_privileged_pod_created", + "/en/security/*/gke-rapid-secret-get-activity-against-multiple-objects.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_rapid_secret_get_activity_against_multiple_objects", + "/en/security/*/gke-rbac-wildcard-elevation-on-existing-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_rbac_wildcard_elevation_on_existing_role", + "/en/security/*/gke-secret-access-from-node-or-denied-service-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_from_node_or_denied_service_account", + "/en/security/*/gke-secret-access-via-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_via_unusual_user_agent", + "/en/security/*/gke-secret-get-or-list-with-suspicious-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_suspicious_user_agent", + "/en/security/*/gke-secrets-list-from-unusual-source-as-organization.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/credential_access_gcp_gke_secrets_list_unusual_source_asn", + "/en/security/*/gke-sensitive-rbac-change-followed-by-workload-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_rbac_change_followed_by_workload_modification", + "/en/security/*/gke-service-account-modified-rbac-objects.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_service_account_modified_rbac_objects", + "/en/security/*/gke-suspicious-assignment-of-controller-service-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_suspicious_assignment_of_controller_service_account", + "/en/security/*/gke-suspicious-self-subject-review-via-service-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_suspicious_self_subject_review", + "/en/security/*/gke-unusual-sensitive-workload-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_unusual_sensitive_workload_modification", + "/en/security/*/gke-user-exec-into-pod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_user_exec_into_pod", + "/en/security/*/google-calendar-c2-via-script-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_google_calendar_c2_via_script", "/en/security/*/google-drive-ownership-transferred-via-google-workspace.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace", + "/en/security/*/google-secops-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/google_secops_external_alerts", + "/en/security/*/google-workspace-2sv-policy-disabled-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled", "/en/security/*/google-workspace-2sv-policy-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled", + "/en/security/*/google-workspace-admin-role-assigned-to-a-user-or-group.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user", "/en/security/*/google-workspace-admin-role-assigned-to-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user", "/en/security/*/google-workspace-admin-role-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/impact_google_workspace_admin_role_deletion", "/en/security/*/google-workspace-api-access-granted-via-domain-wide-delegation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_dwd", "/en/security/*/google-workspace-bitlocker-setting-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/defense_evasion_google_workspace_bitlocker_setting_disabled", "/en/security/*/google-workspace-custom-admin-role-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created", "/en/security/*/google-workspace-custom-gmail-route-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified", + "/en/security/*/google-workspace-device-registration-after-oauth-from-suspicious-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn", + "/en/security/*/google-workspace-device-registration-burst-for-single-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_burst", + "/en/security/*/google-workspace-drive-data-transfer-or-takeout-export-initiated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace", "/en/security/*/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user", + "/en/security/*/google-workspace-gmail-routing-or-forwarding-rule-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified", + "/en/security/*/google-workspace-login-flagged-suspicious.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_google_workspace_login_flagged_suspicious_by_google", + "/en/security/*/google-workspace-mfa-enforcement-disabled-for-organization.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled", "/en/security/*/google-workspace-mfa-enforcement-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled", "/en/security/*/google-workspace-object-copied-to-external-drive-with-app-consent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent", "/en/security/*/google-workspace-password-policy-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_password_policy_modified", "/en/security/*/google-workspace-restrictions-for-marketplace-modified-to-allow-any-app.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app", "/en/security/*/google-workspace-role-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_role_modified", "/en/security/*/google-workspace-suspended-user-account-renewed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/initial_access_google_workspace_suspended_user_renewed", + "/en/security/*/google-workspace-user-login-with-unusual-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/initial_access_google_workspace_login_from_atypical_asn", "/en/security/*/google-workspace-user-organizational-unit-changed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_user_organizational_unit_changed", + "/en/security/*/google-workspace-user-sign-in-from-atypical-device-type.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_atypical_device", "/en/security/*/group-policy-abuse-for-privilege-addition.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_group_policy_privileged_groups", "/en/security/*/group-policy-discovery-via-microsoft-gpresult-utility.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_group_policy_object_discovery", "/en/security/*/grub-configuration-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_grub_configuration_creation", "/en/security/*/grub-configuration-generation-through-built-in-utilities.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_grub_makeconfig", "/en/security/*/halfbaked-command-and-control-beacon.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_halfbaked_beacon", "/en/security/*/hidden-directory-creation-via-unusual-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_hidden_directory_creation", + "/en/security/*/hidden-file-created-in-system-directory-by-suspicious-process.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/hidden-files-and-directories-via-hidden-flag.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_creation_of_hidden_files_directories", + "/en/security/*/high-command-line-entropy-detected-for-privileged-commands.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user", "/en/security/*/high-mean-of-process-arguments-in-an-rdp-session.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args", "/en/security/*/high-mean-of-rdp-session-duration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration", "/en/security/*/high-number-of-cloned-github-repos-from-pat.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat", + "/en/security/*/high-number-of-closed-pull-requests-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user", "/en/security/*/high-number-of-egress-network-connections-from-unusual-executable.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable", - "/en/security/*/high-number-of-okta-device-token-cookies-generated-for-authentication.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_multiple_device_token_hashes_for_single_user", + "/en/security/*/high-number-of-okta-device-token-cookies-generated-for-authentication.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation", "/en/security/*/high-number-of-okta-user-password-reset-or-unlock-attempts.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts", "/en/security/*/high-number-of-process-and-or-service-terminations.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_stop_process_service_threshold", "/en/security/*/high-number-of-process-terminations.html": "/docs/reference/security/prebuilt-rules/rules/linux/impact_process_kill_threshold", + "/en/security/*/high-number-of-protected-branch-force-pushes-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user", "/en/security/*/high-variance-in-rdp-session-duration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration", + "/en/security/*/host-detected-with-suspicious-windows-process-es.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host", + "/en/security/*/host-file-system-changes-via-windows-subsystem-for-linux.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_filesystem", "/en/security/*/host-files-system-changes-via-windows-subsystem-for-linux.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_filesystem", "/en/security/*/host-isolation-api.html": "/docs/api/doc/kibana/operation/operation-endpointisolateaction", "/en/security/*/host-isolation-exceptions-api.html": "/docs/api/doc/kibana/group/endpoint-security-exceptions-api", @@ -11631,6 +12132,9 @@ "/en/security/*/hosts-file-modified.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/impact_hosts_file_modified", "/en/security/*/hosts-overview.html": "/docs/solutions/security/explore/hosts-page", "/en/security/*/hping-process-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_linux_hping_activity", + "/en/security/*/ibm-qradar-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/ibm_qradar_external_alerts", + "/en/security/*/icmp-redirect-message-from-internal-host.html": "/docs/reference/security/prebuilt-rules/rules/network/credential_access_icmp_redirect_message_observed", + "/en/security/*/icmp-timestamp-or-information-request-from-the-internet.html": "/docs/reference/security/prebuilt-rules/rules/network/discovery_icmp_timestamp_or_information_request_from_the_internet", "/en/security/*/iis-http-logging-disabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_iis_httplogging_disabled", "/en/security/*/image-file-execution-options-injection.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_evasion_registry_ifeo_injection", "/en/security/*/image-loaded-with-invalid-signature.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_invalid_codesign_imageload", @@ -11651,6 +12155,7 @@ "/en/security/*/ingest-third-party-cloud-security-data.html": "/docs/solutions/security/cloud/ingest-third-party-cloud-security-data", "/en/security/*/ingest-wiz-data.html": "/docs/solutions/security/cloud/ingest-wiz-data", "/en/security/*/ingress-transfer-via-windows-bits.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_ingress_transfer_bits", + "/en/security/*/initial-access-via-file-upload-followed-by-get-request.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request", "/en/security/*/initramfs-extraction-via-cpio.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_extract_initramfs_via_cpio", "/en/security/*/initramfs-unpacking-via-unmkinitramfs.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_unpack_initramfs_via_unmkinitramfs", "/en/security/*/insecure-aws-ec2-vpc-security-group-ingress-rule-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections", @@ -11661,56 +12166,119 @@ "/en/security/*/installutil-process-making-network-connections.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_installutil_beacon", "/en/security/*/interactive-investigation-guides.html": "/docs/solutions/security/detect-and-alert/launch-timeline-from-investigation-guides", "/en/security/*/interactive-logon-by-an-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_make_token_local", + "/en/security/*/interactive-shell-launched-via-unusual-parent-process-in-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_unusual_interactive_process_inside_container", "/en/security/*/interactive-terminal-spawned-via-perl.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_perl_tty_shell", "/en/security/*/interactive-terminal-spawned-via-python.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_python_tty_shell", "/en/security/*/invest-guide-run-osquery.html": "/docs/solutions/security/investigate/run-osquery-from-investigation-guides", "/en/security/*/investigations-tools.html": "/docs/solutions/security/investigate", - "/en/security/*/ipsec-nat-traversal-port-activity.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_nat_traversal_port_activity", + "/en/security/*/ipsec-nat-traversal-port-activity.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_newly_observed_ipsec_nat_traversal_peer", "/en/security/*/ipv4-ipv6-forwarding-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_ip_forwarding_activity", + "/en/security/*/java-dropped-and-executed-with-dns-lookup.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_java_dropped_jar_immediate_dns_lookup", + "/en/security/*/kde-autostart-script-or-desktop-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kde_autostart_modification", "/en/security/*/kerberos-cached-credentials-dumping.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_kerberosdump_kcc", "/en/security/*/kerberos-pre-authentication-disabled-for-user.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_disable_kerberos_preauth", "/en/security/*/kerberos-traffic-from-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_kerberoasting_unusual_process", "/en/security/*/kernel-driver-load-by-non-root-user.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kernel_driver_load_by_non_root", "/en/security/*/kernel-driver-load.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kernel_driver_load", + "/en/security/*/kernel-instrumentation-discovery-via-kprobes-and-tracefs.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_kernel_instrumentation_discovery_via_kprobes_and_tracefs", "/en/security/*/kernel-load-or-unload-via-kexec-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec", + "/en/security/*/kernel-module-load-from-unusual-location.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kernel_module_load_from_unusual_location", + "/en/security/*/kernel-module-load-via-built-in-utility.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_insmod_kernel_module_load", "/en/security/*/kernel-module-load-via-insmod.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_insmod_kernel_module_load", "/en/security/*/kernel-module-removal.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_kernel_module_removal", "/en/security/*/kernel-object-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kernel_object_file_creation", "/en/security/*/kernel-seeking-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_kernel_seeking", "/en/security/*/kernel-unpacking-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_kernel_unpacking", + "/en/security/*/keychain-commandline-interaction-via-unsigned-or-untrusted-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_credentials_keychains", "/en/security/*/keychain-password-retrieval-via-command-line.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd", "/en/security/*/kill-command-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_kill_command_executed", "/en/security/*/kill-process-api.html": "/docs/api/doc/kibana/operation/operation-endpointkillprocessaction", "/en/security/*/kirbi-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_kirbi_file", "/en/security/*/krbtgt-delegation-backdoor.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_msds_alloweddelegateto_krbtgt", "/en/security/*/kspm.html": "/docs/solutions/security/cloud/kubernetes-security-posture-management", + "/en/security/*/kubeconfig-file-creation-or-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_kubeconfig_file_activity", + "/en/security/*/kubeconfig-file-discovery.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_kubeconfig_file_discovery", + "/en/security/*/kubectl-apply-pod-from-url.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_kubectl_apply_pod_from_url", + "/en/security/*/kubectl-configuration-discovery.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_kubectl_configuration_discovery", + "/en/security/*/kubectl-network-configuration-modification.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_kubectl_networking_modification", + "/en/security/*/kubectl-permission-discovery.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/discovery_kubectl_permission_discovery", + "/en/security/*/kubectl-workload-and-cluster-discovery.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_kubectl_workload_and_cluster_discovery", + "/en/security/*/kubelet-api-connection-attempt-to-internal-ip.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_kubelet_api_connection_attempt_internal_ip", + "/en/security/*/kubernetes-admission-webhook-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_kubernetes_admission_webhook_created_or_modified", + "/en/security/*/kubernetes-and-cloud-credential-path-access-via-process-arguments.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_kubernetes_and_cloud_credential_paths_via_process_args", + "/en/security/*/kubernetes-anonymous-request-authorized-by-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized", "/en/security/*/kubernetes-anonymous-request-authorized.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized", + "/en/security/*/kubernetes-anonymous-user-create-update-patch-pods-request.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/execution_anonymous_create_update_patch_pod_request", + "/en/security/*/kubernetes-api-request-impersonating-privileged-identity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_api_request_impersonating_privileged_identity", + "/en/security/*/kubernetes-api-server-proxying-request-to-kubelet.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_api_proxy_to_node", + "/en/security/*/kubernetes-client-certificate-signing-request-created-or-approved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_kubernetes_client_certificate_signing_request_created_or_approved", + "/en/security/*/kubernetes-cluster-admin-role-binding-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_cluster_admin_rolebinding_created", "/en/security/*/kubernetes-container-created-with-excessive-linux-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities", - "/en/security/*/kubernetes-denied-service-account-request.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/discovery_denied_service_account_request", + "/en/security/*/kubernetes-coredns-or-kube-dns-configuration-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/impact_kubernetes_coredns_or_kube_dns_configuration_modified", + "/en/security/*/kubernetes-creation-of-a-rolebinding-referencing-a-serviceaccount.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_service_account_bound_to_clusterrole", + "/en/security/*/kubernetes-creation-or-modification-of-sensitive-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_sensitive_role_creation_or_modification", + "/en/security/*/kubernetes-denied-service-account-request.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/kubernetes-direct-api-request-via-curl-or-wget.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget", + "/en/security/*/kubernetes-ephemeral-container-added-to-pod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_ephemeral_container_added_to_pod", + "/en/security/*/kubernetes-events-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/defense_evasion_events_deleted", "/en/security/*/kubernetes-exposed-service-created-with-type-nodeport.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport", + "/en/security/*/kubernetes-forbidden-creation-request.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/execution_forbidden_creation_request", + "/en/security/*/kubernetes-forbidden-request-from-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent", + "/en/security/*/kubernetes-multi-resource-discovery.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/discovery_kubernetes_multi_resource_setup_recon", "/en/security/*/kubernetes-pod-created-with-a-sensitive-hostpath-volume.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume", "/en/security/*/kubernetes-pod-created-with-hostipc.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc", "/en/security/*/kubernetes-pod-created-with-hostnetwork.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork", "/en/security/*/kubernetes-pod-created-with-hostpid.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid", + "/en/security/*/kubernetes-pod-creation-using-common-debug-or-base-images.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_common_debug_or_base_image_pod_creation", + "/en/security/*/kubernetes-pod-exec-cloud-instance-metadata-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_cloud_instance_metadata", + "/en/security/*/kubernetes-pod-exec-potential-reverse-shell.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_potential_reverse_shell", + "/en/security/*/kubernetes-pod-exec-sensitive-file-or-credential-path-access.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_sensitive_file_access", + "/en/security/*/kubernetes-pod-exec-with-curl-or-wget-to-https.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_curl_wget_https", + "/en/security/*/kubernetes-potential-endpoint-permission-enumeration-attempt-by-anonymous-user-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_anonymous_user", + "/en/security/*/kubernetes-potential-endpoint-permission-enumeration-attempt-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_user_and_srcip", "/en/security/*/kubernetes-privileged-pod-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_privileged_pod_created", + "/en/security/*/kubernetes-rapid-secret-get-activity-against-multiple-objects.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_multiple_secret_retrieval_burst", + "/en/security/*/kubernetes-rbac-wildcard-elevation-on-existing-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_role_patch_wildcard_verbs_resources_response", + "/en/security/*/kubernetes-secret-access-via-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_get_secrets_access", + "/en/security/*/kubernetes-secret-get-or-list-from-node-or-pod-service-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_read_by_node_or_pod_service_account", + "/en/security/*/kubernetes-secret-get-or-list-with-suspicious-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_access_scripting_http_clients", + "/en/security/*/kubernetes-secret-or-configmap-access-via-azure-arc-proxy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_azure_arc_proxy_secret_configmap_access", + "/en/security/*/kubernetes-secrets-list-across-cluster-or-sensitive-namespaces.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces", + "/en/security/*/kubernetes-sensitive-configuration-file-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kubernetes_sensitive_file_activity", + "/en/security/*/kubernetes-sensitive-rbac-change-followed-by-workload-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_sensitive_rbac_change_followed_by_workload_modification", + "/en/security/*/kubernetes-service-account-modified-rbac-objects.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_service_account_rbac_write_operation", + "/en/security/*/kubernetes-service-account-secret-access.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_kubernetes_service_account_secret_access", + "/en/security/*/kubernetes-service-account-token-created-via-tokenrequest-api.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/credential_access_kubernetes_service_account_token_created_via_tokenrequest", + "/en/security/*/kubernetes-static-pod-manifest-file-access.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kubernetes_static_pod_manifest_path_process_execution", "/en/security/*/kubernetes-suspicious-assignment-of-controller-service-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account", + "/en/security/*/kubernetes-suspicious-self-subject-review-via-unusual-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review", "/en/security/*/kubernetes-suspicious-self-subject-review.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review", "/en/security/*/kubernetes-user-exec-into-pod.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/execution_user_exec_to_pod", + "/en/security/*/lateral-movement-alerts-from-a-newly-observed-source-address.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/lateral_movement_multi_alerts_new_srcip", + "/en/security/*/lateral-movement-alerts-from-a-newly-observed-user.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/lateral_movement_multi_alerts_new_userid", "/en/security/*/lateral-movement-via-startup-folder.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_via_startup_folder_rdp_smb", "/en/security/*/launch-agent-creation-or-modification-and-immediate-loading.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_creation_change_launch_agents_file", - "/en/security/*/launchdaemon-creation-or-modification-and-immediate-loading.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_creation_modif_launch_deamon_sequence", + "/en/security/*/launch-item-registration-with-suspicious-executable-path-via-macos-security-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/macos/persistence_launch_item_suspicious_executable_via_security_events", + "/en/security/*/launch-service-creation-and-immediate-loading.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_creation_change_launch_agents_file", + "/en/security/*/launchdaemon-creation-or-modification-and-immediate-loading.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/linux-audio-recording-activity-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/collection_potential_audio_recording_activity", "/en/security/*/linux-clipboard-activity-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/collection_linux_clipboard_activity", + "/en/security/*/linux-external-ip-address-discovery-via-curl.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_curl_external_ip_discovery", "/en/security/*/linux-file-monitoring.html": "/docs/solutions/security/configure-elastic-defend/configure-linux-file-system-monitoring", + "/en/security/*/linux-firewall-rule-creation-or-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_linux_firewall_rule_creation_or_modification", "/en/security/*/linux-group-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_linux_group_creation", "/en/security/*/linux-init-pid-1-secret-dump-via-gdb.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_gdb_init_process_hooking", "/en/security/*/linux-process-hooking-via-gdb.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_gdb_process_hooking", - "/en/security/*/linux-restricted-shell-breakout-via-linux-binary-s.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_evasion_linux_binary", + "/en/security/*/linux-restricted-shell-breakout-via-linux-binary-s.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/linux-ssh-x11-forwarding.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_ssh_x11_forwarding", "/en/security/*/linux-system-information-discovery-via-getconf.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_getconf_execution", "/en/security/*/linux-system-information-discovery.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_linux_system_information_discovery", + "/en/security/*/linux-telegram-api-request.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_telegram_api_request", "/en/security/*/linux-user-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_linux_user_account_creation", "/en/security/*/linux-user-account-credential-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_user_credential_modification_via_echo", "/en/security/*/linux-user-added-to-privileged-group.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_linux_user_added_to_privileged_group", + "/en/security/*/linux-user-or-group-deletion.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_user_or_group_deletion", + "/en/security/*/linux-video-recording-or-screenshot-activity-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/collection_potential_video_recording_or_screenshot_activity", "/en/security/*/list-actions-api.html": "/docs/api/doc/kibana/operation/operation-endpointgetactionslist", "/en/security/*/list-endpoints-api.html": "/docs/api/doc/kibana/operation/operation-getendpointmetadatalist", "/en/security/*/lists-api-create-container.html": "/docs/api/doc/kibana/operation/operation-createlist", @@ -11733,10 +12301,64 @@ "/en/security/*/local-account-tokenfilter-policy-disabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy", "/en/security/*/local-scheduled-task-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_local_scheduled_task_creation", "/en/security/*/login-via-unusual-system-user.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_ssh_via_backdoored_system_user", + "/en/security/*/long-base64-encoded-command-via-scripting-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line", "/en/security/*/lsass-memory-dump-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_lsass_memdump_file_created", "/en/security/*/lsass-memory-dump-handle-access.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_lsass_memdump_handle_access", "/en/security/*/lsass-process-access-via-windows-api.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_lsass_openprocess_api", + "/en/security/*/m365-air-investigation-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_air_investigation_signal", + "/en/security/*/m365-azure-monitor-alert-email-with-financial-or-billing-theme.html": "/docs/reference/security/prebuilt-rules/rules/integrations/microsoft_exchange_online_message_trace/initial_access_azure_monitor_callback_phishing_email", + "/en/security/*/m365-defender-alerts-signal-ual.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_defender_alerts_signal", + "/en/security/*/m365-entra-id-risk-detection-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/credential_access_entra_id_risk_detection_signal", + "/en/security/*/m365-exchange-anti-phish-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion", + "/en/security/*/m365-exchange-anti-phish-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification", + "/en/security/*/m365-exchange-dkim-signing-configuration-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled", + "/en/security/*/m365-exchange-email-safe-attachment-rule-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled", + "/en/security/*/m365-exchange-email-safe-link-policy-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled", + "/en/security/*/m365-exchange-federated-domain-created-or-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain", + "/en/security/*/m365-exchange-inbox-forwarding-rule-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_exchange_new_inbox_rule", + "/en/security/*/m365-exchange-inbox-phishing-evasion-rule-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_new_inbox_rule_delete_or_move", + "/en/security/*/m365-exchange-inbox-rule-with-obfuscated-name.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_inbox_rule_obfuscated_name", + "/en/security/*/m365-exchange-mail-flow-transport-rule-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation", + "/en/security/*/m365-exchange-mail-flow-transport-rule-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification", + "/en/security/*/m365-exchange-mailbox-accessed-by-unusual-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id", + "/en/security/*/m365-exchange-mailbox-audit-logging-bypass-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association", + "/en/security/*/m365-exchange-mailbox-high-risk-permission-delegated.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation", + "/en/security/*/m365-exchange-mailbox-items-accessed-excessively.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_exchange_excessive_mail_items_accessed", + "/en/security/*/m365-exchange-malware-filter-policy-deleted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion", + "/en/security/*/m365-exchange-malware-filter-rule-modified.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod", + "/en/security/*/m365-exchange-management-group-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_exchange_management_role_assignment", + "/en/security/*/m365-exchange-mfa-notification-email-deleted-or-moved.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_mfa_notification_email_deleted", + "/en/security/*/m365-identity-device-code-grant-by-an-unusual-user-non-compliant-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_user_noncompliant_device", + "/en/security/*/m365-identity-device-code-grant-with-unusual-user-and-asn.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_source_asn", + "/en/security/*/m365-identity-global-administrator-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign", + "/en/security/*/m365-identity-login-from-atypical-region.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel", + "/en/security/*/m365-identity-login-from-impossible-travel-location.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel", + "/en/security/*/m365-identity-oauth-flow-by-first-party-microsoft-app-from-multiple-ips.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_entra_id_susp_oauth2_authorization", + "/en/security/*/m365-identity-oauth-flow-by-user-sign-in-to-device-registration.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/credential_access_entra_id_device_reg_via_oauth_redirection", + "/en/security/*/m365-identity-oauth-illicit-consent-grant-by-rare-client-and-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_illicit_consent_grant_via_registered_application", + "/en/security/*/m365-identity-oauth-phishing-via-first-party-microsoft-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_oauth_phishing_via_first_party_microsoft_application", + "/en/security/*/m365-identity-oauth-ropc-grant-via-legacy-authentication-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_ropc_grant_via_legacy_authenticated_client", + "/en/security/*/m365-identity-unusual-sso-authentication-errors-for-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user", + "/en/security/*/m365-identity-user-account-lockouts.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/credential_access_identity_user_account_lockouts", + "/en/security/*/m365-identity-user-brute-force-attempted.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force", "/en/security/*/m365-onedrive-excessive-file-downloads-with-oauth-token.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads", + "/en/security/*/m365-onedrive-malware-file-upload.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded", + "/en/security/*/m365-onedrive-sharepoint-excessive-file-downloads.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads", + "/en/security/*/m365-or-entra-id-identity-sign-in-from-a-suspicious-source.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_azure_o365_with_network_alert", + "/en/security/*/m365-potential-aitm-userloggedin-via-office-app-tycoon2fa.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_tycoon_o365", + "/en/security/*/m365-purview-dlp-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/collection_microsoft_purview_dlp_signal", + "/en/security/*/m365-purview-insider-risk-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/collection_microsoft_purview_insider_risk_signal", + "/en/security/*/m365-purview-security-compliance-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_purview_security_compliance_signal", + "/en/security/*/m365-quarantine-and-hygiene-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_quarantine_hygiene_signal", + "/en/security/*/m365-security-compliance-admin-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_microsoft_security_compliance_admin_signal", + "/en/security/*/m365-sharepoint-malware-file-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded", + "/en/security/*/m365-sharepoint-onedrive-file-access-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_sharepoint_file_download_via_powershell", + "/en/security/*/m365-sharepoint-search-for-sensitive-content.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/discovery_sharepoint_sensitive_term_search", + "/en/security/*/m365-sharepoint-site-administrator-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/privilege_escalation_sharepoint_site_collection_admin_added", + "/en/security/*/m365-sharepoint-site-sharing-policy-weakened.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_sharepoint_sharing_policy_weakened", + "/en/security/*/m365-teams-custom-application-interaction-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed", + "/en/security/*/m365-teams-rogue-help-desk-chat-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_teams_rogue_helpdesk_chat", + "/en/security/*/m365-threat-intelligence-signal.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_defender_threat_intelligence_signal", "/en/security/*/machine-learning-detected-a-dns-request-predicted-to-be-a-dga-domain.html": "/docs/reference/security/prebuilt-rules/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain", "/en/security/*/machine-learning-detected-a-dns-request-with-a-high-dga-probability-score.html": "/docs/reference/security/prebuilt-rules/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability", "/en/security/*/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability", @@ -11750,6 +12372,10 @@ "/en/security/*/malware-prevented-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/endgame_malware_prevented", "/en/security/*/management-api-overview.html": "/docs/api/doc/kibana/group/endpoint-security-endpoint-management-api", "/en/security/*/manual-dracut-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_manual_dracut_execution", + "/en/security/*/manual-loading-of-a-suspicious-chromium-extension.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_manual_chromium_extension_loading", + "/en/security/*/manual-memory-dumping-via-proc-filesystem.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_manual_memory_dumping", + "/en/security/*/manual-mount-discovery-via-etc-exports-or-etc-fstab.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_manual_mount_discovery_via_exports_or_fstab", + "/en/security/*/mark-of-the-web-removal-by-an-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_mark_of_the_web_removal_unusual_process", "/en/security/*/masquerading-space-after-filename.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_masquerading_space_after_filename", "/en/security/*/member-removed-from-github-organization.html": "/docs/reference/security/prebuilt-rules/rules_building_block/impact_github_member_removed_from_organization", "/en/security/*/memory-dump-file-with-unusual-extension.html": "/docs/reference/security/prebuilt-rules/rules_building_block/credential_access_mdmp_file_unusual_extension", @@ -11758,40 +12384,47 @@ "/en/security/*/memory-threat-prevented-elastic-defend.html": "/docs/reference/security/prebuilt-rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented", "/en/security/*/message-of-the-day-motd-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_message_of_the_day_creation", "/en/security/*/mfa-deactivation-with-no-re-activation-for-okta-user-account.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation", - "/en/security/*/mfa-disabled-for-google-workspace-organization.html": "/docs/reference/security/prebuilt-rules/rules/integrations/google_workspace/persistence_mfa_disabled_for_google_workspace_organization", - "/en/security/*/microsoft-365-exchange-anti-phish-policy-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion", - "/en/security/*/microsoft-365-exchange-anti-phish-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_rule_mod", - "/en/security/*/microsoft-365-exchange-dkim-signing-configuration-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_microsoft_365_exchange_dkim_signing_config_disabled", - "/en/security/*/microsoft-365-exchange-dlp-policy-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_microsoft_365_exchange_dlp_policy_removed", - "/en/security/*/microsoft-365-exchange-malware-filter-policy-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion", - "/en/security/*/microsoft-365-exchange-malware-filter-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_rule_mod", - "/en/security/*/microsoft-365-exchange-management-group-role-assignment.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_microsoft_365_exchange_management_role_assignment", - "/en/security/*/microsoft-365-exchange-safe-attachment-rule-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled", - "/en/security/*/microsoft-365-exchange-safe-link-policy-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_exchange_safelinks_disabled", - "/en/security/*/microsoft-365-exchange-transport-rule-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/exfiltration_microsoft_365_exchange_transport_rule_creation", - "/en/security/*/microsoft-365-exchange-transport-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/exfiltration_microsoft_365_exchange_transport_rule_mod", - "/en/security/*/microsoft-365-global-administrator-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_microsoft_365_global_administrator_role_assign", - "/en/security/*/microsoft-365-inbox-forwarding-rule-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_microsoft_365_new_inbox_rule", - "/en/security/*/microsoft-365-portal-login-from-rare-location.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_portal_login_from_rare_location", - "/en/security/*/microsoft-365-portal-logins-from-impossible-travel-locations.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_impossible_travel_portal_logins", - "/en/security/*/microsoft-365-potential-ransomware-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/impact_microsoft_365_potential_ransomware_activity", - "/en/security/*/microsoft-365-teams-custom-application-interaction-allowed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_microsoft_365_teams_custom_app_interaction_allowed", - "/en/security/*/microsoft-365-teams-external-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_microsoft_365_teams_external_access_enabled", - "/en/security/*/microsoft-365-teams-guest-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_microsoft_365_teams_guest_access_enabled", - "/en/security/*/microsoft-365-unusual-volume-of-file-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/impact_microsoft_365_unusual_volume_of_file_deletion", - "/en/security/*/microsoft-365-user-restricted-from-sending-email.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_user_restricted_from_sending_email", + "/en/security/*/mfa-disabled-for-google-workspace-organization.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/microsoft-365-exchange-anti-phish-policy-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion", + "/en/security/*/microsoft-365-exchange-anti-phish-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification", + "/en/security/*/microsoft-365-exchange-dkim-signing-configuration-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled", + "/en/security/*/microsoft-365-exchange-dlp-policy-removed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed", + "/en/security/*/microsoft-365-exchange-malware-filter-policy-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion", + "/en/security/*/microsoft-365-exchange-malware-filter-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod", + "/en/security/*/microsoft-365-exchange-management-group-role-assignment.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_exchange_management_role_assignment", + "/en/security/*/microsoft-365-exchange-safe-attachment-rule-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled", + "/en/security/*/microsoft-365-exchange-safe-link-policy-disabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled", + "/en/security/*/microsoft-365-exchange-transport-rule-creation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation", + "/en/security/*/microsoft-365-exchange-transport-rule-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification", + "/en/security/*/microsoft-365-global-administrator-role-assigned.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign", + "/en/security/*/microsoft-365-inbox-forwarding-rule-created.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_exchange_new_inbox_rule", + "/en/security/*/microsoft-365-portal-login-from-rare-location.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel", + "/en/security/*/microsoft-365-portal-logins-from-impossible-travel-locations.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel", + "/en/security/*/microsoft-365-potential-ransomware-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity", + "/en/security/*/microsoft-365-teams-custom-application-interaction-allowed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed", + "/en/security/*/microsoft-365-teams-external-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled", + "/en/security/*/microsoft-365-teams-guest-access-enabled.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_teams_guest_access_enabled", + "/en/security/*/microsoft-365-unusual-volume-of-file-deletion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion", + "/en/security/*/microsoft-365-user-restricted-from-sending-email.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email", "/en/security/*/microsoft-build-engine-started-an-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_msbuild_started_unusal_process", "/en/security/*/microsoft-build-engine-started-by-a-script-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_msbuild_started_by_script", "/en/security/*/microsoft-build-engine-started-by-a-system-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_msbuild_started_by_system_process", "/en/security/*/microsoft-build-engine-started-by-an-office-application.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_msbuild_started_by_office_app", "/en/security/*/microsoft-build-engine-using-an-alternate-name.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_msbuild_started_renamed", + "/en/security/*/microsoft-defender-xdr-alert-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/m365_defender_alert_external_alerts", + "/en/security/*/microsoft-defender-xdr-incident-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/m365_defender_incident_external_alerts", + "/en/security/*/microsoft-entra-id-exccessive-account-lockouts-detected.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/microsoft-exchange-server-um-spawning-suspicious-processes.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_ms_exchange_process", "/en/security/*/microsoft-exchange-server-um-writing-suspicious-files.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_ms_exchange_files", "/en/security/*/microsoft-exchange-transport-agent-install-script.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_transport_agent_exchange", "/en/security/*/microsoft-exchange-worker-spawning-suspicious-processes.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process", + "/en/security/*/microsoft-graph-email-access-by-unusual-user-and-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph", + "/en/security/*/microsoft-graph-multi-category-reconnaissance-burst.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/discovery_graph_activity_delegated_user_multi_category_recon", + "/en/security/*/microsoft-graph-request-user-impersonation-by-unusual-client.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request", "/en/security/*/microsoft-iis-connection-strings-decryption.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_iis_connectionstrings_dumping", - "/en/security/*/microsoft-iis-service-account-password-dumped.html": "/docs/reference/security/prebuilt-rules/rules_building_block/credential_access_iis_apppoolsa_pwd_appcmd", + "/en/security/*/microsoft-iis-service-account-password-dumped.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd", "/en/security/*/microsoft-management-console-file-from-unusual-path.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_via_mmc_console_file_unusual_path", + "/en/security/*/microsoft-sentinel-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/microsoft_sentinel_external_alerts", "/en/security/*/microsoft-windows-defender-tampering.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_microsoft_defender_tampering", "/en/security/*/mimikatz-memssp-log-file-detected.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_mimikatz_memssp_default_logs", "/en/security/*/ml-requirements.html": "/docs/solutions/security/advanced-entity-analytics/machine-learning-job-rule-requirements", @@ -11801,42 +12434,63 @@ "/en/security/*/modification-of-environment-variable-via-unsigned-or-untrusted-parent.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_modify_environment_launchctl", "/en/security/*/modification-of-openssh-binaries.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_credential_access_modify_ssh_binaries", "/en/security/*/modification-of-safari-settings-via-defaults-command.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_safari_config_change", - "/en/security/*/modification-of-standard-authentication-module-or-configuration.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config", + "/en/security/*/modification-of-standard-authentication-module-or-configuration.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/modification-of-the-mspkiaccountcredentials.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_credroaming_ldap", "/en/security/*/modification-of-wdigest-security-provider.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_mod_wdigest_security_provider", "/en/security/*/modification-or-removal-of-an-okta-application-sign-on-policy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy", "/en/security/*/mofcomp-activity.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_mofcomp", + "/en/security/*/mount-launched-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_mount_launched_inside_container", "/en/security/*/mounting-hidden-or-webdav-remote-shares.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net", "/en/security/*/ms-office-macro-security-registry-modifications.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_ms_office_suspicious_regmod", "/en/security/*/msbuild-making-network-connections.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_msbuild_making_network_connections", "/en/security/*/mshta-making-network-connections.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_mshta_beacon", "/en/security/*/msiexec-service-child-process-with-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_msiexec_child_proc_netcon", - "/en/security/*/multi-factor-authentication-disabled-for-an-azure-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_mfa_disabled_for_azure_user", + "/en/security/*/multi-base64-decoding-attempt-from-suspicious-location.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_multi_base64_decoding_attempt", + "/en/security/*/multi-cloud-cli-token-and-credential-access-commands.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_multi_cloud_cli_token_harvesting", + "/en/security/*/multi-factor-authentication-disabled-for-an-azure-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user", + "/en/security/*/multiple-alerts-in-same-att-ck-tactic-by-host.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_same_tactic_by_host", "/en/security/*/multiple-alerts-involving-a-user.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_involving_user", + "/en/security/*/multiple-alerts-on-a-host-exhibiting-cpu-spike.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/impact_alerts_on_host_with_cpu_spike", + "/en/security/*/multiple-cloud-secrets-accessed-by-source-address.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_multi_could_secrets_via_api", "/en/security/*/multiple-device-token-hashes-for-single-okta-session.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session", + "/en/security/*/multiple-dhcp-servers-responding-to-the-same-transaction.html": "/docs/reference/security/prebuilt-rules/rules/network/credential_access_dhcp_multiple_servers_same_transaction", + "/en/security/*/multiple-elastic-defend-alerts-by-agent.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_edr_elastic_defend_by_host", + "/en/security/*/multiple-elastic-defend-alerts-from-a-single-process-tree.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_edr_elastic_same_process_tree", + "/en/security/*/multiple-external-edr-alerts-by-host.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_external_edr_alerts_by_host", "/en/security/*/multiple-logon-failure-followed-by-logon-success.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success", "/en/security/*/multiple-logon-failure-from-the-same-source-address.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip", + "/en/security/*/multiple-machine-learning-alerts-by-influencer-field.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_machine_learning_jobs_by_entity", "/en/security/*/multiple-okta-sessions-detected-for-a-single-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user", "/en/security/*/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy", - "/en/security/*/multiple-okta-user-authentication-events-with-client-address.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_from_single_source", + "/en/security/*/multiple-okta-user-authentication-events-with-client-address.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source", "/en/security/*/multiple-okta-user-authentication-events-with-same-device-token-hash.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash", + "/en/security/*/multiple-remote-management-tool-vendors-on-same-host.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_multiple_rmm_vendors_same_host", + "/en/security/*/multiple-rmm-vendors-queried-by-a-single-dns-client.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/multiple-sonicwall-login-failures-followed-by-successful-login.html": "/docs/reference/security/prebuilt-rules/rules/network/credential_access_sonicwall_login_failures_followed_by_success", "/en/security/*/multiple-vault-web-credentials-read.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_saved_creds_vault_winlog", + "/en/security/*/multiple-vulnerabilities-by-asset-via-wiz.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_vulnerabilities_wiz_by_container", "/en/security/*/my-first-rule.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/guided_onboarding_sample_rule", + "/en/security/*/mysql-user-defined-function-injection.html": "/docs/reference/security/prebuilt-rules/rules/network/persistence_mysql_udf_injection", "/en/security/*/namespace-manipulation-using-unshare.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_unshare_namespace_manipulation", "/en/security/*/netcat-listener-established-via-rlwrap.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_nc_listener_via_rlwrap", "/en/security/*/netsh-helper-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_netsh_helper_dll", + "/en/security/*/netsupport-manager-execution-from-an-unusual-path.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_rmm_netsupport_susp_path", "/en/security/*/network-activity-detected-via-cat.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_cat_network_activity", "/en/security/*/network-activity-detected-via-kworker.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_kworker_netcon", + "/en/security/*/network-activity-to-a-suspicious-top-level-domain.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_dns_susp_tld", "/en/security/*/network-connection-by-cups-or-foomatic-rip-child.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_cupsd_foomatic_rip_netcon", + "/en/security/*/network-connection-followed-by-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_netcon_file_creation", "/en/security/*/network-connection-from-binary-with-rwx-memory-region.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_netcon_from_rwx_mem_region_binary", "/en/security/*/network-connection-initiated-by-sshd-child-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_ssh_netcon", + "/en/security/*/network-connection-initiated-by-suspicious-sshd-child-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_ssh_netcon", + "/en/security/*/network-connection-to-oast-domain-via-script-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_network_connection_to_oast_domain", "/en/security/*/network-connection-via-certutil.html": "/docs/reference/security/prebuilt-rules/rules_building_block/command_and_control_certutil_network_connection", "/en/security/*/network-connection-via-compiled-html-file.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_html_help_executable_program_connecting_to_the_internet", "/en/security/*/network-connection-via-msxsl.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_msxsl_network", "/en/security/*/network-connection-via-recently-compiled-executable.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_network_event_post_compilation", "/en/security/*/network-connection-via-registration-utility.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_register_server_program_connecting_to_the_internet", "/en/security/*/network-connection-via-signed-binary.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet", - "/en/security/*/network-connection-via-sudo-binary.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_netcon_via_sudo_binary", + "/en/security/*/network-connection-via-sudo-binary.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/network-connections-initiated-through-xdg-autostart-entry.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_xdg_autostart_netcon", "/en/security/*/network-level-authentication-nla-disabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_disable_nla", "/en/security/*/network-logon-provider-registry-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_persistence_network_logon_provider_modification", @@ -11847,27 +12501,78 @@ "/en/security/*/new-activesyncalloweddeviceid-added-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device", "/en/security/*/new-github-app-installed.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/execution_new_github_app_installed", "/en/security/*/new-github-owner-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/persistence_github_org_owner_added", - "/en/security/*/new-okta-authentication-behavior-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_new_authentication_behavior_detection", + "/en/security/*/new-github-personal-access-token-pat-added.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/persistence_new_pat_created", + "/en/security/*/new-github-self-hosted-action-runner.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/initial_access_github_register_self_hosted_runner", + "/en/security/*/new-okta-authentication-behavior-detected.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_new_okta_authentication_behavior", "/en/security/*/new-okta-identity-provider-idp-added-by-admin.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_new_idp_successfully_added_by_admin", - "/en/security/*/new-or-modified-federation-domain.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/privilege_escalation_new_or_modified_federation_domain", + "/en/security/*/new-or-modified-federation-domain.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain", "/en/security/*/new-user-added-to-github-organization.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_github_new_user_added_to_organization", + "/en/security/*/newly-observed-elastic-defend-behavior-alert.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/newly_observed_elastic_defend_alert", + "/en/security/*/newly-observed-fortigate-alert.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/newly_observed_fortigate_alert", + "/en/security/*/newly-observed-high-severity-detection-alert.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/newly_observed_elastic_detection_rule", + "/en/security/*/newly-observed-high-severity-suricata-alert.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/newly_observed_suricata_alert", + "/en/security/*/newly-observed-ipsec-nat-traversal-peer.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_newly_observed_ipsec_nat_traversal_peer", + "/en/security/*/newly-observed-palo-alto-network-alert.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/newly_observed_panos_alert", + "/en/security/*/newly-observed-process-exhibiting-high-cpu-usage.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/impact_newly_observed_process_with_high_cpu", + "/en/security/*/newly-observed-rc4-kerberos-service-ticket-request.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_kerberos_service_ticket_rc4", + "/en/security/*/newly-observed-screenconnect-host-server.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_newly_observed_screenconnect_host_server", + "/en/security/*/newly-seen-commonly-abused-network-scanner.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_newly_seen_abused_scanners", + "/en/security/*/node-js-pre-or-post-install-script-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution", "/en/security/*/nping-process-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_linux_nping_activity", + "/en/security/*/nsenter-to-pid-namespace-via-auditd.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_auditd_nsenter_target_host_pid", "/en/security/*/ntds-dump-via-wbadmin.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_wbadmin_ntds", "/en/security/*/ntds-or-sam-database-file-copied.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline", "/en/security/*/nullsessionpipe-registry-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification", - "/en/security/*/o365-email-reported-by-user-as-malware-or-phish.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_o365_user_reported_phish_malware", - "/en/security/*/o365-excessive-single-sign-on-logon-errors.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/credential_access_user_excessive_sso_logon_errors", - "/en/security/*/o365-exchange-suspicious-mailbox-right-delegation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_right_delegation", - "/en/security/*/o365-mailbox-audit-logging-bypass.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_microsoft_365_mailboxauditbypassassociation", + "/en/security/*/o365-email-reported-by-user-as-malware-or-phish.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/o365-excessive-single-sign-on-logon-errors.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user", + "/en/security/*/o365-exchange-suspicious-mailbox-right-delegation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation", + "/en/security/*/o365-mailbox-audit-logging-bypass.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association", "/en/security/*/office-test-registry-persistence.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_msoffice_startup_registry", "/en/security/*/offline-endpoint.html": "/docs/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments", - "/en/security/*/okta-brute-force-or-password-spraying-attack.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying", + "/en/security/*/okta-admin-console-login-failure.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_okta_admin_console_login_failure", + "/en/security/*/okta-aitm-session-cookie-replay.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_aitm_session_cookie_replay", + "/en/security/*/okta-alerts-following-unusual-proxy-authentication.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_okta_suspicious_activity_after_proxy_authentication", + "/en/security/*/okta-brute-force-or-password-spraying-attack.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_password_spray_single_source", "/en/security/*/okta-fastpass-phishing-detection.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_okta_fastpass_phishing", + "/en/security/*/okta-multiple-os-names-detected-for-a-single-dt-hash.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_multiple_user_agent_os_authentication", "/en/security/*/okta-sign-in-events-via-third-party-idp.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp", + "/en/security/*/okta-successful-login-after-credential-attack.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_successful_login_after_credential_attack", "/en/security/*/okta-threatinsight-threat-suspected-promotion.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion", + "/en/security/*/okta-user-assigned-administrator-role.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user", "/en/security/*/okta-user-session-impersonation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_user_impersonation_access", "/en/security/*/okta-user-sessions-started-from-different-geolocations.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations", - "/en/security/*/onedrive-malware-file-upload.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/lateral_movement_malware_uploaded_onedrive", + "/en/security/*/ollama-api-accessed-from-external-network.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_ollama_api_external_access", + "/en/security/*/ollama-dns-query-to-untrusted-domain.html": "/docs/reference/security/prebuilt-rules/rules_building_block/command_and_control_ollama_model_download_untrusted_source", + "/en/security/*/onedrive-malware-file-upload.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded", + "/en/security/*/openai-chatgpt-enterprise-account-owner-role-assigned.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-app-authentication-linked.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-assistant-advises-credential-rotation-after-suspected-exposure.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-authentication-from-a-suspicious-user-agent.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-codex-access-token-created.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-codex-prompt-containing-credentials.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-codex-security-scan-configuration-changed.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-conversation-message-containing-credentials.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-conversation-shared.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-custom-agent-published.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-custom-agent-trigger-changed.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-domain-created.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-excessive-conversation-deletion.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-google-drive-sensitive-query-burst.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-high-codex-mcp-tool-diversity.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-high-file-download-activity.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-memory-deleted.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-multiple-authentication-failures.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-repeated-assistant-refusals.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-resources-sharing-updated.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-slack-query-burst.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-unusual-codex-mcp-tool-call.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-unusual-codex-plugin-installed.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-unusual-mcp-app-activity.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-user-activity-from-high-number-of-countries.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-user-invite-sent.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-workspace-feature-toggled.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-workspace-log-file-deleted.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/openai-chatgpt-enterprise-workspace-log-files-accessed.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/openssl-client-or-server-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_openssl_client_or_server", "/en/security/*/openssl-password-hash-generation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_openssl_passwd_hash_generation", "/en/security/*/osquery-placeholder-fields.html": "/docs/solutions/security/investigate/use-placeholder-fields-in-osquery-queries", @@ -11875,10 +12580,18 @@ "/en/security/*/outbound-scheduled-task-activity-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_scheduled_task_powershell_source", "/en/security/*/outlook-home-page-registry-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_outlook_home_page", "/en/security/*/overview-dashboard.html": "/docs/solutions/security/dashboards/overview-dashboard", + "/en/security/*/panw-and-elastic-defend-command-and-control-correlation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_pan_elastic_defend_c2", + "/en/security/*/parent-process-detected-with-suspicious-windows-process-es.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process", "/en/security/*/parent-process-pid-spoofing.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_parent_process_pid_spoofing", + "/en/security/*/passwordless-sudo-probing.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_passwordless_sudo_probing", + "/en/security/*/payload-downloaded-by-interpreter-and-piped-to-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_payload_downloaded_by_interpreter_and_piped_to_interpreter", + "/en/security/*/pbpaste-execution-via-unusual-parent-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/collection_pbpaste_execution_via_unusual_parent", "/en/security/*/peripheral-device-discovery.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_peripheral_device", + "/en/security/*/perl-outbound-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_perl_outbound_network_connection", "/en/security/*/permission-theft-detected-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/privilege_escalation_endgame_permission_theft_detected", "/en/security/*/permission-theft-prevented-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/privilege_escalation_endgame_permission_theft_prevented", + "/en/security/*/persistence-via-a-hidden-plist-filename-via-macos-security-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/macos/persistence_hidden_plist_filename_via_security_events", + "/en/security/*/persistence-via-a-hidden-plist-filename.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_hidden_plist_filename", "/en/security/*/persistence-via-a-windows-installer.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_msi_installer_task_startup", "/en/security/*/persistence-via-bits-job-notify-cmdline.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_bits_job_notify_command", "/en/security/*/persistence-via-directoryservice-plugin-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_directory_services_plugins_modification", @@ -11891,33 +12604,49 @@ "/en/security/*/persistence-via-microsoft-outlook-vba.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_ms_outlook_vba_template", "/en/security/*/persistence-via-powershell-profile.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_powershell_profiles", "/en/security/*/persistence-via-scheduled-job-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_local_scheduled_job_creation", + "/en/security/*/persistence-via-suspicious-launch-agent-or-launch-daemon.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_suspicious_launch_agent_or_launch_daemon", "/en/security/*/persistence-via-telemetrycontroller-scheduled-task-hijack.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack", "/en/security/*/persistence-via-update-orchestrator-service-hijack.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_update_orchestrator_service_hijack", "/en/security/*/persistence-via-wmi-event-subscription.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_windows_management_instrumentation_event_subscription", "/en/security/*/persistence-via-wmi-standard-registry-provider.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_wmi_stdregprov_run_services", "/en/security/*/persistent-scripts-in-the-startup-directory.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_startup_folder_scripts", + "/en/security/*/php-file-creation-in-wordpress-plugin-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_php_file_creation_in_wordpress_plugin_dir", + "/en/security/*/pkinit-followed-by-same-principal-u2u-service-ticket.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_pkinit_same_principal_u2u", + "/en/security/*/pluggable-authentication-module-or-configuration-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_pluggable_authentication_module_creation", "/en/security/*/pluggable-authentication-module-pam-creation-in-unusual-directory.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_pluggable_authentication_module_creation_in_unusual_dir", "/en/security/*/pluggable-authentication-module-pam-source-download.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_pluggable_authentication_module_source_download", "/en/security/*/pluggable-authentication-module-pam-version-discovery.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_pam_version_discovery", + "/en/security/*/pod-or-container-creation-with-suspicious-command-line.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution", "/en/security/*/policies-page-ov.html": "/docs/solutions/security/manage-elastic-defend/policies", "/en/security/*/polkit-policy-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_polkit_policy_creation", "/en/security/*/polkit-version-discovery.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_polkit_version_discovery", "/en/security/*/port-forwarding-rule-addition.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_port_forwarding_added_registry", "/en/security/*/possible-fin7-dga-command-and-control-behavior.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_fin7_c2_behavior", "/en/security/*/possible-okta-dos-attack.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/impact_possible_okta_dos_attack", + "/en/security/*/postgresql-copy-program-command-execution.html": "/docs/reference/security/prebuilt-rules/rules/network/execution_postgresql_copy_program_command", "/en/security/*/potential-abuse-of-resources-by-high-token-count-and-large-response-sizes.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_high_resource_consumption_detection", + "/en/security/*/potential-account-takeover-logon-from-new-source-ip.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_takeover_new_source_ip", + "/en/security/*/potential-account-takeover-mixed-logon-types.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_account_takeover_mixed_logon_types", "/en/security/*/potential-active-directory-replication-account-backdoor.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dcsync_user_backdoor", "/en/security/*/potential-adidns-poisoning-via-wildcard-record-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_adidns_wildcard", "/en/security/*/potential-admin-group-account-addition.html": "/docs/reference/security/prebuilt-rules/rules/macos/privilege_escalation_local_user_added_to_admin", + "/en/security/*/potential-amsi-bypass-via-rpc-runtime-hooking.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_amsi_bypass_rpc_ndrclientcall", "/en/security/*/potential-antimalware-scan-interface-bypass-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_amsi_bypass_powershell", "/en/security/*/potential-application-shimming-via-sdbinst.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_via_application_shimming", - "/en/security/*/potential-aws-s3-bucket-ransomware-note-uploaded.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_extension", + "/en/security/*/potential-aws-s3-bucket-ransomware-note-uploaded.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_keyword", "/en/security/*/potential-azure-openai-model-theft.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure_openai/azure_openai_model_theft_detection", + "/en/security/*/potential-backdoor-execution-through-pam-exec.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_pluggable_authentication_module_pam_exec_backdoor_exec", "/en/security/*/potential-buffer-overflow-attack-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_bufferoverflow_attack", + "/en/security/*/potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_adcs_certificate_identity_transposition", "/en/security/*/potential-chroot-container-escape-via-mount.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_docker_mount_chroot_container_escape", + "/en/security/*/potential-clickfix-command-via-windows-run-dialog.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_windows_clickfix_runmru", "/en/security/*/potential-code-execution-via-postgresql.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_remote_code_execution_via_postgresql", "/en/security/*/potential-command-and-control-via-internet-explorer.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_iexplore_via_com", + "/en/security/*/potential-command-shell-via-netcat.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_revshell_cmd_via_netcat", + "/en/security/*/potential-computer-account-ntlm-relay-activity.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dollar_account_relay", "/en/security/*/potential-cookies-theft-via-browser-debugging.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging", + "/en/security/*/potential-copy-fail-cve-2026-31431-exploitation-via-af-alg-socket.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_copy_fail_cve_2026_31431_exploitation_via_af_alg_socket", + "/en/security/*/potential-cpanel-whm-crlf-authentication-bypass-cve-2026-41940.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_potential_cpanel_whm_crlf_authentication_bypass", "/en/security/*/potential-credential-access-via-dcsync.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dcsync_replication_rights", "/en/security/*/potential-credential-access-via-duplicatehandle-in-lsass.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump", "/en/security/*/potential-credential-access-via-lsass-memory-dump.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_lsass_access_memdump", @@ -11925,41 +12654,80 @@ "/en/security/*/potential-credential-access-via-renamed-com-services-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_comsvcs_imageload", "/en/security/*/potential-credential-access-via-trusted-developer-utility.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_credential_dumping_msbuild", "/en/security/*/potential-credential-access-via-windows-utilities.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_cmdline_dump_tool", - "/en/security/*/potential-curl-cve-2023-38545-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_curl_cve_2023_38545_heap_overflow", + "/en/security/*/potential-credential-discovery-via-recursive-grep.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_grep_recursive_credential_discovery", + "/en/security/*/potential-curl-cve-2023-38545-exploitation.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-cve-2025-32463-nsswitch-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_cve_2025_32463_nsswitch_file_creation", + "/en/security/*/potential-cve-2025-32463-sudo-chroot-execution-attempt.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution", + "/en/security/*/potential-cve-2025-33053-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_url_cve_2025_33053", "/en/security/*/potential-data-exfiltration-activity-to-an-unusual-destination-port.html": "/docs/reference/security/prebuilt-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port", "/en/security/*/potential-data-exfiltration-activity-to-an-unusual-ip-address.html": "/docs/reference/security/prebuilt-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip", "/en/security/*/potential-data-exfiltration-activity-to-an-unusual-iso-code.html": "/docs/reference/security/prebuilt-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code", "/en/security/*/potential-data-exfiltration-activity-to-an-unusual-region.html": "/docs/reference/security/prebuilt-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name", + "/en/security/*/potential-data-exfiltration-through-curl.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/exfiltration_potential_curl_data_exfiltration", + "/en/security/*/potential-data-exfiltration-through-wget.html": "/docs/reference/security/prebuilt-rules/rules/linux/exfiltration_potential_wget_data_exfiltration", + "/en/security/*/potential-data-exfiltration-via-rclone.html": "/docs/reference/security/prebuilt-rules/rules/windows/exfiltration_rclone_cloud_upload", "/en/security/*/potential-data-splitting-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/exfiltration_potential_data_splitting_for_exfiltration", + "/en/security/*/potential-database-dumping-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/exfiltration_potential_database_dumping", "/en/security/*/potential-defense-evasion-via-cmstp-exe.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_cmstp_execution", "/en/security/*/potential-defense-evasion-via-doas.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_doas_configuration_creation_or_rename", "/en/security/*/potential-defense-evasion-via-proot.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_potential_proot_exploits", "/en/security/*/potential-denial-of-azure-openai-ml-service.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure_openai/azure_openai_denial_of_ml_service_detection", + "/en/security/*/potential-destructive-aws-cli-command-executed-by-genai-agent.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/impact_destructive_aws_cli_execution_by_genai_agent", "/en/security/*/potential-dga-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability", + "/en/security/*/potential-dhcp-starvation-via-high-client-mac-cardinality.html": "/docs/reference/security/prebuilt-rules/rules/network/impact_dhcp_starvation_high_client_mac_cardinality", + "/en/security/*/potential-direct-kubelet-access-via-process-arguments.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_direct_kubelet_access_via_process_args", "/en/security/*/potential-disabling-of-apparmor.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_disable_apparmor_attempt", "/en/security/*/potential-disabling-of-selinux.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_disable_selinux_attempt", "/en/security/*/potential-dll-side-loading-via-microsoft-antimalware-service-executable.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_windefend_unusual_path", "/en/security/*/potential-dll-side-loading-via-trusted-microsoft-programs.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_suspicious_explorer_winword", + "/en/security/*/potential-dns-exfiltration-via-excessive-chunked-queries.html": "/docs/reference/security/prebuilt-rules/rules/windows/exfiltration_excessive_dns_queries_by_process", + "/en/security/*/potential-dns-rebinding-from-public-to-private-address.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_dns_rebinding_private_ip_answer", "/en/security/*/potential-dns-tunneling-via-nslookup.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_dns_tunneling_nslookup", + "/en/security/*/potential-dns-tunneling-via-null-or-long-dns-queries.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_dns_tunneling_long_labels", + "/en/security/*/potential-docker-escape-via-nsenter.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_docker_escape_via_nsenter", + "/en/security/*/potential-dynamic-iex-reconstruction-via-environment-variables.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction", + "/en/security/*/potential-edr-freeze-via-werfaultsecure-abuse.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_edr_freeze_via_werfaultsecure", + "/en/security/*/potential-entra-id-prt-extraction-via-browsercore.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_entraid_prt_via_browsercore", "/en/security/*/potential-enumeration-via-active-directory-web-service.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_active_directory_webservice", "/en/security/*/potential-escalation-via-vulnerable-msi-repair.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_msi_repair_via_mshelp_link", + "/en/security/*/potential-etherhiding-c2-via-blockchain-connection.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_potential_etherhiding_c2", + "/en/security/*/potential-etherhiding-c2-via-curl-json-rpc-request.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_etherhiding_c2_via_blockchain_rpc_request", + "/en/security/*/potential-evasion-via-boot-time-removal-tool.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_boot_time_removal_tool", "/en/security/*/potential-evasion-via-filter-manager.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_via_filter_manager", "/en/security/*/potential-evasion-via-windows-filtering-platform.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_windows_filtering_platform", "/en/security/*/potential-execution-of-rc-local-script.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_rc_local_service_already_running", + "/en/security/*/potential-execution-via-filefix-phishing-attack.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_windows_phish_clickfix", + "/en/security/*/potential-execution-via-ssh-backdoor.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor", "/en/security/*/potential-execution-via-xzbackdoor.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor", "/en/security/*/potential-exploitation-of-an-unquoted-service-path-vulnerability.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_unquoted_service_path", "/en/security/*/potential-external-linux-ssh-brute-force-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_external", + "/en/security/*/potential-fake-captcha-phishing-attack.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_windows_fakecaptcha_cmd_ps", "/en/security/*/potential-file-download-via-a-headless-browser.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_headless_browser", "/en/security/*/potential-file-transfer-via-certreq.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_certreq_postdata", "/en/security/*/potential-file-transfer-via-curl-for-windows.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_tool_transfer_via_curl", + "/en/security/*/potential-filefix-command-via-windows-explorer-address-bar.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_windows_filefix_typedpaths", + "/en/security/*/potential-fileless-execution-via-o-tmpfile.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_fileless_execution_via_o_tempfile", "/en/security/*/potential-foxmail-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_initial_access_foxmail_exploit", - "/en/security/*/potential-hex-payload-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_hex_payload_execution", + "/en/security/*/potential-git-cve-2025-48384-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_git_exploit_cve_2025_48384", + "/en/security/*/potential-hex-payload-execution-via-command-line.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_hex_payload_execution_via_commandline", + "/en/security/*/potential-hex-payload-execution-via-common-utility.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_hex_payload_execution_via_utility", + "/en/security/*/potential-hex-payload-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_hex_payload_execution_via_utility", "/en/security/*/potential-hidden-local-user-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_account_creation_hide_at_logon", "/en/security/*/potential-hidden-process-via-mount-hidepid.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_mount_execution", + "/en/security/*/potential-http-downgrade-attack.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack", + "/en/security/*/potential-icmp-tunneling-activity-to-the-internet.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_potential_icmp_tunneling_to_the_internet", + "/en/security/*/potential-iis-web-shell-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_web_shell_aspx_write", + "/en/security/*/potential-impersonation-attempt-via-kubectl.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_potential_kubectl_impersonation", "/en/security/*/potential-internal-linux-ssh-brute-force-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal", "/en/security/*/potential-invoke-mimikatz-powershell-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_mimikatz_powershell_module", "/en/security/*/potential-java-jndi-exploitation-attempt.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_suspicious_java_netcon_childproc", + "/en/security/*/potential-java-service-exploitation-via-suspicious-child-process.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_suspicious_java_netcon_childproc", "/en/security/*/potential-kerberos-attack-via-bifrost.html": "/docs/reference/security/prebuilt-rules/rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole", + "/en/security/*/potential-kerberos-coercion-via-dns-based-spn-spoofing.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_kerberos_coerce", + "/en/security/*/potential-kerberos-relay-attack-against-a-computer-account.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dollar_account_relay_kerberos", + "/en/security/*/potential-kerberos-spn-spoofing-via-suspicious-dns-query.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_kerberos_coerce_dns", + "/en/security/*/potential-kubectl-masquerading-via-unexpected-process.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_potential_kubectl_masquerading", + "/en/security/*/potential-kubeletctl-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_potential_kubeletctl_execution", "/en/security/*/potential-lateral-tool-transfer-via-smb-share.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_executable_tool_transfer_smb", "/en/security/*/potential-linux-backdoor-user-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_linux_backdoor_user_creation", "/en/security/*/potential-linux-credential-dumping-via-proc-filesystem.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_proc_credential_dumping", @@ -11967,47 +12735,78 @@ "/en/security/*/potential-linux-hack-tool-launched.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_potential_hack_tool_executed", "/en/security/*/potential-linux-local-account-brute-force-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_linux_local_account_bruteforce", "/en/security/*/potential-linux-ransomware-note-creation-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/impact_potential_linux_ransomware_note_detected", + "/en/security/*/potential-linux-tunneling-and-or-port-forwarding-via-command-line.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_potential_tunneling_command_line", + "/en/security/*/potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_tunneling_via_ssh_option", "/en/security/*/potential-linux-tunneling-and-or-port-forwarding.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_tunneling_and_port_forwarding", "/en/security/*/potential-local-ntlm-relay-via-http.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss", "/en/security/*/potential-lsa-authentication-package-abuse.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_lsa_auth_package", "/en/security/*/potential-lsass-clone-creation-via-psscapturesnapshot.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_via_snapshot_lsass_clone_creation", "/en/security/*/potential-lsass-memory-dump-via-psscapturesnapshot.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_lsass_access_via_snapshot", + "/en/security/*/potential-machine-account-relay-attack-via-smb.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_machine_account_smb_relay", "/en/security/*/potential-macos-ssh-brute-force-detected.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_potential_macos_ssh_bruteforce", + "/en/security/*/potential-malicious-powershell-based-on-alert-correlation.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_posh_malicious_script_agg", "/en/security/*/potential-malware-driven-ssh-brute-force-attempt.html": "/docs/reference/security/prebuilt-rules/rules/linux/impact_potential_bruteforce_malware_infection", "/en/security/*/potential-masquerading-as-browser-process.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_masquerading_browsers", "/en/security/*/potential-masquerading-as-business-app-installer.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_business_apps_installer", "/en/security/*/potential-masquerading-as-communication-apps.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_communication_apps", - "/en/security/*/potential-masquerading-as-system32-dll.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_masquerading_windows_dll", + "/en/security/*/potential-masquerading-as-system32-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_windows_dll", "/en/security/*/potential-masquerading-as-system32-executable.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_masquerading_windows_system32_exe", "/en/security/*/potential-masquerading-as-vlc-dll.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_masquerading_vlc_dll", "/en/security/*/potential-memory-seeking-activity.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_potential_memory_seeking_activity", "/en/security/*/potential-meterpreter-reverse-shell.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_via_meterpreter_linux", "/en/security/*/potential-microsoft-office-sandbox-evasion.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file", "/en/security/*/potential-modification-of-accessibility-binaries.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_priv_escalation_via_accessibility_features", + "/en/security/*/potential-netntlmv1-downgrade-attack.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_ntlm_downgrade", + "/en/security/*/potential-netscaler-log-poisoning-command-injection-attempt.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_netscaler_log_poisoning_command_injection", "/en/security/*/potential-network-scan-detected.html": "/docs/reference/security/prebuilt-rules/rules/network/discovery_potential_port_scan_detected", "/en/security/*/potential-network-scan-executed-from-host.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_ping_sweep_detected", "/en/security/*/potential-network-share-discovery.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_net_share_discovery_winlog", "/en/security/*/potential-network-sweep-detected.html": "/docs/reference/security/prebuilt-rules/rules/network/discovery_potential_network_sweep_detected", - "/en/security/*/potential-non-standard-port-http-https-connection.html": "/docs/reference/security/prebuilt-rules/rules_building_block/command_and_control_non_standard_http_port", - "/en/security/*/potential-non-standard-port-ssh-connection.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_non_standard_ssh_port", + "/en/security/*/potential-non-standard-port-http-https-connection.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-non-standard-port-ssh-connection.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-notepad-markdown-rce-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_notepad_markdown_child_process", + "/en/security/*/potential-ntlm-relay-attack-against-a-computer-account.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dollar_account_relay_ntlm", + "/en/security/*/potential-okta-brute-force-device-token-rotation.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation", + "/en/security/*/potential-okta-brute-force-multi-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_brute_force_multi_source", + "/en/security/*/potential-okta-credential-stuffing-single-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source", "/en/security/*/potential-okta-mfa-bombing-via-push-notifications.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications", + "/en/security/*/potential-okta-password-spray-multi-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_password_spray_multi_source", + "/en/security/*/potential-okta-password-spray-single-source.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_password_spray_single_source", "/en/security/*/potential-openssh-backdoor-logging-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_ssh_backdoor_log", "/en/security/*/potential-outgoing-rdp-connection-by-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules_building_block/lateral_movement_rdp_conn_unusual_process", "/en/security/*/potential-pass-the-hash-pth-attempt.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_alternate_creds_pth", + "/en/security/*/potential-password-spraying-attack-via-ssh.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_password_spraying_attack", "/en/security/*/potential-persistence-via-atom-init-script-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_via_atom_init_file_modification", "/en/security/*/potential-persistence-via-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/fim/persistence_suspicious_file_modifications", "/en/security/*/potential-persistence-via-login-hook.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_loginwindow_plist_modification", - "/en/security/*/potential-persistence-via-periodic-tasks.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_periodic_tasks_file_mdofiy", + "/en/security/*/potential-persistence-via-mandatory-user-profile.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_suspicious_user_mandatory_profile_file", + "/en/security/*/potential-persistence-via-periodic-tasks.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_periodic_tasks_file_modify", "/en/security/*/potential-persistence-via-time-provider-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_time_provider_mod", - "/en/security/*/potential-port-monitor-or-print-processor-registration-abuse.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_port_monitor_print_pocessor_abuse", + "/en/security/*/potential-php2shell-exploitation-attempt.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-port-monitor-or-print-processor-registration-abuse.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_port_monitor_print_processor_abuse", "/en/security/*/potential-port-scanning-activity-from-compromised-host.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_port_scanning_activity_from_compromised_host", "/en/security/*/potential-powershell-hacktool-script-by-author.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_posh_hacktool_authors", "/en/security/*/potential-powershell-hacktool-script-by-function-names.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_posh_hacktool_functions", - "/en/security/*/potential-powershell-obfuscated-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation", + "/en/security/*/potential-powershell-obfuscated-script-via-high-entropy.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_high_entropy", + "/en/security/*/potential-powershell-obfuscated-script.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var", + "/en/security/*/potential-powershell-obfuscation-via-character-array-reconstruction.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays", + "/en/security/*/potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic", + "/en/security/*/potential-powershell-obfuscation-via-high-numeric-character-proportion.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion", + "/en/security/*/potential-powershell-obfuscation-via-high-special-character-proportion.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_posh_obfuscation_proportion_special_chars", + "/en/security/*/potential-powershell-obfuscation-via-invalid-escape-sequences.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_backtick", + "/en/security/*/potential-powershell-obfuscation-via-reverse-keywords.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword", + "/en/security/*/potential-powershell-obfuscation-via-special-character-overuse.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion", + "/en/security/*/potential-powershell-obfuscation-via-string-concatenation.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_string_concat", + "/en/security/*/potential-powershell-obfuscation-via-string-reordering.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_string_format", "/en/security/*/potential-powershell-pass-the-hash-relay-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_posh_relay_tools", "/en/security/*/potential-privacy-control-bypass-via-localhost-secure-copy.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess", "/en/security/*/potential-privacy-control-bypass-via-tccdb-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_privacy_controls_tcc_database_modification", + "/en/security/*/potential-privilege-escalation-in-container-via-runc-init.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_container_runc_init_effective_root_auditd", "/en/security/*/potential-privilege-escalation-through-writable-docker-socket.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_writable_docker_socket", + "/en/security/*/potential-privilege-escalation-via-a-parent-child-process-sequence.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent_child", + "/en/security/*/potential-privilege-escalation-via-a-parent-process-sequence.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent", + "/en/security/*/potential-privilege-escalation-via-a-suspicious-uid-change.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_child", "/en/security/*/potential-privilege-escalation-via-container-misconfiguration.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_container_util_misconfiguration", "/en/security/*/potential-privilege-escalation-via-cve-2022-38028.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_exploit_cve_202238028", "/en/security/*/potential-privilege-escalation-via-cve-2023-4911.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911", @@ -12020,23 +12819,38 @@ "/en/security/*/potential-privilege-escalation-via-recently-compiled-executable.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_uid_change_post_compilation", "/en/security/*/potential-privilege-escalation-via-service-imagepath-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_reg_service_imagepath_mod", "/en/security/*/potential-privilege-escalation-via-sudoers-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers", - "/en/security/*/potential-privilege-escalation-via-uid-int-max-bug-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_linux_uid_int_max_bug", + "/en/security/*/potential-privilege-escalation-via-suid-sgid-proxy-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_suid_sgid_proxy_execution", + "/en/security/*/potential-privilege-escalation-via-suid-sgid.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_suid_lpe_via_process_args", + "/en/security/*/potential-privilege-escalation-via-uid-int-max-bug-detected.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-privilege-escalation-via-unshare-and-uid-change.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_overlayfs_local_privesc", + "/en/security/*/potential-privilege-escalation-via-unshare-followed-by-root-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_unshare_to_root_process_auditd_sequence", "/en/security/*/potential-privileged-escalation-via-samaccountname-spoofing.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_samaccountname_spoofing_attack", "/en/security/*/potential-process-injection-from-malicious-document.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_injection_from_msoffice", "/en/security/*/potential-process-injection-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_process_injection", "/en/security/*/potential-process-name-stomping-with-prctl.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_prctl_process_name_tampering", + "/en/security/*/potential-prompt-injection-coercing-shell-execution.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/potential-protocol-tunneling-via-chisel-client.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_chisel_client_activity", - "/en/security/*/potential-protocol-tunneling-via-chisel-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_chisel_server_activity", + "/en/security/*/potential-protocol-tunneling-via-chisel-server.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-protocol-tunneling-via-cloudflared.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_tunnel_cloudflared", "/en/security/*/potential-protocol-tunneling-via-earthworm.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_tunneling_via_earthworm", - "/en/security/*/potential-pspy-process-monitoring-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_pspy_process_monitoring_detected", + "/en/security/*/potential-protocol-tunneling-via-yuze.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_tunnel_yuze", + "/en/security/*/potential-proxy-execution-via-systemd-run.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_proxy_execution_via_systemd_run", + "/en/security/*/potential-pspy-process-monitoring-detected.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/potential-ransomware-behavior-high-count-of-readme-files-by-system.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_high_freq_file_renames_by_kernel", + "/en/security/*/potential-ransomware-behavior-note-files-by-system.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_high_freq_file_renames_by_kernel", "/en/security/*/potential-ransomware-note-file-dropped-via-smb.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_ransomware_note_file_over_smb", + "/en/security/*/potential-redis-config-set-cron-directory-persistence-redisraider.html": "/docs/reference/security/prebuilt-rules/rules/network/persistence_potential_redis_config_set_cron_persistence", + "/en/security/*/potential-redis-config-set-ssh-authorized-key-injection.html": "/docs/reference/security/prebuilt-rules/rules/network/persistence_potential_redis_config_set_ssh_key_injection", + "/en/security/*/potential-redis-lua-use-after-free-rce-attempt-cve-2025-49844-redishell.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_potential_redis_lua_use_after_free_rce_cve_2025_49844", "/en/security/*/potential-relay-attack-against-a-domain-controller.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_dollar_account_relay", - "/en/security/*/potential-remote-code-execution-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_linux_shell_activity_via_web_server", + "/en/security/*/potential-remcos-trojan-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_remcos_rat_iocs", + "/en/security/*/potential-remote-code-execution-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_suspicious_child_execution", "/en/security/*/potential-remote-credential-access-via-registry.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_remote_sam_secretsdump", "/en/security/*/potential-remote-desktop-shadowing-activity.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_evasion_rdp_shadowing", "/en/security/*/potential-remote-desktop-tunneling-detected.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_rdp_tunnel_plink", "/en/security/*/potential-remote-file-execution-via-msiexec.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_execution_remote_via_msiexec", + "/en/security/*/potential-remote-install-via-msiexec.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_msiexec_remote_payload", + "/en/security/*/potential-remotemonologue-attack.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_regmod_remotemonologue", "/en/security/*/potential-reverse-shell-activity-via-terminal.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_revershell_via_shell_cmd", "/en/security/*/potential-reverse-shell-via-background-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_via_background_process", "/en/security/*/potential-reverse-shell-via-child.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_via_child_tcp_utility_linux", @@ -12045,15 +12859,27 @@ "/en/security/*/potential-reverse-shell-via-suspicious-child-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_via_lolbin_interpreter_linux", "/en/security/*/potential-reverse-shell-via-udp.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_via_udp_cli_utility_linux", "/en/security/*/potential-reverse-shell.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_shell_via_tcp_cli_utility_linux", + "/en/security/*/potential-root-effective-shell-from-non-standard-path-via-auditd.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_auditd_euid_root_shell_from_non_standard_path", + "/en/security/*/potential-sap-netweaver-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_sap_netweaver_webshell_exec", + "/en/security/*/potential-sap-netweaver-webshell-creation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_sap_netweaver_jsp_webshell", + "/en/security/*/potential-secret-scanning-via-gitleaks.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_gitleaks_execution", "/en/security/*/potential-secure-file-deletion-via-sdelete-utility.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_sdelete_like_filename_rename", + "/en/security/*/potential-self-signed-tls-certificate-recently-issued-on-external-connection.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_tls_self_signed_recent_external_connection", "/en/security/*/potential-shadow-credentials-added-to-ad-object.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_shadow_credentials", "/en/security/*/potential-shadow-file-read-via-command-line-utilities.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_shadow_file_read", "/en/security/*/potential-sharprdp-behavior.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_rdp_sharprdp_target", "/en/security/*/potential-shell-via-wildcard-injection-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_wildcard_shell_spawn", + "/en/security/*/potential-snap-confine-privilege-escalation-via-cve-2026-3888.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_snap_confine_lpe_via_cve_2026_3888", + "/en/security/*/potential-spike-in-web-server-error-logs.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs", + "/en/security/*/potential-sql-injection-against-microsoft-sql-server.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_mssql_potential_sql_injection", + "/en/security/*/potential-ssh-brute-force-detected-via-macos-security-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/macos/credential_access_potential_macos_ssh_bruteforce_via_security_events", "/en/security/*/potential-ssh-it-ssh-worm-downloaded.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_ssh_it_worm_download", + "/en/security/*/potential-ssh-password-grabbing-via-strace.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_ssh_password_grabbing_via_strace", + "/en/security/*/potential-ssh-reverse-port-forwarding.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_openssh_reverse_port_forwarding", "/en/security/*/potential-subnet-scanning-activity-from-compromised-host.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_subnet_scanning_activity_from_compromised_host", - "/en/security/*/potential-successful-linux-ftp-brute-force-attack-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce", - "/en/security/*/potential-successful-linux-rdp-brute-force-attack-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce", + "/en/security/*/potential-successful-linux-ftp-brute-force-attack-detected.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-successful-linux-rdp-brute-force-attack-detected.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/potential-successful-ssh-brute-force-attack-via-macos-security-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/macos/credential_access_potential_successful_macos_ssh_bruteforce_via_security_events", "/en/security/*/potential-successful-ssh-brute-force-attack.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce", "/en/security/*/potential-sudo-hijacking.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_sudo_hijacking", "/en/security/*/potential-sudo-privilege-escalation-via-cve-2019-14287.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_sudo_cve_2019_14287", @@ -12061,15 +12887,27 @@ "/en/security/*/potential-suspicious-debugfs-root-device-access.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_sda_disk_mount_non_root", "/en/security/*/potential-suspicious-file-edit.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_suspicious_file_opened_through_editor", "/en/security/*/potential-syn-based-port-scan-detected.html": "/docs/reference/security/prebuilt-rules/rules/network/discovery_potential_syn_port_scan_detected", + "/en/security/*/potential-system-tampering-via-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_mod_critical_os_files", + "/en/security/*/potential-telnet-authentication-bypass-cve-2026-24061.html": "/docs/reference/security/prebuilt-rules/rules/linux/initial_access_telnet_auth_bypass_via_user_envar", + "/en/security/*/potential-terminalfix-cloudflare-lure-in-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_windows_terminalfix_cloudflare_lure", + "/en/security/*/potential-thc-tool-downloaded.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_ssh_it_worm_download", + "/en/security/*/potential-timestomp-in-executable-files.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_timestomp_sysmon", + "/en/security/*/potential-toolshell-initial-exploit-cve-2025-53770-cve-2025-53771.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_potential_toolshell_exploit_attempt", + "/en/security/*/potential-traffic-tunneling-using-qemu.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_tunnel_qemu", + "/en/security/*/potential-tunneling-via-tailscaled.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_tunneling_via_tailscaled", "/en/security/*/potential-unauthorized-access-via-wildcard-injection-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read", + "/en/security/*/potential-uninstall-entry-concealment.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_hide_from_uninstall_list_concealment", "/en/security/*/potential-upgrade-of-non-interactive-shell.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_interpreter_tty_upgrade", "/en/security/*/potential-veeam-credential-access-command.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_veeam_commands", + "/en/security/*/potential-viewstate-rce-attempt-on-sharepoint-iis.html": "/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_potential_rce_via_toolshell", + "/en/security/*/potential-webshell-deployed-via-apache-struts-cve-2023-50164-exploitation.html": "/docs/reference/security/prebuilt-rules/rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell", "/en/security/*/potential-widespread-malware-infection-across-multiple-hosts.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_potential_widespread_malware_infection", "/en/security/*/potential-windows-error-manager-masquerading.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_werfault", "/en/security/*/potential-windows-session-hijacking-via-ccmexec.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_sccm_scnotification_dll", "/en/security/*/potential-wpad-spoofing-via-dns-record-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_adidns_wpad_record", "/en/security/*/potential-wsus-abuse-for-lateral-movement.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_via_wsus_update", "/en/security/*/potentially-successful-mfa-bombing-via-push-notifications.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications", + "/en/security/*/potentially-successful-okta-mfa-bombing-via-push-notifications.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications", "/en/security/*/potentially-suspicious-process-started-via-tmux-or-screen.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen", "/en/security/*/powershell-invoke-ninjacopy-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_posh_invoke_ninjacopy", "/en/security/*/powershell-kerberos-ticket-dump.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_posh_kerb_ticket_dump", @@ -12077,6 +12915,7 @@ "/en/security/*/powershell-keylogging-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_posh_keylogger", "/en/security/*/powershell-mailbox-collection-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_posh_mailbox", "/en/security/*/powershell-minidump-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_posh_minidump", + "/en/security/*/powershell-obfuscation-via-negative-index-string-reversal.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal", "/en/security/*/powershell-psreflect-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_posh_psreflect", "/en/security/*/powershell-script-block-logging-disabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_disable_posh_scriptblocklogging", "/en/security/*/powershell-script-with-archive-compression-capabilities.html": "/docs/reference/security/prebuilt-rules/rules_building_block/collection_posh_compression", @@ -12088,7 +12927,7 @@ "/en/security/*/powershell-script-with-token-impersonation-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_posh_token_impersonation", "/en/security/*/powershell-script-with-veeam-credential-access-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_posh_veeam_sql", "/en/security/*/powershell-script-with-webcam-video-capture-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_posh_webcam_video_capture", - "/en/security/*/powershell-script-with-windows-defender-tampering-capabilities.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_posh_defender_tampering", + "/en/security/*/powershell-script-with-windows-defender-tampering-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_defender_tampering", "/en/security/*/powershell-share-enumeration-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_posh_invoke_sharefinder", "/en/security/*/powershell-suspicious-discovery-related-windows-api-functions.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_posh_suspicious_api_functions", "/en/security/*/powershell-suspicious-payload-encoded-and-compressed.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_compressed", @@ -12104,11 +12943,14 @@ "/en/security/*/privilege-escalation-via-cap-setuid-setgid-capabilities.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_suspicious_uid_guid_elevation", "/en/security/*/privilege-escalation-via-gdb-cap-sys-ptrace.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_gdb_sys_ptrace_elevation", "/en/security/*/privilege-escalation-via-named-pipe-impersonation.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_named_pipe_impersonation", + "/en/security/*/privilege-escalation-via-parallels-appliance-extract-argument-injection.html": "/docs/reference/security/prebuilt-rules/rules/macos/privilege_escalation_parallels_appliance_tar_arg_injection_esql", "/en/security/*/privilege-escalation-via-rogue-named-pipe-impersonation.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_via_rogue_named_pipe", "/en/security/*/privilege-escalation-via-root-crontab-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/privilege_escalation_root_crontab_filemod", "/en/security/*/privilege-escalation-via-suid-sgid.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_suid_sgid_exploitation", "/en/security/*/privilege-escalation-via-windir-environment-variable.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_rogue_windir_environment_var", "/en/security/*/privileged-account-brute-force.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_bruteforce_admin_account", + "/en/security/*/privileged-accounts-brute-force.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_bruteforce_admin_account", + "/en/security/*/privileged-container-creation-with-host-directory-mount.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference", "/en/security/*/privileged-docker-container-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_potentially_overly_permissive_container_creation", "/en/security/*/privileges-api-overview.html": "/docs/api/doc/kibana/operation/operation-readprivileges", "/en/security/*/privileges-elevation-via-parent-process-pid-spoofing.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_via_ppid_spoofing", @@ -12121,6 +12963,7 @@ "/en/security/*/process-creation-via-secondary-logon.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_create_process_as_different_user", "/en/security/*/process-discovery-using-built-in-tools.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_generic_process_discovery", "/en/security/*/process-discovery-via-built-in-applications.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_process_discovery_via_builtin_tools", + "/en/security/*/process-execution-followed-by-self-deletion.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_execution_followed_by_self_deletion", "/en/security/*/process-execution-from-an-unusual-directory.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_from_unusual_directory", "/en/security/*/process-injection-by-the-microsoft-build-engine.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_injection_msbuild", "/en/security/*/process-injection-detected-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/privilege_escalation_endgame_process_injection_detected", @@ -12128,11 +12971,15 @@ "/en/security/*/process-spawned-from-message-of-the-day-motd.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_message_of_the_day_execution", "/en/security/*/process-started-from-process-id-pid-file.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_process_started_from_process_id_file", "/en/security/*/process-started-with-executable-stack.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_executable_stack_execution", - "/en/security/*/process-termination-followed-by-deletion.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_process_termination_followed_by_deletion", - "/en/security/*/processes-with-trailing-spaces.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_processes_with_trailing_spaces", + "/en/security/*/process-termination-followed-by-deletion.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/processes-with-trailing-spaces.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_processes_with_trailing_spaces", "/en/security/*/program-files-directory-masquerading.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_trusted_directory", "/en/security/*/prompt-for-credentials-with-osascript.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_promt_for_pwd_via_osascript", "/en/security/*/prompts-api-find.html": "/docs/api/doc/kibana/operation/operation-findprompts", + "/en/security/*/protected-storage-service-access-via-smb.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_protected_storage_service_access", + "/en/security/*/proxy-execution-via-console-window-host.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_indirect_exec_conhost", + "/en/security/*/proxy-execution-via-windows-openssh.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_indirect_exec_openssh", + "/en/security/*/proxy-shell-execution-via-busybox.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_busybox_indirect_shell_spawn", "/en/security/*/proxychains-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_proxychains_activity", "/en/security/*/psexec-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_psexec_lateral_movement_command", "/en/security/*/python-path-file-pth-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_pth_file_creation", @@ -12140,6 +12987,7 @@ "/en/security/*/quarantine-attrib-removed-by-unsigned-or-untrusted-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_attempt_del_quarantine_attrib", "/en/security/*/query-alert-indices.html": "/docs/solutions/security/detect-and-alert/query-alert-indices", "/en/security/*/query-registry-using-built-in-tools.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_generic_registry_query", + "/en/security/*/quick-assist-full-control-sharing-mode-enabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_quick_assist_fullcontrol_sharing", "/en/security/*/ransomware-detected-elastic-defend.html": "/docs/reference/security/prebuilt-rules/rules/integrations/endpoint/impact_elastic_ransomware_detected", "/en/security/*/ransomware-detected-elastic-endgame.html": "/docs/reference/security/prebuilt-rules/rules/promotions/endgame_ransomware_detected", "/en/security/*/ransomware-prevented-elastic-defend.html": "/docs/reference/security/prebuilt-rules/rules/integrations/endpoint/impact_elastic_ransomware_prevented", @@ -12147,11 +12995,14 @@ "/en/security/*/rapid-secret-retrieval-attempts-from-aws-secretsmanager.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager", "/en/security/*/rapid7-threat-command-cves-correlation.html": "/docs/reference/security/prebuilt-rules/rules/threat_intel/threat_intel_rapid7_threat_command", "/en/security/*/rare-aws-error-code.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/ml_cloudtrail_rare_error_code", + "/en/security/*/rare-connection-to-webdav-target.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_rare_webdav_destination", "/en/security/*/rare-smb-connection-to-the-internet.html": "/docs/reference/security/prebuilt-rules/rules/windows/exfiltration_smb_rare_destination", "/en/security/*/rare-user-logon.html": "/docs/reference/security/prebuilt-rules/rules/ml/initial_access_ml_auth_rare_user_logon", "/en/security/*/rc-local-rc-common-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_rc_script_creation", "/en/security/*/rdp-enabled-via-registry.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_rdp_enabled_registry", "/en/security/*/rdp-remote-desktop-protocol-from-the-internet.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet", + "/en/security/*/react2shell-cve-2025-55182-exploitation-attempt.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_react_server_components_rce_attempt", + "/en/security/*/react2shell-network-security-alert.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_react_server_rce_network_alerts", "/en/security/*/reduce-notifications-alerts.html": "/docs/solutions/security/detect-and-alert/reduce-notifications-alerts", "/en/security/*/registry-persistence-via-appcert-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_appcertdlls_registry", "/en/security/*/registry-persistence-via-appinit-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_appinitdlls_registry", @@ -12167,6 +13018,8 @@ "/en/security/*/remote-file-download-via-mpcmdrun.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_remote_file_copy_mpcmdrun", "/en/security/*/remote-file-download-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_remote_file_copy_powershell", "/en/security/*/remote-file-download-via-script-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_remote_file_copy_scripts", + "/en/security/*/remote-github-actions-runner-registration.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_register_github_actions_runner", + "/en/security/*/remote-management-access-launch-after-msi-install.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_rmm_after_msi_install", "/en/security/*/remote-scheduled-task-creation-via-rpc.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_remote_task_creation_winlog", "/en/security/*/remote-scheduled-task-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_scheduled_task_target", "/en/security/*/remote-ssh-login-enabled-via-systemsetup-command.html": "/docs/reference/security/prebuilt-rules/rules/macos/lateral_movement_remote_ssh_login_enabled", @@ -12175,7 +13028,10 @@ "/en/security/*/remote-xsl-script-execution-via-com.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_xsl_script_execution_via_com", "/en/security/*/remotely-started-services-via-rpc.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_remote_services", "/en/security/*/renamed-autoit-scripts-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_renamed_autoit", + "/en/security/*/renamed-automation-script-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_renamed_autoit", "/en/security/*/renamed-utility-executed-with-short-program-name.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_short_program_name", + "/en/security/*/renaming-of-openssh-binaries.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_credential_access_modify_ssh_binaries", + "/en/security/*/repeated-stalled-tls-handshakes-via-alpn-acme-tls-1-extension.html": "/docs/reference/security/prebuilt-rules/rules/network/impact_tls_alpn_acme_stalled_handshake", "/en/security/*/response-actions-config.html": "/docs/solutions/security/endpoint-response-actions/configure-third-party-response-actions", "/en/security/*/response-actions-history.html": "/docs/solutions/security/endpoint-response-actions/response-actions-history", "/en/security/*/response-actions.html": "/docs/solutions/security/endpoint-response-actions", @@ -12209,6 +13065,7 @@ "/en/security/*/screenconnect-server-spawning-suspicious-processes.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_webshell_screenconnect_server", "/en/security/*/screensaver-plist-file-modified-by-unexpected-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_screensaver_plist_file_modification", "/en/security/*/script-execution-via-microsoft-html-application.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_script_via_html_app", + "/en/security/*/script-interpreter-connection-to-non-standard-port.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_script_interpreter_connection_to_non_standard_port", "/en/security/*/searching-for-saved-credentials-via-vaultcmd.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_saved_creds_vaultcmd", "/en/security/*/sec-explore-intro.html": "/docs/solutions/security/explore", "/en/security/*/sec-manage-intro.html": "/docs/solutions/security/manage-elastic-defend", @@ -12224,12 +13081,20 @@ "/en/security/*/security-spaces.html": "/docs/solutions/security/get-started/spaces-elastic-security", "/en/security/*/sedebugprivilege-enabled-by-a-suspicious-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled", "/en/security/*/segfault-detected.html": "/docs/reference/security/prebuilt-rules/rules_building_block/execution_linux_segfault", + "/en/security/*/segfault-from-sensitive-process-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_segfault_from_sensitive_process", "/en/security/*/self-healing-rollback.html": "/docs/solutions/security/configure-elastic-defend/configure-self-healing-rollback-for-windows-endpoints", "/en/security/*/selinux-configuration-creation-or-renaming.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_selinux_configuration_creation_or_renaming", "/en/security/*/sensitive-audit-policy-sub-category-disabled.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_audit_policy_disabled_winlog", + "/en/security/*/sensitive-file-access-followed-by-compression.html": "/docs/reference/security/prebuilt-rules/rules/macos/collection_sensitive_file_access_followed_by_compression", + "/en/security/*/sensitive-files-compression-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_collection_sensitive_files_compression_inside_container", "/en/security/*/sensitive-files-compression.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_collection_sensitive_files", + "/en/security/*/sensitive-identity-file-open-by-suspicious-process-via-auditd.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_auditd_sensitive_cloud_and_host_identity_file_open", + "/en/security/*/sensitive-keys-or-passwords-searched-for-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_sensitive_keys_or_passwords_search_inside_container", + "/en/security/*/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-principal.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user", "/en/security/*/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user", "/en/security/*/sensitive-registry-hive-access-via-regback.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_regback_sam_security_hives", + "/en/security/*/sentinelone-alert-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/sentinelone_alert_external_alerts", + "/en/security/*/sentinelone-threat-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/sentinelone_threat_external_alerts", "/en/security/*/service-command-lateral-movement.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_cmd_service", "/en/security/*/service-control-spawned-via-script-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_service_control_spawned_script_int", "/en/security/*/service-creation-via-local-kerberos-authentication.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_krbrelayup_service_creation", @@ -12239,13 +13104,19 @@ "/en/security/*/service-path-modification.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_service_path_registry", "/en/security/*/session-view.html": "/docs/solutions/security/investigate/session-view", "/en/security/*/setcap-setuid-setgid-capability-set.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_setuid_setgid_capability_set", + "/en/security/*/several-failed-protected-branch-force-pushes-by-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user", "/en/security/*/shadow-file-modification-by-unusual-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_shadow_file_modification", "/en/security/*/shadow-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_shadow_file_modification", "/en/security/*/shared-exception-lists.html": "/docs/solutions/security/detect-and-alert/create-manage-shared-exception-lists", + "/en/security/*/shared-object-created-by-previously-unknown-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_shared_object_creation", "/en/security/*/shared-object-created-or-changed-by-previously-unknown-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_shared_object_creation", - "/en/security/*/sharepoint-malware-file-upload.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/lateral_movement_malware_uploaded_sharepoint", + "/en/security/*/shared-object-load-via-lolbin.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_lolbin_so_load", + "/en/security/*/sharepoint-malware-file-upload.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded", "/en/security/*/shell-configuration-creation-or-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_shell_configuration_modification", + "/en/security/*/shell-configuration-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_shell_configuration_modification", "/en/security/*/shell-execution-via-apple-scripting.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_shell_execution_via_apple_scripting", + "/en/security/*/shell-execution-via-elastic-endpoint.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_elastic_endpoint_shell_execution", + "/en/security/*/shell-history-clearing-via-environment-variables.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_shell_history_clearing_via_environment_variables", "/en/security/*/shortcut-file-written-or-modified-on-startup-folder.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_startup_folder_lnk", "/en/security/*/siem-field-reference.html": "/docs/reference/security/fields-and-object-schemas/siem-field-reference", "/en/security/*/signals-api-overview.html": "/docs/api/doc/kibana/operation/operation-searchalerts", @@ -12256,8 +13127,10 @@ "/en/security/*/simple-http-web-server-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_simple_web_server_creation", "/en/security/*/sip-provider-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_sip_provider_mod", "/en/security/*/smb-connections-via-lolbin-or-untrusted-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_direct_outbound_smb_connection", + "/en/security/*/smb-windows-file-sharing-activity-from-the-internet.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_smb_windows_file_sharing_activity_from_the_internet", "/en/security/*/smb-windows-file-sharing-activity-to-the-internet.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet", - "/en/security/*/smtp-on-port-26-tcp.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_port_26_activity", + "/en/security/*/smtp-on-port-26-tcp.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_smtp_to_the_internet_port_26", + "/en/security/*/smtp-to-the-internet-on-port-26-tcp.html": "/docs/reference/security/prebuilt-rules/rules/network/command_and_control_smtp_to_the_internet_port_26", "/en/security/*/sns-topic-message-publish-by-rare-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user", "/en/security/*/softwareupdate-preferences-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_apple_softupdates_modification", "/en/security/*/solarwinds-process-disabling-services-via-registry.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry", @@ -12266,6 +13139,11 @@ "/en/security/*/spike-in-bytes-sent-to-an-external-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device", "/en/security/*/spike-in-failed-logon-events.html": "/docs/reference/security/prebuilt-rules/rules/ml/credential_access_ml_auth_spike_in_failed_logon_events", "/en/security/*/spike-in-firewall-denies.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_high_count_network_denies", + "/en/security/*/spike-in-group-application-assignment-change-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes", + "/en/security/*/spike-in-group-lifecycle-change-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes", + "/en/security/*/spike-in-group-management-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events", + "/en/security/*/spike-in-group-membership-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes", + "/en/security/*/spike-in-group-privilege-change-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes", "/en/security/*/spike-in-host-based-traffic.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_high_count_events_for_a_host_name", "/en/security/*/spike-in-logon-events.html": "/docs/reference/security/prebuilt-rules/rules/ml/credential_access_ml_auth_spike_in_logon_events", "/en/security/*/spike-in-network-traffic-to-a-country.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_spike_in_traffic_to_a_country", @@ -12273,8 +13151,19 @@ "/en/security/*/spike-in-number-of-connections-made-from-a-source-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip", "/en/security/*/spike-in-number-of-connections-made-to-a-destination-ip.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip", "/en/security/*/spike-in-number-of-processes-in-an-rdp-session.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes", + "/en/security/*/spike-in-privileged-command-execution-by-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user", "/en/security/*/spike-in-remote-file-transfers.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers", + "/en/security/*/spike-in-special-logon-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events", + "/en/security/*/spike-in-special-privilege-use-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events", "/en/security/*/spike-in-successful-logon-events-from-a-source-ip.html": "/docs/reference/security/prebuilt-rules/rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip", + "/en/security/*/spike-in-user-account-management-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events", + "/en/security/*/spike-in-user-lifecycle-management-change-events.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes", + "/en/security/*/splunk-enterprise-postgresql-backup-to-restore-potential-rce-sequence.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_splunk_postgres_backup_restore_rce_sequence", + "/en/security/*/splunk-enterprise-postgresql-recovery-endpoint-injection-artifacts.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_splunk_postgres_recovery_body_injection", + "/en/security/*/splunk-external-alerts.html": "/docs/reference/security/prebuilt-rules/rules/promotions/splunk_external_alerts", + "/en/security/*/ssfilecopyreceiver-writing-to-common-persistence-locations.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_ssfilecopyreceiver_file_writes", + "/en/security/*/ssfilecopysender-executed-as-root.html": "/docs/reference/security/prebuilt-rules/rules/macos/initial_access_ssfilecopysender_root_execution", + "/en/security/*/ssh-authorized-keys-file-activity.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/persistence_ssh_authorized_keys_modification", "/en/security/*/ssh-authorized-keys-file-deletion.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_authorized_keys_file_deletion", "/en/security/*/ssh-authorized-keys-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/persistence_ssh_authorized_keys_modification", "/en/security/*/ssh-key-generated-via-ssh-keygen.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_ssh_key_generation", @@ -12288,73 +13177,107 @@ "/en/security/*/statistical-model-detected-c2-beaconing-activity.html": "/docs/reference/security/prebuilt-rules/rules/integrations/beaconing/command_and_control_beaconing", "/en/security/*/stolen-credentials-used-to-login-to-okta-account-after-mfa-reset.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset", "/en/security/*/sublime-plugin-or-application-script-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_modification_sublime_app_plugin_or_script", + "/en/security/*/successful-amqp-multi-queue-purge-burst.html": "/docs/reference/security/prebuilt-rules/rules/network/impact_amqp_multi_queue_purge_burst", "/en/security/*/successful-application-sso-from-rare-unknown-client-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device", "/en/security/*/successful-ssh-authentication-from-unusual-ip-address.html": "/docs/reference/security/prebuilt-rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip", "/en/security/*/successful-ssh-authentication-from-unusual-ssh-public-key.html": "/docs/reference/security/prebuilt-rules/rules/linux/initial_access_first_time_public_key_authentication", "/en/security/*/successful-ssh-authentication-from-unusual-user.html": "/docs/reference/security/prebuilt-rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_user", "/en/security/*/sudo-command-enumeration-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_sudo_allowed_command_enumeration", - "/en/security/*/sudo-heap-based-buffer-overflow-attempt.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/privilege_escalation_sudo_buffer_overflow", + "/en/security/*/sudo-heap-based-buffer-overflow-attempt.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/sudoers-file-activity.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/privilege_escalation_sudoers_file_mod", "/en/security/*/sudoers-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/privilege_escalation_sudoers_file_mod", "/en/security/*/suid-sgid-bit-set.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod", "/en/security/*/suid-sguid-enumeration-detected.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_suid_sguid_enumeration", - "/en/security/*/sunburst-command-and-control-activity.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_sunburst_c2_activity_detected", + "/en/security/*/sunburst-command-and-control-activity.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/suricata-and-elastic-defend-network-correlation.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2", + "/en/security/*/suspected-lateral-movement-from-compromised-host.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/multiple_alerts_by_host_ip_and_source_ip", "/en/security/*/suspend-process-api.html": "/docs/api/doc/kibana/operation/operation-endpointsuspendprocessaction", "/en/security/*/suspicious-access-to-ldap-attributes.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_high_number_ad_properties", "/en/security/*/suspicious-activity-reported-by-okta-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user", "/en/security/*/suspicious-antimalware-scan-interface-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_amsi_bypass_dllhijack", + "/en/security/*/suspicious-apple-mail-rule-plist-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_apple_mail_rule_modification", "/en/security/*/suspicious-apt-package-manager-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_apt_package_manager_execution", "/en/security/*/suspicious-apt-package-manager-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_apt_package_manager_netcon", "/en/security/*/suspicious-automator-workflows-execution.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_script_via_automator_workflows", + "/en/security/*/suspicious-aws-s3-connection-via-script-interpreter.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_aws_s3_connection_via_script", "/en/security/*/suspicious-browser-child-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_initial_access_suspicious_browser_childproc", "/en/security/*/suspicious-calendar-file-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_suspicious_calendar_modification", "/en/security/*/suspicious-certutil-commands.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_certutil_commands", + "/en/security/*/suspicious-child-execution-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_suspicious_child_execution", "/en/security/*/suspicious-child-process-of-adobe-acrobat-reader-update-service.html": "/docs/reference/security/prebuilt-rules/rules/macos/privilege_escalation_exploit_adobe_acrobat_updater", + "/en/security/*/suspicious-child-process-of-papercut-server-component.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_papercut_suspicious_child_process", + "/en/security/*/suspicious-child-process-via-azure-vm-customscript-extension.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_azure_customscript_extension_suspicious_descendant", "/en/security/*/suspicious-cmd-execution-via-wmi.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_suspicious_cmd_wmi", + "/en/security/*/suspicious-command-execution-via-busybox-proxy.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_busybox_unusual_execution", + "/en/security/*/suspicious-command-execution-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_suspicious_command_execution", + "/en/security/*/suspicious-command-prompt-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_command_prompt_connecting_to_the_internet", "/en/security/*/suspicious-communication-app-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_communication_apps_suspicious_child_process", "/en/security/*/suspicious-content-extracted-or-decompressed-via-funzip.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_sus_extraction_or_decrompression_via_funzip", "/en/security/*/suspicious-crontab-creation-or-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_crontab_creation", + "/en/security/*/suspicious-curl-from-macos-application.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_suspicious_curl_from_macos_application", + "/en/security/*/suspicious-curl-to-google-app-script-endpoint.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_suspicious_curl_to_google_app_script", + "/en/security/*/suspicious-curl-to-jamf-endpoint.html": "/docs/reference/security/prebuilt-rules/rules/macos/lateral_movement_suspicious_curl_to_jamf_endpoint", "/en/security/*/suspicious-data-encryption-via-openssl-utility.html": "/docs/reference/security/prebuilt-rules/rules/linux/impact_data_encrypted_via_openssl", "/en/security/*/suspicious-dll-loaded-for-persistence-or-privilege-escalation.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_persistence_phantom_dll", "/en/security/*/suspicious-dynamic-linker-discovery-via-od.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_dynamic_linker_via_od", "/en/security/*/suspicious-emond-child-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_emond_rules_process_execution", "/en/security/*/suspicious-endpoint-security-parent-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process", "/en/security/*/suspicious-execution-from-a-mounted-device.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_execution_from_mounted_device", + "/en/security/*/suspicious-execution-from-a-webdav-share.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_scripting_remote_webdav", "/en/security/*/suspicious-execution-from-foomatic-rip-or-cupsd-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution", "/en/security/*/suspicious-execution-from-inet-cache.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_execution_from_inetcache", + "/en/security/*/suspicious-execution-from-vs-code-extension.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_execution_from_vscode_extension", "/en/security/*/suspicious-execution-via-microsoft-office-add-ins.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_execution_via_office_addins", "/en/security/*/suspicious-execution-via-msiexec.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_suspicious_msiexec_execution", "/en/security/*/suspicious-execution-via-scheduled-task.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_suspicious_scheduled_task_runtime", "/en/security/*/suspicious-execution-via-windows-subsystem-for-linux.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_bash_exec", + "/en/security/*/suspicious-execution-with-nodejs.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_nodejs_susp_patterns", "/en/security/*/suspicious-explorer-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_via_explorer_suspicious_child_parent_args", "/en/security/*/suspicious-file-creation-via-kworker.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_kworker_file_creation", + "/en/security/*/suspicious-file-creation-via-pkg-install-script.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_suspicious_file_creation_via_pkg_install_script", "/en/security/*/suspicious-file-downloaded-from-google-drive.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/command_and_control_google_drive_malicious_file_download", + "/en/security/*/suspicious-file-made-executable-via-chmod-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_file_made_executable_via_chmod_inside_container", "/en/security/*/suspicious-file-renamed-via-smb.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_ransomware_file_rename_smb", "/en/security/*/suspicious-hidden-child-process-of-launchd.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process", "/en/security/*/suspicious-html-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_evasion_suspicious_htm_file_creation", "/en/security/*/suspicious-image-load-taskschd-dll-from-ms-office.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office", "/en/security/*/suspicious-imagepath-service-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_suspicious_service_created_registry", + "/en/security/*/suspicious-installer-package-spawns-network-event.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_installer_package_spawned_network_event", + "/en/security/*/suspicious-instance-metadata-service-imds-api-command-line-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_cli", + "/en/security/*/suspicious-instance-metadata-service-imds-api-request.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_request", "/en/security/*/suspicious-inter-process-communication-via-outlook.html": "/docs/reference/security/prebuilt-rules/rules/windows/collection_email_outlook_mailbox_via_com", + "/en/security/*/suspicious-java-class-file-created-in-papercut-server-library.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_papercut_java_class_file", + "/en/security/*/suspicious-javascript-execution-via-deno.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_susp_javascript_via_deno", "/en/security/*/suspicious-jetbrains-teamcity-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_exploit_jetbrains_teamcity", + "/en/security/*/suspicious-kerberos-authentication-ticket-request.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_credential_access_kerberos_correlation", + "/en/security/*/suspicious-kernel-feature-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_sysctl_kernel_feature_activity", "/en/security/*/suspicious-kworker-uid-elevation.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_kworker_uid_elevation", + "/en/security/*/suspicious-linux-process-connection-to-bulletproof-hosting-asn.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_connection_to_bulletproof_hosting_asn", "/en/security/*/suspicious-lsass-access-via-malseclogon.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_lsass_handle_via_malseclogon", "/en/security/*/suspicious-lsass-process-access.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_lsass_access_generic", "/en/security/*/suspicious-macos-ms-office-child-process.html": "/docs/reference/security/prebuilt-rules/rules/macos/initial_access_suspicious_mac_ms_office_child_process", "/en/security/*/suspicious-managed-code-hosting-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_managedcode_host_process", "/en/security/*/suspicious-memory-grep-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_suspicious_memory_grep_activity", - "/en/security/*/suspicious-microsoft-365-mail-access-by-clientappid.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_abnormal_clientappid", + "/en/security/*/suspicious-microsoft-365-mail-access-by-clientappid.html": "/docs/reference/security/prebuilt-rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id", + "/en/security/*/suspicious-microsoft-antimalware-service-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_execution_windefend_unusual_path", "/en/security/*/suspicious-microsoft-diagnostics-wizard-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_proxy_execution_via_msdt", + "/en/security/*/suspicious-microsoft-html-application-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_mshta_susp_child", "/en/security/*/suspicious-mining-process-creation-event.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_suspicious_mining_process_creation_events", "/en/security/*/suspicious-modprobe-file-event.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_linux_modprobe_enumeration", "/en/security/*/suspicious-module-loaded-by-lsass.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_lsass_loaded_susp_dll", "/en/security/*/suspicious-ms-office-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_ms_office_child_process", "/en/security/*/suspicious-ms-outlook-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_ms_outlook_child_process", + "/en/security/*/suspicious-named-pipe-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_suspicious_mkfifo_execution", "/en/security/*/suspicious-net-code-compilation.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_dotnet_compiler_parent_process", "/en/security/*/suspicious-net-reflection-via-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_posh_assembly_load", "/en/security/*/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable", "/en/security/*/suspicious-network-connection-via-systemd.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_netcon", + "/en/security/*/suspicious-network-tool-launched-inside-a-container.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_suspicious_network_tool_launched_inside_container", + "/en/security/*/suspicious-outbound-network-connection-via-unsigned-binary.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_suspicious_outbound_network_via_unsigned_binary", "/en/security/*/suspicious-outlook-child-process.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_outlook_suspicious_child", "/en/security/*/suspicious-passwd-file-event-action.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_suspicious_passwd_file_write", "/en/security/*/suspicious-path-invocation-from-command-line.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_unusual_path_invocation_from_command_line", + "/en/security/*/suspicious-path-mounted.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_suspicious_path_mounted", "/en/security/*/suspicious-pbpaste-high-volume-activity.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_high_volume_of_pbpaste", "/en/security/*/suspicious-pdf-reader-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_suspicious_pdf_reader", "/en/security/*/suspicious-portable-executable-encoded-in-powershell-script.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_posh_portable_executable", @@ -12363,27 +13286,40 @@ "/en/security/*/suspicious-print-spooler-file-deletion.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion", "/en/security/*/suspicious-print-spooler-point-and-print-dll.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_printspooler_registry_copyfiles", "/en/security/*/suspicious-print-spooler-spl-file-created.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_printspooler_suspicious_spl_file", - "/en/security/*/suspicious-printspooler-service-executable-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_printspooler_service_suspicious_file", + "/en/security/*/suspicious-printspooler-service-executable-file-creation.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/suspicious-proc-maps-discovery.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_proc_maps_read", "/en/security/*/suspicious-proc-pseudo-file-system-enumeration.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_suspicious_proc_enumeration", "/en/security/*/suspicious-process-access-via-direct-system-call.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_process_access_direct_syscall", "/en/security/*/suspicious-process-creation-calltrace.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_process_creation_calltrace", + "/en/security/*/suspicious-process-execution-by-zoom.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_suspicious_process_execution_by_zoom", "/en/security/*/suspicious-process-execution-via-renamed-psexec-executable.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_suspicious_psexesvc", + "/en/security/*/suspicious-python-shell-command-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_suspicious_python_command_execution", "/en/security/*/suspicious-rc-local-error-message.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_rc_local_error_via_syslog", "/en/security/*/suspicious-rdp-activex-client-loaded.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_suspicious_rdp_client_imageload", + "/en/security/*/suspicious-react-server-child-process.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_execution_susp_react_serv_child", + "/en/security/*/suspicious-reading-of-procfs-syscall-file.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_suspicious_proc_pid_syscall_read", "/en/security/*/suspicious-remote-registry-access-via-sebackupprivilege.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv", "/en/security/*/suspicious-renaming-of-esxi-files.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_rename_esxi_files", - "/en/security/*/suspicious-renaming-of-esxi-index-html-file.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_rename_esxi_index_file", + "/en/security/*/suspicious-renaming-of-esxi-index-html-file.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/suspicious-screenconnect-client-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_screenconnect_childproc", "/en/security/*/suspicious-script-object-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_scrobj_load", + "/en/security/*/suspicious-seincreasebasepriorityprivilege-use.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_thread_cpu_priority_hijack", "/en/security/*/suspicious-service-was-installed-in-the-system.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_service_windows_service_winlog", + "/en/security/*/suspicious-shell-execution-via-velociraptor.html": "/docs/reference/security/prebuilt-rules/rules/windows/command_and_control_velociraptor_shell_execution", + "/en/security/*/suspicious-sip-check-by-macos-application.html": "/docs/reference/security/prebuilt-rules/rules/macos/discovery_suspicious_sip_check", "/en/security/*/suspicious-solarwinds-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes", + "/en/security/*/suspicious-solarwinds-web-help-desk-java-module-load-or-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_potential_webhelpdesk_exploit", "/en/security/*/suspicious-startup-shell-folder-modification.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_evasion_registry_startup_shell_folder_modified", + "/en/security/*/suspicious-startupitem-plist-creation.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_startup_item_plist_creation", + "/en/security/*/suspicious-suid-binary-execution-auditd-sequence.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution_auditd_sequence", + "/en/security/*/suspicious-suid-binary-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution", "/en/security/*/suspicious-symbolic-link-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_linux_suspicious_symbolic_link", "/en/security/*/suspicious-sysctl-file-event.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_linux_sysctl_enumeration", "/en/security/*/suspicious-system-commands-executed-by-previously-unknown-executable.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_suspicious_executable_running_system_commands", + "/en/security/*/suspicious-tcc-access-granted-for-user-folders.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_suspicious_tcc_access_granted", "/en/security/*/suspicious-termination-of-esxi-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/impact_esxi_process_kill", "/en/security/*/suspicious-troubleshooting-pack-cabinet-execution.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_msdt_suspicious_diagcab", + "/en/security/*/suspicious-uid-change-to-root-via-python.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_potential_privesc_via_python", "/en/security/*/suspicious-usage-of-bpf-probe-write-user-helper.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_bpf_probe_write_user", "/en/security/*/suspicious-utility-launched-via-proxychains.html": "/docs/reference/security/prebuilt-rules/rules/linux/command_and_control_linux_suspicious_proxychains_activity", "/en/security/*/suspicious-web-browser-sensitive-file-access.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access", @@ -12394,22 +13330,29 @@ "/en/security/*/suspicious-wmi-event-subscription-created.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_sysmon_wmi_event_subscription", "/en/security/*/suspicious-wmi-image-load-from-ms-office.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_suspicious_image_load_wmi_ms_office", "/en/security/*/suspicious-wmic-xsl-script-execution.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_wmi_script", + "/en/security/*/suspicious-write-attempt-to-apparmor-policy-management-files.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_apparmor_exploitation_via_sys_fs", "/en/security/*/suspicious-zoom-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_suspicious_zoom_child_process", "/en/security/*/svchost-spawning-cmd.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_command_shell_started_by_svchost", "/en/security/*/symbolic-link-to-shadow-copy-created.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_symbolic_link_to_shadow_copy_created", + "/en/security/*/system-and-network-configuration-check.html": "/docs/reference/security/prebuilt-rules/rules/macos/discovery_system_and_network_configuration_check", "/en/security/*/system-binary-moved-or-copied.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_binary_copied_to_suspicious_directory", "/en/security/*/system-binary-path-file-permission-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_system_binary_file_permission_change", + "/en/security/*/system-binary-symlink-to-suspicious-location.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_symlink_binary_to_writable_dir", + "/en/security/*/system-file-ownership-change.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_modify_ownership_os_files", "/en/security/*/system-hosts-file-access.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_hosts_file_access", + "/en/security/*/system-information-discovery-via-dmidecode-from-parent-shell.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_dmidecode_system_discovery", "/en/security/*/system-information-discovery-via-windows-command-shell.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_files_dir_systeminfo_via_cmd", "/en/security/*/system-log-file-deletion.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_log_files_deleted", "/en/security/*/system-network-connections-discovery.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_system_network_connections", "/en/security/*/system-owner-user-discovery-linux.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_linux_system_owner_user_discovery", + "/en/security/*/system-public-ip-discovery-via-dns-query.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_host_public_ip_address_lookup", "/en/security/*/system-service-discovery-through-built-in-windows-utilities.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_system_service_discovery", "/en/security/*/system-shells-via-services.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_system_shells_via_services", "/en/security/*/system-time-discovery.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_system_time_discovery", "/en/security/*/system-v-init-script-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_init_d_file_creation", "/en/security/*/systemd-generator-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_generator_creation", "/en/security/*/systemd-service-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_service_creation", + "/en/security/*/systemd-service-override-configuration-file-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_override_conf_creation", "/en/security/*/systemd-service-started-by-unusual-parent-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_service_started", "/en/security/*/systemd-shell-execution-during-boot.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_shell_execution", "/en/security/*/systemd-timer-created.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_systemd_scheduled_timer_created", @@ -12419,14 +13362,18 @@ "/en/security/*/tainted-kernel-module-load.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_tainted_kernel_module_load", "/en/security/*/tainted-out-of-tree-kernel-module-load.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_tainted_kernel_module_out_of_tree_load", "/en/security/*/tampering-of-shell-command-line-history.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history", + "/en/security/*/tampering-with-runner-tracking-id-in-github-actions-runners.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars", "/en/security/*/tcc-bypass-via-mounted-apfs-snapshot-access.html": "/docs/reference/security/prebuilt-rules/rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access", + "/en/security/*/telnet-authentication-bypass-via-user-environment-variable.html": "/docs/reference/security/prebuilt-rules/rules/linux/initial_access_telnet_auth_bypass_envar_auditd", "/en/security/*/temporarily-scheduled-task-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_temp_scheduled_task", "/en/security/*/third-party-actions.html": "/docs/solutions/security/endpoint-response-actions/third-party-response-actions", "/en/security/*/third-party-backup-files-deleted-via-unexpected-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/impact_backup_file_deletion", + "/en/security/*/threat-intel-email-indicator-match.html": "/docs/reference/security/prebuilt-rules/rules/threat_intel/threat_intel_indicator_match_email", "/en/security/*/threat-intel-hash-indicator-match.html": "/docs/reference/security/prebuilt-rules/rules/threat_intel/threat_intel_indicator_match_hash", "/en/security/*/threat-intel-ip-address-indicator-match.html": "/docs/reference/security/prebuilt-rules/rules/threat_intel/threat_intel_indicator_match_address", "/en/security/*/threat-intel-url-indicator-match.html": "/docs/reference/security/prebuilt-rules/rules/threat_intel/threat_intel_indicator_match_url", "/en/security/*/threat-intel-windows-registry-indicator-match.html": "/docs/reference/security/prebuilt-rules/rules/threat_intel/threat_intel_indicator_match_registry", + "/en/security/*/thrift-rpc-method-from-an-external-client.html": "/docs/reference/security/prebuilt-rules/rules/network/initial_access_thrift_rpc_method_from_external_client", "/en/security/*/timeline-api-create.html": "/docs/api/doc/kibana/operation/operation-createtimelines", "/en/security/*/timeline-api-delete.html": "/docs/api/doc/kibana/operation/operation-deletetimelines", "/en/security/*/timeline-api-get.html": "/docs/api/doc/kibana/operation/operation-gettimelines", @@ -12438,7 +13385,7 @@ "/en/security/*/timeline-templates-ui.html": "/docs/solutions/security/investigate/timeline-templates", "/en/security/*/timelines-ui.html": "/docs/solutions/security/investigate/timeline", "/en/security/*/timestomping-using-touch-command.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_timestomp_touch", - "/en/security/*/trap-signals-execution.html": "/docs/reference/security/prebuilt-rules/rules_building_block/privilege_escalation_trap_execution", + "/en/security/*/trap-signals-execution.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/privilege_escalation_trap_execution", "/en/security/*/troubleshooting-ov.html": "/docs/troubleshoot/security", "/en/security/*/trusted-applications-api.html": "/docs/api/doc/kibana/group/endpoint-security-exceptions-api", "/en/security/*/trusted-apps-ov.html": "/docs/solutions/security/manage-elastic-defend/trusted-applications", @@ -12457,7 +13404,7 @@ "/en/security/*/uid-elevation-from-previously-unknown-executable.html": "/docs/reference/security/prebuilt-rules/rules/linux/privilege_escalation_uid_elevation_from_unknown_executable", "/en/security/*/unauthorized-access-to-an-okta-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access", "/en/security/*/unauthorized-scope-for-public-app-oauth2-token-grant-with-client-credentials.html": "/docs/reference/security/prebuilt-rules/rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange", - "/en/security/*/uncommon-destination-port-connection-by-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_web_server_sus_destination_port", + "/en/security/*/uncommon-destination-port-connection-by-web-server.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/uncommon-registry-persistence-change.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_registry_uncommon", "/en/security/*/unexpected-child-process-of-macos-screensaver-engine.html": "/docs/reference/security/prebuilt-rules/rules/macos/persistence_screensaver_engine_unexpected_child_process", "/en/security/*/uninstall-agent.html": "/docs/solutions/security/configure-elastic-defend/uninstall-elastic-agent", @@ -12468,36 +13415,52 @@ "/en/security/*/unsigned-dll-loaded-by-dns-service.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_dns_serverlevelplugindll", "/en/security/*/unsigned-dll-loaded-by-svchost.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_service_dll_unsigned", "/en/security/*/unsigned-dll-side-loading-from-a-suspicious-folder.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir", + "/en/security/*/untrusted-dll-loaded-by-azure-ad-connect-authentication-agent.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_imageload_azureadconnectauthsvc", "/en/security/*/untrusted-dll-loaded-by-azure-ad-sync-service.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_imageload_azureadconnectauthsvc", "/en/security/*/untrusted-driver-loaded.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_untrusted_driver_loaded", "/en/security/*/unusual-aws-command-for-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user", "/en/security/*/unusual-aws-s3-object-encryption-with-sse-c.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c", + "/en/security/*/unusual-azure-vm-extension-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_vm_extension_unusual_for_host", "/en/security/*/unusual-base64-encoding-decoding-activity.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_base64_decoding_activity", + "/en/security/*/unusual-child-execution-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_unusual_child_execution", "/en/security/*/unusual-child-process-from-a-system-virtual-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unusual_system_vp_child_program", "/en/security/*/unusual-child-process-of-dns-exe.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_unusual_dns_service_children", "/en/security/*/unusual-child-processes-of-rundll32.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_rundll32_no_arguments", "/en/security/*/unusual-city-for-an-aws-command.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city", - "/en/security/*/unusual-command-execution-from-web-server-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_web_server_sus_command_execution", + "/en/security/*/unusual-command-execution-from-web-server-parent.html": "/docs/reference/security/prebuilt-rules", + "/en/security/*/unusual-command-execution-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_unusual_command_execution", "/en/security/*/unusual-country-for-an-aws-command.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country", "/en/security/*/unusual-d-bus-daemon-child-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_dbus_unsual_daemon_parent_execution", "/en/security/*/unusual-discovery-activity-by-user.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_signal_unusual_user_host", - "/en/security/*/unusual-discovery-signal-alert-with-unusual-process-command-line.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline", + "/en/security/*/unusual-discovery-signal-alert-with-unusual-process-command-line.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/unusual-discovery-signal-alert-with-unusual-process-executable.html": "/docs/reference/security/prebuilt-rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable", - "/en/security/*/unusual-dns-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/command_and_control_ml_packetbeat_rare_dns_question", + "/en/security/*/unusual-dns-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/command_and_control_ml_rare_dns_question", "/en/security/*/unusual-dpkg-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_dpkg_unusual_execution", "/en/security/*/unusual-executable-file-creation-by-a-system-critical-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity", + "/en/security/*/unusual-execution-from-kernel-thread-kthreadd-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_unusual_kthreadd_execution", "/en/security/*/unusual-execution-via-microsoft-common-console-file.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_initial_access_via_msc_file", + "/en/security/*/unusual-exim4-child-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_unusual_exim4_child_process", "/en/security/*/unusual-file-creation-alternate-data-stream.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unusual_ads_file_creation", "/en/security/*/unusual-file-creation-by-web-server.html": "/docs/reference/security/prebuilt-rules/rules_building_block/persistence_web_server_sus_file_creation", + "/en/security/*/unusual-file-creation-via-web-server.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_webserver_unusual_file_creation", "/en/security/*/unusual-file-modification-by-dns-exe.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_unusual_dns_service_file_writes", + "/en/security/*/unusual-file-operation-by-dns-exe.html": "/docs/reference/security/prebuilt-rules/rules/windows/lateral_movement_unusual_dns_service_file_writes", "/en/security/*/unusual-file-transfer-utility-launched.html": "/docs/reference/security/prebuilt-rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched", + "/en/security/*/unusual-group-name-accessed-by-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user", "/en/security/*/unusual-high-confidence-content-filter-blocks-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_high_confidence_misconduct_blocks_detected", "/en/security/*/unusual-high-denied-sensitive-information-policy-blocks-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_sensitive_information_policy_blocks_detected", "/en/security/*/unusual-high-denied-topic-blocks-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_topic_policy_blocks_detected", "/en/security/*/unusual-high-word-policy-blocks-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_word_policy_blocks_detected", + "/en/security/*/unusual-host-name-for-okta-privileged-operations-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user", + "/en/security/*/unusual-host-name-for-windows-privileged-operations-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user", "/en/security/*/unusual-hour-for-a-user-to-logon.html": "/docs/reference/security/prebuilt-rules/rules/ml/initial_access_ml_auth_rare_hour_for_a_user_to_logon", - "/en/security/*/unusual-instance-metadata-service-imds-api-request.html": "/docs/reference/security/prebuilt-rules/rules/linux/credential_access_unusual_instance_metadata_service_api_request", + "/en/security/*/unusual-instance-metadata-service-imds-api-request.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_cli", "/en/security/*/unusual-interactive-shell-launched-from-system-user.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_interactive_shell_from_system_user", + "/en/security/*/unusual-kernel-module-enumeration.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_kernel_module_enumeration", + "/en/security/*/unusual-kill-signal.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_unsual_kill_signal", + "/en/security/*/unusual-kubernetes-sensitive-workload-modification.html": "/docs/reference/security/prebuilt-rules/rules/integrations/kubernetes/privilege_escalation_sensitive_workload_modification_by_user_agent", + "/en/security/*/unusual-ld-preload-ld-library-path-command-line-arguments.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_ld_preload_cmdline", + "/en/security/*/unusual-library-load-via-python.html": "/docs/reference/security/prebuilt-rules/rules/macos/execution_unusual_library_load_via_python", "/en/security/*/unusual-linux-network-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_linux_anomalous_network_activity", "/en/security/*/unusual-linux-network-configuration-discovery.html": "/docs/reference/security/prebuilt-rules/rules/ml/discovery_ml_linux_system_network_configuration_discovery", "/en/security/*/unusual-linux-network-connection-discovery.html": "/docs/reference/security/prebuilt-rules/rules/ml/discovery_ml_linux_system_network_connection_discovery", @@ -12509,7 +13472,10 @@ "/en/security/*/unusual-linux-user-discovery-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/discovery_ml_linux_system_user_discovery", "/en/security/*/unusual-linux-username.html": "/docs/reference/security/prebuilt-rules/rules/ml/initial_access_ml_linux_anomalous_user_name", "/en/security/*/unusual-login-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/credential_access_ml_suspicious_login_activity", + "/en/security/*/unusual-login-via-system-user.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_ssh_via_backdoored_system_user", "/en/security/*/unusual-network-activity-from-a-windows-system-binary.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_network_connection_from_windows_binary", + "/en/security/*/unusual-network-connection-to-suspicious-top-level-domain.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_unusual_connection_to_suspicious_top_level_domain", + "/en/security/*/unusual-network-connection-to-suspicious-web-service.html": "/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service", "/en/security/*/unusual-network-connection-via-dllhost.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unusual_network_connection_via_dllhost", "/en/security/*/unusual-network-connection-via-rundll32.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unusual_network_connection_via_rundll32", "/en/security/*/unusual-network-destination-domain-name.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_packetbeat_rare_server_domain", @@ -12519,28 +13485,39 @@ "/en/security/*/unusual-pkexec-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_unusual_pkexec_execution", "/en/security/*/unusual-preload-environment-variable-process-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/defense_evasion_unusual_preload_env_vars", "/en/security/*/unusual-print-spooler-child-process.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess", + "/en/security/*/unusual-privilege-type-assigned-to-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user", + "/en/security/*/unusual-process-connection-to-docker-or-containerd-socket.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_unusual_process_connection_to_container_runtime_socket", + "/en/security/*/unusual-process-detected-for-privileged-commands-by-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user", "/en/security/*/unusual-process-execution-on-wbem-path.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_unusual_process_path_wbem", "/en/security/*/unusual-process-execution-path-alternate-data-stream.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unusual_dir_ads", "/en/security/*/unusual-process-extension.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_unusual_process_extension", "/en/security/*/unusual-process-for-a-linux-host.html": "/docs/reference/security/prebuilt-rules/rules/ml/persistence_ml_rare_process_by_host_linux", "/en/security/*/unusual-process-for-a-windows-host.html": "/docs/reference/security/prebuilt-rules/rules/ml/persistence_ml_rare_process_by_host_windows", "/en/security/*/unusual-process-for-mssql-service-accounts.html": "/docs/reference/security/prebuilt-rules/rules_building_block/lateral_movement_unusual_process_sql_accounts", + "/en/security/*/unusual-process-modifying-genai-configuration-file.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_genai_config_modification", "/en/security/*/unusual-process-network-connection.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_unusual_process_network_connection", "/en/security/*/unusual-process-spawned-by-a-host.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host", "/en/security/*/unusual-process-spawned-by-a-parent-process.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process", "/en/security/*/unusual-process-spawned-by-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user", - "/en/security/*/unusual-process-spawned-from-web-server-parent.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_web_server_sus_child_spawned", + "/en/security/*/unusual-process-spawned-from-web-server-parent.html": "/docs/reference/security/prebuilt-rules", "/en/security/*/unusual-process-writing-data-to-an-external-device.html": "/docs/reference/security/prebuilt-rules/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device", + "/en/security/*/unusual-region-name-for-okta-privileged-operations-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user", + "/en/security/*/unusual-region-name-for-windows-privileged-operations-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user", "/en/security/*/unusual-remote-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/lateral_movement_unusual_remote_file_creation", "/en/security/*/unusual-remote-file-directory.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory", "/en/security/*/unusual-remote-file-extension.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension", "/en/security/*/unusual-remote-file-size.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size", + "/en/security/*/unusual-scheduled-task-update.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_scheduled_task_updated", "/en/security/*/unusual-service-host-child-process-childless-service.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_unusual_svchost_childproc_childless", "/en/security/*/unusual-source-ip-for-a-user-to-logon-from.html": "/docs/reference/security/prebuilt-rules/rules/ml/initial_access_ml_auth_rare_source_ip_for_a_user", + "/en/security/*/unusual-source-ip-for-okta-privileged-operations-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user", + "/en/security/*/unusual-source-ip-for-windows-privileged-operations-detected.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user", + "/en/security/*/unusual-spike-in-concurrent-active-sessions-by-a-user.html": "/docs/reference/security/prebuilt-rules/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user", "/en/security/*/unusual-sshd-child-process.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_unusual_sshd_child_process", "/en/security/*/unusual-sudo-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/privilege_escalation_ml_linux_anomalous_sudo_activity", "/en/security/*/unusual-time-or-day-for-an-rdp-session.html": "/docs/reference/security/prebuilt-rules/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session", "/en/security/*/unusual-user-privilege-enumeration-via-id.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_unusual_user_enumeration_via_id", + "/en/security/*/unusual-web-config-file-access.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_web_config_file_access", "/en/security/*/unusual-web-request.html": "/docs/reference/security/prebuilt-rules/rules/ml/command_and_control_ml_packetbeat_rare_urls", "/en/security/*/unusual-web-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/ml/command_and_control_ml_packetbeat_rare_user_agent", "/en/security/*/unusual-windows-network-activity.html": "/docs/reference/security/prebuilt-rules/rules/ml/ml_windows_anomalous_network_activity", @@ -12555,10 +13532,12 @@ "/en/security/*/use-osquery.html": "/docs/solutions/security/investigate/osquery", "/en/security/*/user-account-creation.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_user_account_creation", "/en/security/*/user-account-exposed-to-kerberoasting.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_spn_attribute_modified", - "/en/security/*/user-added-as-owner-for-azure-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_user_added_as_owner_for_azure_application", - "/en/security/*/user-added-as-owner-for-azure-service-principal.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_user_added_as_owner_for_azure_service_principal", + "/en/security/*/user-added-as-owner-for-azure-application.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application", + "/en/security/*/user-added-as-owner-for-azure-service-principal.html": "/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal", + "/en/security/*/user-added-to-privileged-group-in-active-directory.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_user_account_added_to_privileged_group_ad", "/en/security/*/user-added-to-privileged-group.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_user_account_added_to_privileged_group_ad", "/en/security/*/user-added-to-the-admin-group.html": "/docs/reference/security/prebuilt-rules/rules/macos/privilege_escalation_user_added_to_admin_group", + "/en/security/*/user-detected-with-suspicious-windows-process-es.html": "/docs/reference/security/prebuilt-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user", "/en/security/*/user-or-group-creation-modification.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_user_or_group_creation_or_modification", "/en/security/*/users-page.html": "/docs/solutions/security/explore/users-page", "/en/security/*/value-lists-exceptions.html": "/docs/solutions/security/detect-and-alert/create-manage-value-lists", @@ -12585,7 +13564,13 @@ "/en/security/*/web-application-suspicious-activity-post-request-declined.html": "/docs/reference/security/prebuilt-rules/rules/apm/apm_403_response_to_a_post", "/en/security/*/web-application-suspicious-activity-sqlmap-user-agent.html": "/docs/reference/security/prebuilt-rules/rules/apm/apm_sqlmap_user_agent", "/en/security/*/web-application-suspicious-activity-unauthorized-method.html": "/docs/reference/security/prebuilt-rules/rules/apm/apm_405_response_method_not_allowed", + "/en/security/*/web-server-cloud-metadata-ssrf-request.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/credential_access_web_server_cloud_imds_ssrf_request", + "/en/security/*/web-server-discovery-or-fuzzing-activity.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity", + "/en/security/*/web-server-potential-command-injection-request.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/persistence_web_server_potential_command_injection", + "/en/security/*/web-server-potential-spike-in-error-response-codes.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes", + "/en/security/*/web-server-potential-sql-injection-request.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/persistence_web_server_potential_sql_injection", "/en/security/*/web-server-spawned-via-python.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_python_webserver_spawned", + "/en/security/*/web-server-suspicious-user-agent-requests.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents", "/en/security/*/web-shell-detection-script-process-child-of-common-web-processes.html": "/docs/reference/security/prebuilt-rules/rules/windows/persistence_webshell_detection", "/en/security/*/webproxy-settings-modification.html": "/docs/reference/security/prebuilt-rules/rules/macos/credential_access_mitm_localhost_webproxy", "/en/security/*/webserver-access-logs-deleted.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/defense_evasion_deleting_websvr_access_logs", @@ -12601,8 +13586,11 @@ "/en/security/*/windows-installer-with-suspicious-properties.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_msiexec_installsource_archive_file", "/en/security/*/windows-network-enumeration.html": "/docs/reference/security/prebuilt-rules/rules_building_block/discovery_net_view", "/en/security/*/windows-registry-file-creation-in-smb-share.html": "/docs/reference/security/prebuilt-rules/rules/windows/credential_access_moving_registry_hive_via_smb", + "/en/security/*/windows-sandbox-with-sensitive-configuration.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_run_virt_windowssandbox", "/en/security/*/windows-script-executing-powershell.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_script_executing_powershell", + "/en/security/*/windows-script-execution-from-archive.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_scripts_archive_file", "/en/security/*/windows-script-interpreter-executing-process-via-wmi.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_scripts_process_started_via_wmi", + "/en/security/*/windows-server-update-service-spawning-suspicious-processes.html": "/docs/reference/security/prebuilt-rules/rules/windows/initial_access_suspicious_windows_server_update_svc", "/en/security/*/windows-service-installed-via-an-unusual-client.html": "/docs/reference/security/prebuilt-rules/rules/windows/privilege_escalation_windows_service_via_unusual_client", "/en/security/*/windows-subsystem-for-linux-distribution-installed.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_registry_modification", "/en/security/*/windows-subsystem-for-linux-enabled-via-dism-utility.html": "/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_wsl_enabled_via_dism", @@ -12614,8 +13602,10 @@ "/en/security/*/wmic-remote-command.html": "/docs/reference/security/prebuilt-rules/rules_building_block/lateral_movement_wmic_remote", "/en/security/*/wps-office-exploitation-via-dll-hijack.html": "/docs/reference/security/prebuilt-rules/rules/windows/execution_initial_access_wps_dll_exploit", "/en/security/*/writedac-access-on-active-directory-object.html": "/docs/reference/security/prebuilt-rules/rules_building_block/defense_evasion_write_dac_access", + "/en/security/*/xdg-open-command-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_suspicious_xdg_open_command_execution", "/en/security/*/yum-dnf-plugin-status-discovery.html": "/docs/reference/security/prebuilt-rules/rules/linux/discovery_yum_dnf_plugin_detection", "/en/security/*/yum-package-manager-plugin-file-creation.html": "/docs/reference/security/prebuilt-rules/rules/linux/persistence_yum_package_manager_plugin_file_creation", + "/en/security/*/zimbra-swatchdog-snmp-command-injection-execution.html": "/docs/reference/security/prebuilt-rules/rules/linux/execution_zimbra_swatchdog_snmp_command_injection", "/en/security/*/zoom-meeting-with-no-passcode.html": "/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode", "/en/security/master/release-notes-header-9.0.0.html": "/docs/release-notes/security", "/en/serverless/*/_cloud_native_vulnerability_management_dashboard.html": "/docs/solutions/security/dashboards/cloud-native-vulnerability-management-dashboard",