From 2f8b9940554fcf280995dfd2bfc0774e7a848e7b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 19:55:17 +0530
Subject: [PATCH] Lock versions for releases: 8.19,9.2,9.3,9.4 (#6163)

(cherry picked from commit 8f28676d628fbde13a7458e707409e7aedc47c16)
---
 detection_rules/etc/version.lock.json | 631 +++++++++++++++++---------
 docs-dev/ATT&CK-coverage.md           |   1 +
 pyproject.toml                        |   2 +-
 3 files changed, 420 insertions(+), 214 deletions(-)

diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json
index ebbf2c56e..8e2143157 100644
--- a/detection_rules/etc/version.lock.json
+++ b/detection_rules/etc/version.lock.json
@@ -35,6 +35,12 @@
     "type": "query",
     "version": 8
   },
+  "012bfca7-45cb-4507-a3ba-3777167f8b81": {
+    "rule_name": "Google Workspace Device Registration After OAuth from Suspicious ASN",
+    "sha256": "5020e674a38d5634ad2d4127128c09eab9c1131b1e448655eec8c5c6145427a0",
+    "type": "eql",
+    "version": 1
+  },
   "0136b315-b566-482f-866c-1d8e2477ba16": {
     "rule_name": "Deprecated - M365 Security Compliance User Restricted from Sending Email",
     "sha256": "226cb4ca9b14010933649d9bac8285e8266edb900b2d835b38307bc6fb629385",
@@ -98,9 +104,9 @@
   },
   "02a23ee7-c8f8-4701-b99d-e9038ce313cb": {
     "rule_name": "Process Created with an Elevated Token",
-    "sha256": "4aa9842670b9ebc492a4614e4317094998cf31227ac49598907aeb5bec61c692",
+    "sha256": "c9ca8efdee1a28a5dab4c8569bdcc0b3f97a2dbf4857ba44b4691a0992a386ba",
     "type": "eql",
-    "version": 11
+    "version": 12
   },
   "02a4576a-7480-4284-9327-548a806b5e48": {
     "rule_name": "Potential Credential Access via DuplicateHandle in LSASS",
@@ -126,9 +132,9 @@
   },
   "02bab13d-fb14-4d7c-b6fe-4a28874d37c5": {
     "rule_name": "Potential Ransomware Note File Dropped via SMB",
-    "sha256": "8faa211ae2a7bcacb59c68e92a447cfd62919035dfe3259c39c0ee886be5ece8",
+    "sha256": "5888e1f7b14960dd1d20594bea541a44ae3029b63ca3ce47feb51f121784e9d4",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "02ea4563-ec10-4974-b7de-12e65aa4f9b3": {
     "rule_name": "Dumping Account Hashes via Built-In Commands",
@@ -166,6 +172,13 @@
     "type": "eql",
     "version": 108
   },
+  "0398c0a2-1237-478e-84c4-84510f1925e6": {
+    "min_stack_version": "9.3",
+    "rule_name": "Suspicious Container Runtime CLI Execution",
+    "sha256": "d5f015f6a331cc001e19f26c5ee3d237fb5ef1aa6b240399f308719833d3852f",
+    "type": "eql",
+    "version": 1
+  },
   "03a514d9-500e-443e-b6a9-72718c548f6c": {
     "rule_name": "Deprecated - SSH Process Launched From Inside A Container",
     "sha256": "db16c791683827ffea8705d7c3c3a3c8793db69d1e421f594a01616cf7fb7509",
@@ -226,9 +239,9 @@
   },
   "043d80a3-c49e-43ef-9c72-1088f0c7b278": {
     "rule_name": "Potential Escalation via Vulnerable MSI Repair",
-    "sha256": "dba859d27b151a923834b39a2c500f09b452ecd18fb17bc42fcedef488f957f8",
+    "sha256": "e2c6fff3a05f4beae4ec1516c8b501efd3c644f9f9429d133b66003586f72649",
     "type": "eql",
-    "version": 206
+    "version": 207
   },
   "04c5a96f-19c5-44fd-9571-a0b033f9086f": {
     "rule_name": "Entra ID Global Administrator Role Assigned",
@@ -238,9 +251,9 @@
   },
   "04e65517-16e9-4fc4-b7f1-94dc21ecea0d": {
     "rule_name": "User Added to the Admin Group",
-    "sha256": "b164ca59eecebcabe9bd4bbdc1c86c640f202a21e08e0a08cdfc824610ec9d98",
+    "sha256": "821c6dce76699d5db4ac9172fa84dc029f5ef229b4440a41bf7d9a375104654d",
     "type": "eql",
-    "version": 5
+    "version": 6
   },
   "053a0387-f3b5-4ba5-8245-8002cca2bd08": {
     "rule_name": "Suspicious Microsoft Antimalware Service Execution",
@@ -275,9 +288,9 @@
   },
   "05b358de-aa6d-4f6c-89e6-78f74018b43b": {
     "rule_name": "Conhost Spawned By Suspicious Parent Process",
-    "sha256": "f750da59bfae7e417e2fef8122c3e5b7520f15e8610d3c66dd63557fa6504962",
+    "sha256": "28db07df550ab0c72b01f5a00328a9a82b8baba0149cd6d30f2c8c1120db1690",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "05cad2fb-200c-407f-b472-02ea8c9e5e4a": {
     "rule_name": "Tainted Kernel Module Load",
@@ -685,9 +698,9 @@
   },
   "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5": {
     "rule_name": "Execution of File Written or Modified by Microsoft Office",
-    "sha256": "094356d1f51021f7425e8498fdaa9e5545042553ed50aaf071c39778fedad057",
+    "sha256": "3a48b704510ee51161efcef2c5705490f323ebcfa4d2df40ecc16fad5fff2fe8",
     "type": "eql",
-    "version": 114
+    "version": 115
   },
   "0d92d30a-5f3e-4b71-bc3d-4a0c4914b7e0": {
     "min_stack_version": "9.2",
@@ -705,6 +718,12 @@
     "type": "esql",
     "version": 208
   },
+  "0dd84246-a723-49ba-9f4e-a1e1dfa15990": {
+    "rule_name": "Potential Privilege Escalation via unshare Followed by Root Process",
+    "sha256": "6118b8b7dee465096a34d550a7c8f2720f92f9506cf447e07f2c3b5f821c5f26",
+    "type": "eql",
+    "version": 1
+  },
   "0e1af929-42ed-4262-a846-55a7c54e7c84": {
     "rule_name": "Unusual High Denied Sensitive Information Policy Blocks Detected",
     "sha256": "6319c31a290d00e0983d81b1971155caa96f3687a61721f79286857c1bbbbab0",
@@ -769,6 +788,12 @@
     "type": "esql",
     "version": 107
   },
+  "0f189343-dac7-4c1b-aca7-be8baa6bd02b": {
+    "rule_name": "AWS EKS Control Plane Logging Disabled",
+    "sha256": "3f3f94a9b977bf64c7ab034eb092132c770650ad6b1b602c9b5acc30f8c458da",
+    "type": "query",
+    "version": 1
+  },
   "0f4d35e4-925e-4959-ab24-911be207ee6f": {
     "rule_name": "rc.local/rc.common File Creation",
     "sha256": "0dd7907213fe1c2007ed13fc265447af5e1da11ec3932ac1bd234bac879ddd75",
@@ -787,6 +812,12 @@
     "type": "eql",
     "version": 109
   },
+  "0f5941c6-3db9-4d2f-91df-06c7c292ba45": {
+    "rule_name": "Kubernetes Client Certificate Signing Request Created or Approved",
+    "sha256": "6822f4f5fe5d3e698af1b1c09028b6c177c248af8515e0f1c7618e273ed73a8c",
+    "type": "query",
+    "version": 1
+  },
   "0f615fe4-eaa2-11ee-ae33-f661ea17fbce": {
     "rule_name": "Behavior - Detected - Elastic Defend",
     "sha256": "d8fb41394bccffb0c9806c9a2edcf0cd1eefa2bc71a5d98d020b766f1e9e0c1c",
@@ -978,9 +1009,9 @@
   },
   "12f07955-1674-44f7-86b5-c35da0a6f41a": {
     "rule_name": "Suspicious Cmd Execution via WMI",
-    "sha256": "dff426ad89e3595df008b1e3eebe381001d991ed6f8556badc8cb7f03602384f",
+    "sha256": "12486e435a49a8d6ae015693d43d444504c7f0ce79d8ac3f8e560b1a067e9cae",
     "type": "eql",
-    "version": 321
+    "version": 322
   },
   "1327384f-00f3-44d5-9a8c-2373ba071e92": {
     "rule_name": "Persistence via Scheduled Job Creation",
@@ -1496,9 +1527,9 @@
   },
   "1a3f2a4c-12d0-4b88-961a-2711ee295637": {
     "rule_name": "Potential System Tampering via File Modification",
-    "sha256": "8e542036316307cb533b6cf1cf8a04645ffae970672c7916e7185605a72e4be8",
+    "sha256": "40e16656b62a8f8b4a050a24a81a5222c3b71244c7e747902e7899933102755a",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "1a6075b0-7479-450e-8fe7-b8b8438ac570": {
     "rule_name": "Execution of COM object via Xwizard",
@@ -1520,9 +1551,9 @@
   },
   "1ac027c2-8c60-4715-af73-927b9c219e20": {
     "rule_name": "Windows Server Update Service Spawning Suspicious Processes",
-    "sha256": "0fa5a2a328ab55c39a78ae87ec88868fd59afbb127aeb9495fb2be890a7c8083",
+    "sha256": "68657a78537ab31a02e6e7bdf3c1c16c01ab15359ecf055b790816e887efceca",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "1aefed68-eecd-47cc-9044-4a394b60061d": {
     "rule_name": "React2Shell Network Security Alert",
@@ -1787,9 +1818,9 @@
   },
   "1f56f548-94ec-4678-b1ed-b1a14cca4e3a": {
     "rule_name": "File Creation in World-Writable Directory by Unusual Process",
-    "sha256": "4bf3288a105dbff9ff1d8025c12a892327a0c7a5062427686efbbb056082eacc",
+    "sha256": "4df9615b0c5bc14b8ab9c22dfd3b551e165497764f49c76f47131b8c18126ad8",
     "type": "new_terms",
-    "version": 1
+    "version": 2
   },
   "1fa350e0-0aa2-4055-bf8f-ab8b59233e59": {
     "rule_name": "High Number of Egress Network Connections from Unusual Executable",
@@ -1863,9 +1894,9 @@
   },
   "208dbe77-01ed-4954-8d44-1e5751cb20de": {
     "rule_name": "LSASS Memory Dump Handle Access",
-    "sha256": "95ec166b973e8fa95beb4a3ed8c8005380916540f7218d2b4fcddf1f761a8e97",
+    "sha256": "71c7f2709ba57af9d034b02dfddd8ffad88a6ce54561ccb2e9a6249e403f045f",
     "type": "new_terms",
-    "version": 217
+    "version": 218
   },
   "20dc4620-3b68-4269-8124-ca5091e00ea8": {
     "rule_name": "Auditd Max Login Sessions",
@@ -2022,11 +2053,17 @@
     "type": "eql",
     "version": 211
   },
+  "2449be9d-2fdf-4126-a85b-f05e4058df9f": {
+    "rule_name": "Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)",
+    "sha256": "ac02cf87ad4fa4910f75dbb67b51a91afa76b7d5ff58cc2d9c7eeebe9c9a76be",
+    "type": "query",
+    "version": 1
+  },
   "25224a80-5a4a-4b8a-991e-6ab390465c4f": {
     "rule_name": "Lateral Movement via Startup Folder",
-    "sha256": "b2b0a82c5bf29922f290efc7dac94e8b576668840052c3300bbdb37b55f1cf21",
+    "sha256": "0ea2de447f9849a74fe836db1209085c0b5799003f2cae237af3197ac11c27e4",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "25368123-b7b8-4344-9fd4-df28051b4c6e": {
     "rule_name": "First Time Python Created a LaunchAgent or LaunchDaemon",
@@ -2036,16 +2073,16 @@
   },
   "2553a9af-52a4-4a05-bb03-85b2a479a0a0": {
     "rule_name": "Potential PowerShell HackTool Script by Author",
-    "sha256": "c0142afe736323db7e77ec68ca8df2377a389d488407ec0a48f004f811012543",
+    "sha256": "0199eb265ce99c7a9f188d9ffa0b0d930dc5da0e8125dce7773e6f4c681d9ad0",
     "type": "query",
-    "version": 109
+    "version": 110
   },
   "2572f7e0-7647-4c68-a42b-d3b1973deaae": {
     "min_stack_version": "9.3",
     "rule_name": "Potential Kubeletctl Execution Detected via Defend for Containers",
-    "sha256": "f2f4d0bdad8b894fb254412c4e67385b007af2d2a3c4fdd609962b64f4ddc830",
+    "sha256": "acc31532978654732c3792974aca8d114b5fcbc3b1a2bb12c476fbb78d110c67",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39": {
     "rule_name": "Potential Reverse Shell via Background Process",
@@ -2103,9 +2140,9 @@
   },
   "265db8f5-fc73-4d0d-b434-6483b56372e2": {
     "rule_name": "Persistence via Update Orchestrator Service Hijack",
-    "sha256": "da7097593202235ef983f56eee56fedd61251f27a847e34946215f5895b4d5be",
+    "sha256": "f6c4dc44ea09e4d0007ef1b75b2883cdc9f543888b98fd1e58d6ab7ec7e90a34",
     "type": "eql",
-    "version": 318
+    "version": 319
   },
   "266bbea8-fcf9-4b0e-ba7b-fc00f6b1dc73": {
     "rule_name": "Unusual High Denied Topic Blocks Detected",
@@ -2134,9 +2171,9 @@
   },
   "26b01043-4f04-4d2f-882a-5a1d2e95751b": {
     "rule_name": "Privileges Elevation via Parent Process PID Spoofing",
-    "sha256": "7851f2067a7914e98ceb33a4459b1b3eaae624ac3470df3cddde0f895f395d3d",
+    "sha256": "2a8b22e7d63527d904ab15bd93ab301fbe45ba09b99e427ca34ebe89d9d1d15c",
     "type": "eql",
-    "version": 11
+    "version": 12
   },
   "26edba02-6979-4bce-920a-70b080a7be81": {
     "rule_name": "Entra ID High Risk User Sign-in Heuristic",
@@ -2184,6 +2221,12 @@
     "type": "machine_learning",
     "version": 104
   },
+  "275b972d-2fed-44fc-9214-08603b3318e3": {
+    "rule_name": "M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)",
+    "sha256": "1cb9831d107472766f76dbe7ca4eee784b4004fa2ba6f977d2475b01da030a77",
+    "type": "query",
+    "version": 1
+  },
   "2772264c-6fb9-4d9d-9014-b416eed21254": {
     "rule_name": "Incoming Execution via PowerShell Remoting",
     "sha256": "c46e02d9df71ee1e22ed5ac8f5ba1d5afab07283bd6ea70286a84474f4017c06",
@@ -2289,15 +2332,15 @@
   },
   "290aca65-e94d-403b-ba0f-62f320e63f51": {
     "rule_name": "UAC Bypass Attempt via Windows Directory Masquerading",
-    "sha256": "3333bf53f4e1d4f703ad2bfc61439dbf9db3d734bd3557e083a8d6496bbde552",
+    "sha256": "fbac4cf97fd5011fda908f1d0adbb902d2728ecf40da761102b508c43548ccd5",
     "type": "eql",
-    "version": 322
+    "version": 323
   },
   "2917d495-59bd-4250-b395-c29409b76086": {
     "rule_name": "Web Shell Detection: Script Process Child of Common Web Processes",
-    "sha256": "83deebbdaf1d541ffa89b232ca76266b2cca871eb9b318fcc95ed6841e4c8d1b",
+    "sha256": "bc5e8ceab279abfed41e634d0a0a4597dfc4c45c9963a0bdec070875fe0f1010",
     "type": "new_terms",
-    "version": 423
+    "version": 424
   },
   "291a0de9-937a-4189-94c0-3e847c8b13e4": {
     "rule_name": "Enumeration of Privileged Local Groups Membership",
@@ -2401,15 +2444,15 @@
   },
   "2c6a6acf-0dcb-404d-89fb-6b0327294cfa": {
     "rule_name": "Potential Foxmail Exploitation",
-    "sha256": "1e6f9b0c45ad9cd728e02a922586c3466a5968c751c337ffefe09be52489aeeb",
+    "sha256": "d9b063def75ef74f0205dc26441ae826e4c9cc34b2a6b8634df702cad8b562e1",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "2c74e26b-dfe3-4644-b62b-d0482f124210": {
     "rule_name": "Delegated Managed Service Account Modification by an Unusual User",
-    "sha256": "4cb49f08cf5c89365a0f424c80e59095940ef6ec6a67224688a28f1c883212b3",
+    "sha256": "79e8c76a9e9e5c426263821942e3d2ee0a1173e81bbba8aff836e9bd453654cc",
     "type": "new_terms",
-    "version": 3
+    "version": 4
   },
   "2d05fefd-40ba-43ae-af0c-3c25e86b54f1": {
     "rule_name": "BPF Program or Map Load via bpftool",
@@ -2431,9 +2474,9 @@
   },
   "2d62889e-e758-4c5e-b57e-c735914ee32a": {
     "rule_name": "Command and Scripting Interpreter via Windows Scripts",
-    "sha256": "4e77deaa22c866faec27c5fd6a98680db898f41a0261f412455fa88396d28afa",
+    "sha256": "71c4ced0fea8eaf9a81fbfcf8c97f73a25c05b08abfa5fd1302a51843c64a4fc",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "2d6f5332-42ea-11f0-b09a-f661ea17fbcd": {
     "min_stack_version": "9.2",
@@ -2555,9 +2598,9 @@
   },
   "2edc8076-291e-41e9-81e4-e3fcbc97ae5e": {
     "rule_name": "Creation of a Hidden Local User Account",
-    "sha256": "73af61a045f616fc8d49c6765d5eed3fa39a1a7197390d2e632a01efb216cac7",
+    "sha256": "64c4671959fc9fd3a93eb924ddb2c5a70a6f113b1602871a7029d7ce573fafbe",
     "type": "eql",
-    "version": 316
+    "version": 317
   },
   "2f0bae2d-bf20-4465-be86-1311addebaa3": {
     "rule_name": "GCP Kubernetes Rolebindings Created or Patched",
@@ -2651,9 +2694,9 @@
   },
   "31295df3-277b-4c56-a1fb-84e31b4222a9": {
     "rule_name": "Inbound Connection to an Unsecure Elasticsearch Node",
-    "sha256": "1aeda613e850b7c88717372baca0f5d05f2847c871014efca3813d4fe1a5f47f",
+    "sha256": "226510413e9fb3e9adff4eabadcc96ab04daf4e23ce75f47c1671871eba47372",
     "type": "query",
-    "version": 107
+    "version": 108
   },
   "314557e1-a642-4dbc-af43-321bc04b6618": {
     "rule_name": "M365 Security Compliance Admin Signal",
@@ -2663,9 +2706,9 @@
   },
   "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62": {
     "rule_name": "Bypass UAC via Event Viewer",
-    "sha256": "6bf5894df0dfec715bb0d2d840a008738c24d0e87bf6b877bbbb0407365e7668",
+    "sha256": "9668e85c8c56efdd809ccb17f4857ac12f4747e89dfd9d6b2f9d01c51a38a846",
     "type": "eql",
-    "version": 322
+    "version": 323
   },
   "3202e172-01b1-4738-a932-d024c514ba72": {
     "rule_name": "GCP Pub/Sub Topic Deletion",
@@ -2726,10 +2769,10 @@
     "version": 321
   },
   "32d3ad0e-6add-11ef-8c7b-f661ea17fbcc": {
-    "rule_name": "M365 Identity Login from Atypical Travel Location",
-    "sha256": "7d14aa41f43ff8c51804c5c8a5cd1605804b771df672a36172980974cf2f77a4",
+    "rule_name": "M365 Identity Login from Atypical Region",
+    "sha256": "bb2c0bbdce32e798e3e71ac54587b14911474b0bab1aba3c31fdff2cd236c318",
     "type": "new_terms",
-    "version": 10
+    "version": 11
   },
   "32f4675e-6c49-4ace-80f9-97c9259dca2e": {
     "rule_name": "Suspicious MS Outlook Child Process",
@@ -2759,6 +2802,12 @@
     "type": "eql",
     "version": 107
   },
+  "332ecb5b-08b6-47e9-885b-3cee1de74bac": {
+    "rule_name": "Kubernetes API Server Proxying Request to Kubelet",
+    "sha256": "f02c8e3b566fdfa4c980a1798d714bac6a9515efca0d8544bc6db5093c48650f",
+    "type": "query",
+    "version": 1
+  },
   "333de828-8190-4cf5-8d7c-7575846f6fe0": {
     "rule_name": "AWS IAM User Addition to Group",
     "sha256": "8740915ad9d3542a4b6dad50ca626d2efd14c8e2fa9e2dde5944d3f5fa80fa3e",
@@ -2915,9 +2964,9 @@
   },
   "36a8e048-d888-4f61-a8b9-0f9e2e40f317": {
     "rule_name": "Suspicious ImagePath Service Creation",
-    "sha256": "ec3c0ff47791363712d7c0adefdd532d6e0641f4f5981d2cb44732d9deaa5e8d",
+    "sha256": "dcdf537347147dc3930fd8c5892863eea0a265f5f89c49b351a4fbab410ef039",
     "type": "eql",
-    "version": 314
+    "version": 315
   },
   "36c48a0c-c63a-4cbc-aee1-8cac87db31a9": {
     "min_stack_version": "9.4",
@@ -3001,9 +3050,9 @@
   },
   "37f638ea-909d-4f94-9248-edd21e4a9906": {
     "rule_name": "Finder Sync Plugin Registered and Enabled",
-    "sha256": "b96238524f55ee991b4d048d01069616a1e1cd0bf41dd07a5f82e5c52387cb95",
+    "sha256": "3be1e2737e17c3a4630ef9d45bc0d60c92d160dd2a665283457ac04e3c122a97",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "3805c3dc-f82c-4f8d-891e-63c24d3102b0": {
     "rule_name": "Attempted Bypass of Okta MFA",
@@ -3025,9 +3074,9 @@
   },
   "3896d4c0-6ad1-11ef-8c7b-f661ea17fbcc": {
     "rule_name": "M365 Identity Login from Impossible Travel Location",
-    "sha256": "f77d1c2a0262340c0ead77d4fb93456b8c670c291ca6d8a2dd95dbdcd6c73fac",
+    "sha256": "dcf59b2a5eb9cea3fa3b28c42371c01991bf37cf31e626317797923adb7af039",
     "type": "threshold",
-    "version": 9
+    "version": 10
   },
   "38e5acdd-5f20-4d99-8fe4-f0a1a592077f": {
     "rule_name": "Entra ID User Added as Service Principal Owner",
@@ -3092,9 +3141,9 @@
   },
   "3a6001a0-0939-4bbe-86f4-47d8faeb7b97": {
     "rule_name": "Suspicious Module Loaded by LSASS",
-    "sha256": "5131b9101ab93a6759d129fbfc00a0aee661266e47e4be8ba38766b1a8d3f4af",
+    "sha256": "796e8f216c09cde2bcb8f6dea7f1570c7759d3a27fe86d229895f85ff629118d",
     "type": "eql",
-    "version": 14
+    "version": 15
   },
   "3a657da0-1df2-11ef-a327-f661ea17fbcc": {
     "rule_name": "Rapid7 Threat Command CVEs Correlation",
@@ -3232,9 +3281,9 @@
   },
   "3d00feab-e203-4acc-a463-c3e15b7e9a73": {
     "rule_name": "ScreenConnect Server Spawning Suspicious Processes",
-    "sha256": "31c5efd3e2588f4bbb9204805340a6f348a20c46d009ce4e27c99b2576368bbb",
+    "sha256": "b1672954e193a08ee14cf25ad9a926ef7c6d72374b4b36e9fa0067a9ee840fe4",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "3d3aa8f9-12af-441f-9344-9f31053e316d": {
     "rule_name": "PowerShell Script with Log Clear Capabilities",
@@ -3315,9 +3364,9 @@
   },
   "3ecbdc9e-e4f2-43fa-8cca-63802125e582": {
     "rule_name": "Privilege Escalation via Named Pipe Impersonation",
-    "sha256": "5e02c2bd1ee78f88b93c1695389467410310dd135d79cefc434fec6d0bb3b114",
+    "sha256": "4fe6e4dfb6e7e93063fa4911b3c2025b8492162b1f28e177045abb5224eb1bbc",
     "type": "eql",
-    "version": 318
+    "version": 319
   },
   "3ed032b2-45d8-4406-bc79-7ad1eabb2c72": {
     "rule_name": "Suspicious Process Creation CallTrace",
@@ -3778,9 +3827,9 @@
   },
   "47e46d85-3963-44a0-b856-bccff48f8676": {
     "rule_name": "DNS Request for IP Lookup Service via Unsigned Binary",
-    "sha256": "b77d74a3141da1892738e8c0d4fd55bcbe16d6888bb1c16ec266c429adf9d305",
+    "sha256": "5507c058a6bcd349f879a5f5b392db5d4cc807eb70ed4a818f9712aefe6e45a4",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "47f09343-8d1f-4bb5-8bb0-00c9d18f5010": {
     "rule_name": "Execution via Regsvcs/Regasm",
@@ -3923,9 +3972,9 @@
   },
   "4a4e23cf-78a2-449c-bac3-701924c269d3": {
     "rule_name": "Possible FIN7 DGA Command and Control Behavior",
-    "sha256": "36f98006e5bfa62be0b6fb497cac3f8e786c601b1856911576321711398ff937",
+    "sha256": "96bedbe9a649f85b04076f86f964646177498a24c1d89e81f7813ad8ba4715be",
     "type": "query",
-    "version": 109
+    "version": 110
   },
   "4a99ac6f-9a54-4ba5-a64f-6eb65695841b": {
     "rule_name": "Potential Unauthorized Access via Wildcard Injection Detected",
@@ -4086,6 +4135,12 @@
     "type": "eql",
     "version": 320
   },
+  "4df91789-7859-4bc4-9c5a-6b56bfa81a8b": {
+    "rule_name": "Kubernetes Service Account Token Created via TokenRequest API",
+    "sha256": "0706a9e1eb235c20672104023108aba9b31558c357fbe714d749883acecfda4f",
+    "type": "query",
+    "version": 1
+  },
   "4e85dc8a-3e41-40d8-bc28-91af7ac6cf60": {
     "rule_name": "Multiple Logon Failure Followed by Logon Success",
     "sha256": "18af43592e9ea1cab61766146cc9e4060b3d000eea41d6ed6b5e839350b3e422",
@@ -4134,11 +4189,23 @@
     "type": "esql",
     "version": 9
   },
+  "4f8f7c08-ffb5-443f-86c6-0884c964df7b": {
+    "rule_name": "Kubernetes Admission Webhook Created or Modified",
+    "sha256": "956caddbd666140b4d942546d65f645b992fa788f621ada1c52c47a2eb66c89d",
+    "type": "query",
+    "version": 1
+  },
+  "4f95e0f8-18b7-459a-b8b5-b2f5c94bf6eb": {
+    "rule_name": "Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource",
+    "sha256": "d07ed0c823ebd2b302a39fbc13b2439306173a990c39383beb8bc13e3c30cf43",
+    "type": "query",
+    "version": 1
+  },
   "4fe9d835-40e1-452d-8230-17c147cafad8": {
     "rule_name": "Execution via TSClient Mountpoint",
-    "sha256": "e91467439c3544ac933948876d3564d3775402dbd9de32b4331e7677ff28d060",
+    "sha256": "657a130aad7d1740532a346a2eb954f882688124f2deeef86f69ff060d2f4459",
     "type": "eql",
-    "version": 319
+    "version": 320
   },
   "50742e15-c5ef-49c8-9a2d-31221d45af58": {
     "rule_name": "Okta Successful Login After Credential Attack",
@@ -4158,6 +4225,12 @@
     "type": "new_terms",
     "version": 6
   },
+  "50eba7ec-d3f0-474c-a7f4-0906b68e350f": {
+    "rule_name": "Suspicious SUID Binary Execution (Auditd Sequence)",
+    "sha256": "ba5e9ec616ccbc315188f1f2b4bfae5ad1ebf11fba2f689c08b70842ebd5cada",
+    "type": "eql",
+    "version": 1
+  },
   "51176ed2-2d90-49f2-9f3d-17196428b169": {
     "rule_name": "Windows System Information Discovery",
     "sha256": "3f5f4187427fe60250c06d4030358ca518b17592c87d264baef1d7091a731c6a",
@@ -4208,9 +4281,15 @@
   },
   "51ce96fb-9e52-4dad-b0ba-99b54440fc9a": {
     "rule_name": "Incoming DCOM Lateral Movement with MMC",
-    "sha256": "870d58a3e6ea8fe0f4085336bc6cbc3d947914097ba94babb4b5f15b0cda2444",
+    "sha256": "ace765a7fa2fadc50f7138dafefb3a3ce111971e47f2a4bbe14a21d8a2d616c1",
     "type": "eql",
-    "version": 212
+    "version": 213
+  },
+  "5202697c-313b-4bf0-9029-73fe78cd4b6d": {
+    "rule_name": "EKS Authentication Configuration Modified",
+    "sha256": "39befeda3be5d3566310a0757695d7624f95477d5cc37e279a2385c1b36607be",
+    "type": "query",
+    "version": 1
   },
   "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0": {
     "rule_name": "Deprecated - Potential Successful Linux RDP Brute Force Attack Detected",
@@ -4367,15 +4446,15 @@
   },
   "55a372b9-f5b6-4069-a089-8637c00609a2": {
     "rule_name": "First-Time FortiGate Administrator Login",
-    "sha256": "518282100295984ad22ded511e0efb7a009dbec8d0bbfe2c7fac69778163579b",
+    "sha256": "dc6756e17a5caafb08cff75318b119554d594cf173231c99c746ca29d50d8d3c",
     "type": "esql",
-    "version": 3
+    "version": 4
   },
   "55c2bf58-2a39-4c58-a384-c8b1978153c2": {
     "rule_name": "Windows Service Installed via an Unusual Client",
-    "sha256": "d9d7b7c944e438656c8d6c348d8acd34be6f45ef68c23cdc5c1e679c1eb476f2",
+    "sha256": "b5649c8ab6926d99ffe7da8140bf8d357b61e8cee079d84f7e6f83ec3b98d852",
     "type": "eql",
-    "version": 217
+    "version": 218
   },
   "55d551c6-333b-4665-ab7e-5d14a59715ce": {
     "rule_name": "PsExec Network Connection",
@@ -4391,9 +4470,9 @@
   },
   "55f711c1-6b4d-4787-930d-c9317a885adf": {
     "rule_name": "Suspicious Execution with NodeJS",
-    "sha256": "0988cafc07e2277a8687b5a89074a4ad787b1cc0ad5bf564bdacb5b7c95cfe94",
+    "sha256": "afa591418c578bdd961e701d31a05f0a953c1cd95151b2aef63107e7e00a5fe0",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "56004189-4e69-4a39-b4a9-195329d226e9": {
     "min_stack_version": "9.4",
@@ -4449,9 +4528,9 @@
   },
   "56f2e9b5-4803-4e44-a0a4-a52dc79d57fe": {
     "rule_name": "PowerShell PSReflect Script",
-    "sha256": "6c697a981e583ada22e4f514b9fe1cc69e210a0cd838679036eb1158118d1beb",
+    "sha256": "3a6e599f9d4af81d7cd9eabc89715d727103b98f4323896df81d7d3cc2fe6f74",
     "type": "query",
-    "version": 317
+    "version": 318
   },
   "56fdfcf1-ca7c-4fd9-951d-e215ee26e404": {
     "rule_name": "Execution of an Unsigned Service",
@@ -4545,9 +4624,9 @@
   },
   "58c6d58b-a0d3-412d-b3b8-0981a9400607": {
     "rule_name": "Potential Privilege Escalation via InstallerFileTakeOver",
-    "sha256": "54a500e176cc9745327edf4a986bbcad4894627acf87bc50f5727b26558cd775",
+    "sha256": "4d86cd35f177a472f2469c620376892ff2965ae63188678ced96c35b2bfa11b3",
     "type": "eql",
-    "version": 115
+    "version": 116
   },
   "590fc62d-7386-4c75-92b0-af4517018da1": {
     "rule_name": "Unusual Process Modifying GenAI Configuration File",
@@ -4609,9 +4688,9 @@
   },
   "5a3d5447-31c9-409a-aed1-72f9921594fd": {
     "rule_name": "Potential Reverse Shell via Java",
-    "sha256": "11037a250f68a1970df97139622a157e84807139f8126e5d9c7bc7cf56b3b77c",
+    "sha256": "c5e601c37a1f317b85f5d0a30462e149c962b83d62e9b3655509a65b1a4668d1",
     "type": "eql",
-    "version": 13
+    "version": 14
   },
   "5a876e0d-d39a-49b9-8ad8-19c9b622203b": {
     "rule_name": "Command Line Obfuscation via Whitespace Padding",
@@ -4824,9 +4903,9 @@
   },
   "5e23495f-09e2-4484-8235-bdb150d698c9": {
     "rule_name": "Potential CVE-2025-33053 Exploitation",
-    "sha256": "d05a70b154a7b84b4788d0e7a9beb17cf0b147169da42a8f48bafb328c5e8403",
+    "sha256": "2b8137ee0622fa13bc6ca0d3bfa15b56f7274e8b11ddf245d4adb0d4dcc22a53",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "5e4023e7-6357-4061-ae1c-9df33e78c674": {
     "rule_name": "Memory Swap Modification",
@@ -4868,6 +4947,12 @@
     "type": "threshold",
     "version": 9
   },
+  "5f0fff18-f340-444b-9a98-c49ade766ff4": {
+    "rule_name": "Kubernetes and Cloud Credential Path Access via Process Arguments",
+    "sha256": "04635b1ebb2304ae1b43367de6032f6441c7f291dbc720cecb740ef3c2560809",
+    "type": "query",
+    "version": 1
+  },
   "5f2f463e-6997-478c-8405-fb41cc283281": {
     "rule_name": "Potential File Download via a Headless Browser",
     "sha256": "243733569b61c9258414f81794aa80af97b0ce2a578f54cb1fc3eb3b6ffc5deb",
@@ -4936,9 +5021,9 @@
   },
   "61766ef9-48a5-4247-ad74-3349de7eb2ad": {
     "rule_name": "Interactive Logon by an Unusual Process",
-    "sha256": "89c4a7e78c150d6be51a0ac7825e8c185a6b6079831022b8ba59a2cfd77f7047",
+    "sha256": "2a25d4c5aad531f8baec6e0f8a8a24a0fd3f1244408d9bddbf8d27fd796a2cd9",
     "type": "eql",
-    "version": 108
+    "version": 109
   },
   "618a219d-a363-4ab1-ba30-870d7c22facd": {
     "rule_name": "FortiGate FortiCloud SSO Login from Unusual Source",
@@ -4966,9 +5051,9 @@
   },
   "61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7": {
     "rule_name": "AdminSDHolder SDProp Exclusion Added",
-    "sha256": "6383b77739e2749c866d9629ec58d853e848460e9543fa91f5fc5bdfb1ed81f9",
+    "sha256": "898d586695a755ed54cf089cb8a62fce3c122615f91824a319f0bc896b29a1fc",
     "type": "eql",
-    "version": 218
+    "version": 219
   },
   "621e92b6-7e54-11ee-bdc0-f661ea17fbcd": {
     "rule_name": "Multiple Okta Sessions Detected for a Single User",
@@ -4978,9 +5063,9 @@
   },
   "622ecb68-fa81-4601-90b5-f8cd661e4520": {
     "rule_name": "Incoming DCOM Lateral Movement via MSHTA",
-    "sha256": "42257f22a246a40f1b6a636be55d328756204c2ab6229c57d6bed4129300b5df",
+    "sha256": "277bd1c15f356f6fe781c3b6e303d8cc742ef862f2dfbee02ad935fe105a085b",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "627374ab-7080-4e4d-8316-bef1122444af": {
     "rule_name": "Private Key Searching Activity",
@@ -5068,9 +5153,9 @@
   },
   "642ce354-4252-4d43-80c9-6603f16571c1": {
     "rule_name": "System Public IP Discovery via DNS Query",
-    "sha256": "dadbb6d434afb19f97ab0d84b81956da85c5714c7113d0f80e6e22d72df1407b",
+    "sha256": "bef682517bba6454fba3806195c56aa37a003760553409c96e4ac565bcbe7b7e",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "647fc812-7996-4795-8869-9c4ea595fe88": {
     "min_stack_version": "9.4",
@@ -5205,9 +5290,9 @@
   },
   "66da12b1-ac83-40eb-814c-07ed1d82b7b9": {
     "rule_name": "Suspicious macOS MS Office Child Process",
-    "sha256": "42588eba4cedbc1d14e04f7d2306290a2b24362be89e2d67847e34d5a2348eae",
+    "sha256": "d28d8e99ade43dc293d5e70aad016fc90f10ddea11625285e1adadf2fbd75457",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "670b3b5a-35e5-42db-bd36-6c5b9b4b7313": {
     "rule_name": "Modification of the msPKIAccountCredentials",
@@ -5277,9 +5362,9 @@
   },
   "68921d85-d0dc-48b3-865f-43291ca2c4f2": {
     "rule_name": "Persistence via TelemetryController Scheduled Task Hijack",
-    "sha256": "7f9baf27023307f44d511ff57ee099cdad40f2129fc367ca76d75a969c89d1a1",
+    "sha256": "9beba421bcfa504de24c2c44258d0fef5a2d5ba3711c7cc49e6b76ee0e0fdecb",
     "type": "eql",
-    "version": 317
+    "version": 318
   },
   "68994a6c-c7ba-4e82-b476-26a26877adf6": {
     "rule_name": "Google Workspace Admin Role Assigned to a User",
@@ -5313,9 +5398,9 @@
   },
   "68d56fdc-7ffa-4419-8e95-81641bd6f845": {
     "rule_name": "UAC Bypass via ICMLuaUtil Elevated COM Interface",
-    "sha256": "1b42f6edf559e3d2b60263d34ea41d60e23f6ac770cfd98134dd27d88a284084",
+    "sha256": "c65e804191ff9e8784d38dcbad208bc9015d005343b4073fa0671575a942d4fb",
     "type": "eql",
-    "version": 214
+    "version": 215
   },
   "68e90a9b-0eab-425e-be3b-902b0cd1fe9c": {
     "rule_name": "Suspicious Path Mounted",
@@ -5383,6 +5468,12 @@
     "type": "eql",
     "version": 315
   },
+  "6aa52f86-18f1-4a5a-a0ac-e2b5db8af589": {
+    "rule_name": "Potential Direct Kubelet Access via Process Arguments",
+    "sha256": "a480ab08bb68a023f154a81f536831c446fe45a8dd9c246b4a34c4b93b247cee",
+    "type": "eql",
+    "version": 1
+  },
   "6aace640-e631-4870-ba8e-5fdda09325db": {
     "rule_name": "Exporting Exchange Mailbox via PowerShell",
     "sha256": "0e421040f2de589edbc8b55db8ee6a3865f670eccc1b4c5e9cc39c27d5b2e377",
@@ -5409,15 +5500,15 @@
   },
   "6b84d470-9036-4cc0-a27c-6d90bbfe81ab": {
     "rule_name": "Sensitive Files Compression",
-    "sha256": "b4b1d4f080ee2f9ae817ac8f03b7e3665f07014ce68c646701880b9ad6378f45",
+    "sha256": "114363c64adeb62c874af776f1d85c2e2b724262ed90f24a9d2862a2e5889496",
     "type": "new_terms",
-    "version": 214
+    "version": 215
   },
   "6bed021a-0afb-461c-acbe-ffdb9574d3f3": {
     "rule_name": "Remote Computer Account DnsHostName Update",
-    "sha256": "411e56079688143dac201cc66fee2dd6b1e6a533df93203d4e3f5c056e6646be",
+    "sha256": "a1618bf40a3d1b476d391bef6a7af40d100c0da42d801e1e12dcdd09bf86fe7e",
     "type": "eql",
-    "version": 214
+    "version": 215
   },
   "6c6bb7ea-0636-44ca-b541-201478ef6b50": {
     "min_stack_version": "9.3",
@@ -5533,11 +5624,17 @@
     "type": "eql",
     "version": 2
   },
+  "6e6376c1-a71e-4789-a795-198b05664064": {
+    "rule_name": "Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)",
+    "sha256": "b0d72fb2fdf17d7765df40825acc7844ad727d6e0a7e402becfcdd378c0eecb3",
+    "type": "query",
+    "version": 1
+  },
   "6e9130a5-9be6-48e5-943a-9628bfc74b18": {
     "rule_name": "AdminSDHolder Backdoor",
-    "sha256": "dc6bffc49011189309e7b9497e36f0d750f096ab012779a4e963c370a87370a0",
+    "sha256": "59abbe99101114f6fb8998854a935a04ab4c459d3c6720a4db458e53a01505be",
     "type": "query",
-    "version": 215
+    "version": 216
   },
   "6e92a21a-58e7-449a-9cfd-9f563f59ac88": {
     "rule_name": "Multiple Alerts in Same ATT&CK Tactic by Host",
@@ -5613,9 +5710,9 @@
   },
   "6fa0f15b-1926-419b-8de2-fce1429797ba": {
     "rule_name": "Suspicious SeIncreaseBasePriorityPrivilege Use",
-    "sha256": "2dc11ea177c7c2f16472de6dbab833afbf3a072256b6d50918a81d0ff453de33",
+    "sha256": "1ed183a1e863a65ba89d88e5573fc1f3223f9eacb052a18d95f5ad248c7cba47",
     "type": "query",
-    "version": 2
+    "version": 3
   },
   "6fa3abe3-9cd8-41de-951b-51ed8f710523": {
     "rule_name": "Web Server Potential Spike in Error Response Codes",
@@ -5683,9 +5780,9 @@
   },
   "70d12c9c-0dbd-4a1a-bc44-1467502c9cf6": {
     "rule_name": "Persistence via WMI Standard Registry Provider",
-    "sha256": "dc2e28cbbbea2af5186b2e45d7fa37497ae783a755934eea904b531ac9f88b16",
+    "sha256": "cd2bb38a4e974ce084c49ac98d868aadf1d62999ccde4a722c6f7f8681bb55b5",
     "type": "eql",
-    "version": 113
+    "version": 114
   },
   "70fa1af4-27fd-4f26-bd03-50b6af6b9e24": {
     "rule_name": "Attempt to Unload Elastic Endpoint Security Kernel Extension",
@@ -5828,9 +5925,9 @@
   },
   "7405ddf1-6c8e-41ce-818f-48bea6bcaed8": {
     "rule_name": "Potential Modification of Accessibility Binaries",
-    "sha256": "21a540abdca1fa56360f1f68e121ab1cc3feebfc055b9922cca7e2f49bfca3b0",
+    "sha256": "3dd383b6fe11d4426b88f4569f0a405f1405b9e6655ffe6108d3723e997d4a03",
     "type": "eql",
-    "version": 217
+    "version": 218
   },
   "74147312-ba03-4bea-91d1-040d54c1e8c3": {
     "rule_name": "Microsoft Sentinel External Alerts",
@@ -5991,11 +6088,17 @@
     "type": "eql",
     "version": 215
   },
+  "769a2e72-11bd-437b-9503-e51e7790d273": {
+    "rule_name": "Potential Privilege Escalation via SUID/SGID",
+    "sha256": "ce94437cea9118c4db77c156765f82ad48e2325fed6434593be74ac094b0b2e5",
+    "type": "eql",
+    "version": 1
+  },
   "76ddb638-abf7-42d5-be22-4a70b0bf7241": {
     "rule_name": "Privilege Escalation via Rogue Named Pipe Impersonation",
-    "sha256": "7a17f084e6192844b2f877437f8109cad8496af43a28efbf89b5d5b8a40ed209",
+    "sha256": "b57e22699be52ca6afa8d2d3fcd39a54dc822e9f4b0c45e9202b101e20d7299b",
     "type": "eql",
-    "version": 211
+    "version": 212
   },
   "76de17b9-af25-49a0-9378-02888b6bb3a2": {
     "min_stack_version": "9.4",
@@ -6099,9 +6202,9 @@
   },
   "78e9b5d5-7c07-40a7-a591-3dbbf464c386": {
     "rule_name": "Suspicious File Renamed via SMB",
-    "sha256": "fc36a81054625c5902ae6500e85e00b2a9fc03c2150826c8f62a33430d0202e3",
+    "sha256": "fc4e1f18cd4299cef9d02f0fe5c7750aec32de3ccf737640f92c69abcf8aa99f",
     "type": "eql",
-    "version": 7
+    "version": 8
   },
   "78ef0c95-9dc2-40ac-a8da-5deb6293a14e": {
     "rule_name": "Unsigned DLL Loaded by Svchost",
@@ -6291,9 +6394,9 @@
   },
   "7dc45430-7407-4790-b89e-c857c3f6bf23": {
     "rule_name": "Potential Execution via FileFix Phishing Attack",
-    "sha256": "b0942940cb83f01e92f2566f95c101e49dd424f3a7121f93f6fc4199d90c588d",
+    "sha256": "8017672e1d5a3e9db124d9945f7a4ac62f198aec6733b445b3bac6be45ac7d90",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "7dc921db-4cd3-48ef-88bf-2bfa91f29f5c": {
     "rule_name": "Entra ID Custom Domain Added or Verified",
@@ -6321,9 +6424,9 @@
   },
   "7e3f9a2b-1c4d-5e6f-8a0b-9c8d7e6f5a4b": {
     "rule_name": "Kubernetes Secrets List Across Cluster or Sensitive Namespaces",
-    "sha256": "91f40a360d614d4e374653898a06a606f41d52979be1f57ce06ddb453217f93c",
+    "sha256": "5ac05499166d15e3391528b35f73a7473b93b9ae723abcfc4d87c496388a52f0",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "7e5c0e5a-95a5-404e-a5b0-278d35dc3325": {
     "rule_name": "AWS EC2 Stop, Start, and User Data Modification Correlation",
@@ -6351,9 +6454,9 @@
   },
   "7f3521dd-fb80-4548-a7eb-8db37b898dc2": {
     "rule_name": "Potential Notepad Markdown RCE Exploitation",
-    "sha256": "cc73b75d6cfcb37cd8e753f3fd5b547f4507ecfb610651a20433dac419ada718",
+    "sha256": "93a1125fa6da577483bb725160ffb4b13b5dad6f47ccd67d77955061d4375e0b",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "7f370d54-c0eb-4270-ac5a-9a6020585dc6": {
     "rule_name": "Suspicious WMIC XSL Script Execution",
@@ -6671,6 +6774,12 @@
     "type": "eql",
     "version": 7
   },
+  "86b3a245-03de-49a5-ab57-ae44d8f064da": {
+    "rule_name": "Container Runtime CLI Execution with Suspicious Arguments",
+    "sha256": "b49008a2e524c3ab2b367ae2d73b208ee6a89c06a8e67a6bbd6c28ef543e4bd6",
+    "type": "eql",
+    "version": 1
+  },
   "86c3157c-a951-4a4f-989b-2f0d0f1f9518": {
     "rule_name": "Potential Linux Reverse Connection through Port Knocking",
     "sha256": "b4f46ff74a8794d66683aa38de698de5e35a091b48d03ffa0d9181a578899ddc",
@@ -6899,21 +7008,21 @@
   },
   "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45": {
     "rule_name": "Unusual Child Process of dns.exe",
-    "sha256": "115d29537b2bf7faefb1fac91860d7d62bba80d66b4344f46aadb922bd980abd",
+    "sha256": "9955aae54a8f93f01d22e8dbeba7c6f61bdff91c51078dd51ce9daf7339f6580",
     "type": "eql",
-    "version": 319
+    "version": 320
   },
   "8c707e4c-bd20-4ff4-bda5-4dc3b34ce298": {
     "rule_name": "GitHub Private Repository Turned Public",
-    "sha256": "991c4ac5ed8d79ec82589e11ec67a2d11efbc523875013051b96457b55be274a",
+    "sha256": "d2deb01d1b50975220e5ee778a3f487256d2704c60bb881efde3f2af99d372f5",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "8c81e506-6e82-4884-9b9a-75d3d252f967": {
     "rule_name": "Potential SharpRDP Behavior",
-    "sha256": "4cf3598e184cd3c8984d8d33d2a1c2d9b9516554d1c903ef569a66889fe0c998",
+    "sha256": "a5bd7d9ab86ab20b88f66312067bfab6a568f6e2e62a6086ae485a5d2e41f0b6",
     "type": "eql",
-    "version": 112
+    "version": 113
   },
   "8c8df61f-ed2a-4832-87b8-ee30812606e0": {
     "rule_name": "Potential Linux Tunneling and/or Port Forwarding via Command Line",
@@ -7031,6 +7140,12 @@
     "type": "eql",
     "version": 6
   },
+  "8e66c55f-8db6-4e3e-bf4f-3a3e242bdf66": {
+    "rule_name": "Microsoft Graph Multi-Category Reconnaissance Burst",
+    "sha256": "7a9834cd74794ce51aa225cb563776e440a9c8e8148106721fe40db00f5e2418",
+    "type": "esql",
+    "version": 1
+  },
   "8e7a4f2c-9b3d-4e5a-a1b6-c2d8f7e9b3a5": {
     "rule_name": "Entra ID Actor Token User Impersonation Abuse",
     "sha256": "3d44c73a3692bf5d2e82a05e5660e69202bc834886ad39fb4b6b3fe0211e845a",
@@ -7133,6 +7248,12 @@
     "type": "eql",
     "version": 107
   },
+  "90c0ce77-3fb4-484f-a8ad-4648e12b35b1": {
+    "rule_name": "AWS EKS Access Entry Modified",
+    "sha256": "b0dee71f273e351db266bb3a78718389454410b327626c2aaabb5e9dc8852273",
+    "type": "query",
+    "version": 1
+  },
   "90e28af7-1d96-4582-bf11-9a1eff21d0e5": {
     "rule_name": "Auditd Login Attempt at Forbidden Time",
     "sha256": "0410b9e68a9f6e6086c24a72980f090d2a0e09ff9961adc13895613c2bb15cad",
@@ -7356,6 +7477,12 @@
     "type": "eql",
     "version": 215
   },
+  "9550ec87-e73c-4baa-ad44-e448a33fbc3d": {
+    "rule_name": "AWS EKS Access Entry Granted Cluster Admin Policy",
+    "sha256": "652611a8d6d720fe183c23b189538c22c0965eadeff325253a214218fb49ca7a",
+    "type": "query",
+    "version": 1
+  },
   "9563dace-5822-11f0-b1d3-f661ea17fbcd": {
     "rule_name": "Entra ID OAuth user_impersonation Scope for Unusual User and Client",
     "sha256": "4062c9fbacade77b466ba4c8c18199e74c0d56a88a9eeef6fdc5d2d4494315d7",
@@ -7745,9 +7872,9 @@
   },
   "9c0f61fa-abf4-4b11-8d9d-5978c09182dd": {
     "rule_name": "Potential Command Shell via NetCat",
-    "sha256": "e984f394b7db575dabb5ab5eae23ab9c57ebb2227b9f11c38f7cad14f9f9a7bb",
+    "sha256": "fe7066cb047e8fcd01978d0b3fa2b4907279ea0c61582379577178729366bd78",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "9c260313-c811-4ec8-ab89-8f6530e0246c": {
     "rule_name": "Hosts File Modified",
@@ -7924,6 +8051,12 @@
     "type": "eql",
     "version": 216
   },
+  "9f420cca-cb27-44db-a13d-c43c7b48e04a": {
+    "rule_name": "Kubelet API Connection Attempt to Internal IP",
+    "sha256": "cca84cb2c6da4a05157e5d1e018a7bbe95a35bd604d0a3b76740a644e6330382",
+    "type": "eql",
+    "version": 1
+  },
   "9f432a8b-9588-4550-838e-1f77285580d3": {
     "rule_name": "Dynamic IEX Reconstruction via Method String Access",
     "sha256": "a51bf01a5df76390c908b50a4a9b7c3fb2cdad0ed9c8e0c55d50b16b67c240d7",
@@ -8174,9 +8307,9 @@
   },
   "a4f7a295-aba1-4382-9c00-f7b02097acbc": {
     "rule_name": "Suspicious SolarWinds Web Help Desk Java Module Load or Child Process",
-    "sha256": "787d2f5521dc4499fb6b01d857d4e2f1c96bb9acf94725a4dc16764d99962411",
+    "sha256": "76d59e79f3babe6154c71460acf4fda53d270601b8e4aef05258ca8d78e64833",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "a52a9439-d52c-401c-be37-2785235c6547": {
     "min_stack_version": "9.3",
@@ -8258,6 +8391,12 @@
     "type": "eql",
     "version": 3
   },
+  "a643e6b8-ba2a-45f1-8d71-d265bfe2ae43": {
+    "rule_name": "Kubernetes CoreDNS or Kube-DNS Configuration Modified",
+    "sha256": "f9ac0a1ac302dd70ac23d1538d11ac1c49b802df8e0e9d47ce6c2e8c10627cb7",
+    "type": "query",
+    "version": 1
+  },
   "a6788d4b-b241-4bf0-8986-a3b4315c5b70": {
     "rule_name": "AWS S3 Bucket Server Access Logging Disabled",
     "sha256": "6ce6628461a895263040879ad1dfccf958216ebc96b9c795d5b3ce688836c641",
@@ -8270,6 +8409,12 @@
     "type": "eql",
     "version": 1
   },
+  "a698a653-e144-4e40-bade-35135935be45": {
+    "rule_name": "Kubernetes Static Pod Manifest File Access",
+    "sha256": "431eacdea1a3b80fdcde70fa178d5c24b34efa54a40431c2e2192ee86222d548",
+    "type": "query",
+    "version": 1
+  },
   "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90": {
     "rule_name": "Emond Rules Creation or Modification",
     "sha256": "0aef85561df73b765eb845f8de00dd44020df10da07314fb87273d339f48199e",
@@ -8375,9 +8520,9 @@
   "a87d49f0-24ae-4d6e-a0b4-5fd2f6188d6a": {
     "min_stack_version": "9.3",
     "rule_name": "Kubectl Secrets Enumeration Across All Namespaces",
-    "sha256": "dd2e61c000cb7733d1035682841ea2bd21ce20c73dc2b64c291657550b304ab2",
+    "sha256": "c380ca5eff3db9572f02a9c429106de2ea18f096aa7e9f0b4a7d3bcfd1d5e7b6",
     "type": "eql",
-    "version": 1
+    "version": 2
   },
   "a8aaa49d-9834-462d-bf8f-b1255cebc004": {
     "rule_name": "Authentication via Unusual PAM Grantor",
@@ -8432,6 +8577,12 @@
     "type": "machine_learning",
     "version": 109
   },
+  "a8e7d6c5-b4a3-2918-0f9e-8d7c6b5a4032": {
+    "rule_name": "Kubernetes Pod Exec Cloud Instance Metadata Access",
+    "sha256": "19051cb2a65f548b54771af0f577af7e2eb44f76107957bf272b6015313fe25b",
+    "type": "esql",
+    "version": 1
+  },
   "a8f3c2e1-4d5b-4e6f-8a9b-0c1d2e3f4a5b": {
     "rule_name": "AWS IAM Sensitive Operations via Lambda Execution Role",
     "sha256": "722248fbd97f34880ac46f44b6881220135ab96b0ffbff1f45977226ab809dde",
@@ -8480,9 +8631,9 @@
   },
   "a9b05c3b-b304-4bf9-970d-acdfaef2944c": {
     "rule_name": "Persistence via Hidden Run Key Detected",
-    "sha256": "3b30278eb35bd453721b5e6a3709354920655bc529e57a4de4d76c5c1194a794",
+    "sha256": "968e5d19c19da327582404a25be9dadac756379a58bb515651ea70f93c0059c5",
     "type": "eql",
-    "version": 215
+    "version": 216
   },
   "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7": {
     "rule_name": "IPSEC NAT Traversal Port Activity",
@@ -8600,6 +8751,12 @@
     "type": "machine_learning",
     "version": 310
   },
+  "abb7bc31-b865-4318-80a9-b9ee4edd57b6": {
+    "rule_name": "Kubernetes API Request Impersonating Privileged Identity",
+    "sha256": "47ddae266a654e4f71a1b66785569f16e1d60655d17563fb566a4b2b10259462",
+    "type": "query",
+    "version": 1
+  },
   "abc7a2be-479e-428b-b0b3-1d22bda46dd9": {
     "rule_name": "Google Calendar C2 via Script Interpreter",
     "sha256": "cd3aac05b993742d0c467053b7548c79623f2da5a4d979c6abe448b797d3411c",
@@ -8632,9 +8789,9 @@
   },
   "ac6bc744-e82b-41ad-b58d-90654fa4ebfb": {
     "rule_name": "WPS Office Exploitation via DLL Hijack",
-    "sha256": "8d4e2f6cb5d21f8244e59e8c3b20856df8349b82ee18227dc9c8ee312213e81a",
+    "sha256": "cef314234586cf1545f7d707ad192fd03d3e953b281e604e680f99949ed7e97f",
     "type": "eql",
-    "version": 105
+    "version": 106
   },
   "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1": {
     "min_stack_version": "9.4",
@@ -8678,9 +8835,9 @@
   },
   "ace1e989-a541-44df-93a8-a8b0591b63c0": {
     "rule_name": "Potential macOS SSH Brute Force Detected",
-    "sha256": "ad378adde9bbf820b6da8dd6764e50a48c987669c717ca222e023f1a01b17553",
+    "sha256": "2a62d8689df1b549f8a9709b36bddcac030fbf8715e6fe481ec8e8b5434ef6e8",
     "type": "threshold",
-    "version": 112
+    "version": 113
   },
   "acf738b5-b5b2-4acc-bad9-1e18ee234f40": {
     "rule_name": "Suspicious Managed Code Hosting Process",
@@ -8954,6 +9111,12 @@
     "type": "threshold",
     "version": 2
   },
+  "b2c3d4e5-f6a7-4890-b1c2-d3e4f5a60789": {
+    "rule_name": "Kubernetes Pod Exec Sensitive File or Credential Path Access",
+    "sha256": "06fbcbacaf9ae7b1d3578891aa86583861c48ccca12f5861d9996f25a84552a7",
+    "type": "esql",
+    "version": 1
+  },
   "b2c3d4e5-f6a7-5b6c-9d0e-1f2a3b4c5d6e": {
     "rule_name": "Potential Account Takeover - Mixed Logon Types",
     "sha256": "fec263f1a8e25a341fbc4d919058aefe36ed0aa33d27a7bef776cc039a301126",
@@ -9045,21 +9208,21 @@
   "b4bd186b-69c6-45ad-8bef-5c35bbadeaef": {
     "min_stack_version": "9.3",
     "rule_name": "Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers",
-    "sha256": "ea1e6c16c05f513bef9a7fce9aea0e625892b08e71fb0657730605a640764afd",
+    "sha256": "90830399dbd7961335bf3a8753f257d25c33dbcdbc1474f0e95c96133eea6f2e",
     "type": "eql",
-    "version": 2
+    "version": 3
   },
   "b4c8e2a1-9f3d-4e7c-a2b1-0d5e6f7a8b9c": {
     "rule_name": "Kubernetes Rapid Secret GET Activity Against Multiple Objects",
-    "sha256": "3116ce1fbded5e4cc884ac4a680158bc2822f8ed3e02e97ac4223252d5d278c3",
+    "sha256": "e7c54086214a71bb038838607a536ef7aa41291266fa5de8bfed8550c1264f6d",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "b51dbc92-84e2-4af1-ba47-65183fcd0c57": {
-    "rule_name": "Potential Privilege Escalation via OverlayFS",
-    "sha256": "8184ab730ee2e991794ad836b1317d48d6b4ea0e58c4fc42fb00db88f9ca8bef",
+    "rule_name": "Potential Privilege Escalation via unshare and UID Change",
+    "sha256": "3cd020f114e1352ff5935c6e5577a9adcf1860443b9620b2062b4dc2a5b72a4a",
     "type": "eql",
-    "version": 10
+    "version": 11
   },
   "b53f1d73-150d-484d-8f02-222abeb5d5fa": {
     "min_stack_version": "9.3",
@@ -9085,9 +9248,9 @@
   },
   "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921": {
     "rule_name": "Volume Shadow Copy Deleted or Resized via VssAdmin",
-    "sha256": "22aeae9e6e806d1a9e4216f3485b6f9bc573e3efebfcb756f488b3510e88378c",
+    "sha256": "a9c315fd8704d74060623e2eccc8e9f3b65a119d4ed251abcdfdd52901b0379f",
     "type": "eql",
-    "version": 317
+    "version": 318
   },
   "b605f262-f7dc-41b5-9ebc-06bafe7a83b6": {
     "rule_name": "Systemd Service Started by Unusual Parent Process",
@@ -9231,9 +9394,9 @@
   },
   "b90cdde7-7e0d-4359-8bf0-2c112ce2008a": {
     "rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface",
-    "sha256": "a458c8f1dd0880bd480c3221aa2fc1e68d92b55fb0a6899029388a4bc3ef00b2",
+    "sha256": "521aa3e9bb538b547685c1ec1a9f12c5c4e34de5c31cfb9f0bd18ed219ae178a",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "b910f25a-2d44-47f2-a873-aabdc0d355e6": {
     "rule_name": "Chkconfig Service Add",
@@ -9255,9 +9418,9 @@
   },
   "b9554892-5e0e-424b-83a0-5aef95aa43bf": {
     "rule_name": "Group Policy Abuse for Privilege Addition",
-    "sha256": "e1354aee6d1923e8a2981bf59472687a27e3af9e89fa81c9d248a652d6f15fce",
+    "sha256": "9ac9d0123bbe07619ef3f68e09b71e3a234dee94a91f0ad58a5ea042ad48a1b0",
     "type": "eql",
-    "version": 214
+    "version": 215
   },
   "b9666521-4742-49ce-9ddc-b8e84c35acae": {
     "rule_name": "Creation of Hidden Files and Directories via CommandLine",
@@ -9455,9 +9618,9 @@
   },
   "bd7eefee-f671-494e-98df-f01daf9e5f17": {
     "rule_name": "Suspicious Print Spooler Point and Print DLL",
-    "sha256": "f236da0018f3c95714b7f47d42df3c3389fcd252069efa50f02ee8bebb468f09",
+    "sha256": "df28d4809713bc1224246014d11ffc61f9ef0436ecb8801c2fbd495bf8201d57",
     "type": "eql",
-    "version": 214
+    "version": 215
   },
   "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc": {
     "rule_name": "Deprecated - Potential Pspy Process Monitoring Detected",
@@ -9467,9 +9630,9 @@
   },
   "bdcf646b-08d4-492c-870a-6c04e3700034": {
     "rule_name": "Potential Privileged Escalation via SamAccountName Spoofing",
-    "sha256": "7eaec669020f14dddbe892f76fd4b204a602a2c3cd1cd4174098514f6abc7b6a",
+    "sha256": "1cc8b614d64dee3f72481d18cbea5d29b1c50f73e18f0bf1ace62841c74a8ee7",
     "type": "eql",
-    "version": 215
+    "version": 216
   },
   "bdfaddc4-4438-48b4-bc43-9f5cf8151c46": {
     "rule_name": "Execution via Windows Command Debugging Utility",
@@ -9709,9 +9872,9 @@
   },
   "c2a91e88-4f4b-4e1d-9c7b-8fde112a9403": {
     "rule_name": "Kubernetes Multi-Resource Discovery",
-    "sha256": "ba3c836d664df993f5eb60a7daa1e03e7ba8979b31107abda39886337b6eb0fb",
+    "sha256": "e9df8056e4a85a5472fe686ba09143d567fbfa73ea785130804494fd595a35ed",
     "type": "esql",
-    "version": 1
+    "version": 2
   },
   "c2d90150-0133-451c-a783-533e736c12d7": {
     "rule_name": "Mshta Making Network Connections",
@@ -9824,9 +9987,9 @@
   },
   "c57f8579-e2a5-4804-847f-f2732edc5156": {
     "rule_name": "Potential Remote Desktop Shadowing Activity",
-    "sha256": "7c840986983f33b226bd6ec8dbb5af504749920819a8f73fcf5c660ed9c2debe",
+    "sha256": "34a8a87924c6ad4c5cef9cc2bc41b91633417cb0bbbfb65a121e7ff38c26de9b",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "c58c3081-2e1d-4497-8491-e73a45d1a6d6": {
     "rule_name": "GCP Virtual Private Cloud Network Deletion",
@@ -9876,6 +10039,12 @@
     "type": "eql",
     "version": 6
   },
+  "c62733ff-9373-4fdf-9733-3d992e148c93": {
+    "rule_name": "Kubernetes Ephemeral Container Added to Pod",
+    "sha256": "c790909bc3eda3e57868dee65181763def1dddb5b157ac1ecf5390a855d01b24",
+    "type": "query",
+    "version": 1
+  },
   "c6453e73-90eb-4fe7-a98c-cde7bbfc504a": {
     "rule_name": "Remote File Download via MpCmdRun",
     "sha256": "fb2fe11496bbfc2388fa376d8b542bf097de5191513c3955377d9ab1235a6d06",
@@ -9896,9 +10065,9 @@
   },
   "c6b40f4c-c6a9-434e-adb8-989b0d06d005": {
     "rule_name": "Suspicious Kerberos Authentication Ticket Request",
-    "sha256": "8736d228be608f8444c05b92524b70cad9521695df3889cb526d6ff03c7ca3d5",
+    "sha256": "732dee33aa6139e44513f5881a2dba96f5295987d88fcee4aacd52eb5d2eab03",
     "type": "eql",
-    "version": 4
+    "version": 5
   },
   "c70d9f0d-8cb6-4cfc-85df-a95c1ccf4eab": {
     "min_stack_version": "9.2",
@@ -10014,9 +10183,9 @@
   },
   "c8b150f0-0164-475b-a75e-74b47800a9ff": {
     "rule_name": "Suspicious Startup Shell Folder Modification",
-    "sha256": "0a734ad1795c3fce393559e4e4e0ef121722612a0ce4601020f58a7da3a813eb",
+    "sha256": "972012b725a4c8682ab12245bb0f090a12981eef449d2feb19ce9dc5859ada87",
     "type": "eql",
-    "version": 319
+    "version": 320
   },
   "c8cccb06-faf2-4cd5-886e-2c9636cfcb87": {
     "rule_name": "Disabling Windows Defender Security Settings via PowerShell",
@@ -10060,6 +10229,12 @@
     "type": "eql",
     "version": 5
   },
+  "c9d4e8f1-2a3b-4c5d-8e9f-0a1b2c3d4e5f": {
+    "rule_name": "Kubernetes Pod Exec with Curl or Wget to HTTPS",
+    "sha256": "bfe3e798917b0efcd914fbaa1f3b4a7ac06bb0ae47317afd993519c12eca0dc0",
+    "type": "esql",
+    "version": 1
+  },
   "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa": {
     "rule_name": "Credential Manipulation - Prevented - Elastic Endgame",
     "sha256": "cc40f7557b619c20a993ef46dd7b17fa103e74bae9608ccdd499efb61aa5b88f",
@@ -10316,9 +10491,9 @@
   },
   "cf2b8cf5-3364-4396-b551-42aae9b6d37e": {
     "rule_name": "AWS SSM Session Manager Child Process Execution",
-    "sha256": "503d37331fe7187fb01b1d447fea2925952becaaadf1c18dccb8337fd23ad792",
+    "sha256": "b17735b656bbc81d70ff40989315103f3d8f3fcbfafb53bf3dc424ae9bd96070",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "cf307a5a-d503-44a4-8158-db196d99c9df": {
     "rule_name": "Unusual Kill Signal",
@@ -10328,9 +10503,9 @@
   },
   "cf53f532-9cc9-445a-9ae7-fced307ec53c": {
     "rule_name": "Cobalt Strike Command and Control Beacon",
-    "sha256": "1b90eba9a9e009732a4566d19620ff6a110c5d3ed75e1459e87850d2b6fa4d07",
+    "sha256": "215cf3274a7f3d97026667fa01a4a82ebc963fe7db54f0760260bde3f2fb0100",
     "type": "query",
-    "version": 108
+    "version": 109
   },
   "cf549724-c577-4fd6-8f9b-d1b8ec519ec0": {
     "rule_name": "Domain Added to Google Workspace Trusted Domains",
@@ -10532,6 +10707,12 @@
     "type": "eql",
     "version": 113
   },
+  "d4695889-0410-4e7b-a4aa-59be525a11a6": {
+    "rule_name": "Entra ID Register Device with Unusual User Agent (Azure AD Join)",
+    "sha256": "675401d2482999813274db5a1fcb768f91758024beb4c0c6695a66d8cdcd7add",
+    "type": "query",
+    "version": 1
+  },
   "d488f026-7907-4f56-ad51-742feb3db01c": {
     "rule_name": "AWS S3 Bucket Replicated to Another Account",
     "sha256": "6bd7b6a580b9950f4a7a1d4911e00797056e57451d2c13d8236fa85a164dfcc6",
@@ -10627,9 +10808,9 @@
   },
   "d563aaba-2e72-462b-8658-3e5ea22db3a6": {
     "rule_name": "Privilege Escalation via Windir Environment Variable",
-    "sha256": "072f511c23260ba660cacdaedd1876a631d69a1b695e05b41ea3ca3448285f51",
+    "sha256": "6de04fbb3615cf52d1a00204c0cc7d5e126031bf5f50005e01881ede98097e80",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "d591d7af-399b-4888-b705-ae612690c48d": {
     "rule_name": "Newly Observed High Severity Suricata Alert",
@@ -10793,9 +10974,9 @@
   },
   "d8ab1ec1-feeb-48b9-89e7-c12e189448aa": {
     "rule_name": "Untrusted Driver Loaded",
-    "sha256": "521c26dd7b4a866375b12d8bf94fc96f58c4609c18d20e1af2bbb6737116b711",
+    "sha256": "dd48411c421dd9a77c91fa3ff6ff6d14e61e1ae1d21e0c8c6502a895bd5f61d5",
     "type": "eql",
-    "version": 13
+    "version": 14
   },
   "d8b2f85a-cf1c-40fc-acf0-bb5d588a8ea6": {
     "rule_name": "Potential REMCOS Trojan Execution",
@@ -10829,9 +11010,9 @@
   },
   "d99a037b-c8e2-47a5-97b9-170d076827c4": {
     "rule_name": "Volume Shadow Copy Deletion via PowerShell",
-    "sha256": "f0818620cb57af36acddfe05cb87d184601a31dbe28ba5e8bd4f5e367bd4cd38",
+    "sha256": "061af9c10cb05decbc575b0ae0c06c1bdd672222b3a888b953190222fa5b14e7",
     "type": "eql",
-    "version": 318
+    "version": 319
   },
   "d9af2479-ad13-4471-a312-f586517f1243": {
     "rule_name": "Curl or Wget Spawned via Node.js",
@@ -10854,9 +11035,9 @@
   },
   "d9ffc3d6-9de9-4b29-9395-5757d0695ecf": {
     "rule_name": "Suspicious Windows Command Shell Arguments",
-    "sha256": "dc6aa3431de19bd229cf92b2a7fd92a72dc57231303e70f142c18278d1252d14",
+    "sha256": "15f5dd84a9d960fdd0ea0c58c5ffb940e0756358d081435f8ae73ca59eaed3de",
     "type": "eql",
-    "version": 208
+    "version": 209
   },
   "da0d4bae-33ee-11f0-a59f-f661ea17fbcd": {
     "rule_name": "Entra ID Protection - Risk Detection",
@@ -10986,9 +11167,9 @@
   },
   "dc9c1f74-dac3-48e3-b47f-eb79db358f57": {
     "rule_name": "Volume Shadow Copy Deletion via WMIC",
-    "sha256": "47d52567d1c3bae001db77709a1e8aff40f889ce53a7aaf7c9c0218fccf56010",
+    "sha256": "3acf373b176d3530fa50133aba0cc5e97d69dd9048f86a93ec51b82bbabd87eb",
     "type": "eql",
-    "version": 317
+    "version": 318
   },
   "dca28dee-c999-400f-b640-50a081cc0fd1": {
     "rule_name": "Unusual Country For an AWS Command",
@@ -10998,9 +11179,9 @@
   },
   "dca6b4b0-ae70-44eb-bb7a-ce6db502ee78": {
     "rule_name": "Suspicious Execution from INET Cache",
-    "sha256": "ec304aa55d1d4f1641743ac7118be33facd1da2f08d730f7ba48d716f6a02747",
+    "sha256": "bd9a3f37f0d0ab84e7db8a5a74cea5394ae79810a7375da4213f0f9a2c6fa870",
     "type": "eql",
-    "version": 212
+    "version": 213
   },
   "dcbd07f8-bd6e-4bb4-ac5d-cec1927ea88f": {
     "min_stack_version": "9.4",
@@ -11166,9 +11347,9 @@
   },
   "dffbd37c-d4c5-46f8-9181-5afdd9172b4c": {
     "rule_name": "Potential privilege escalation via CVE-2022-38028",
-    "sha256": "fabd1d888ece7ed98e8dbde37327e15de97291c9b270edd70a6f55113489b9d4",
+    "sha256": "3f71996afbee4c685c8f52997c9df48706ea01c6b2de558474316098cbd78701",
     "type": "eql",
-    "version": 210
+    "version": 211
   },
   "e00b8d49-632f-4dc6-94a5-76153a481915": {
     "rule_name": "Delayed Execution via Ping",
@@ -11184,9 +11365,9 @@
   },
   "e052c845-48d0-4f46-8a13-7d0aba05df82": {
     "rule_name": "KRBTGT Delegation Backdoor",
-    "sha256": "60f2e83e2e758d10795f462a4227d514cbaf954e3f734e293bcd14b0923008d8",
+    "sha256": "e267d4a1c0816edee33949500b7845ddffbc71f9e886b046cead5b47b8e3ffb8",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "e0881d20-54ac-457f-8733-fe0bc5d44c55": {
     "rule_name": "System Service Discovery through built-in Windows Utilities",
@@ -11414,9 +11595,9 @@
   },
   "e4e31051-ee01-4307-a6ee-b21b186958f4": {
     "rule_name": "Service Creation via Local Kerberos Authentication",
-    "sha256": "a8d5740eabcbbb09f46fbfdeb0e4366b51fdccf32faeee210f7108501110e476",
+    "sha256": "2835e011c2b091e7ca7df56076492ae247ab5a85004aa4b5799ea204433c5b33",
     "type": "eql",
-    "version": 213
+    "version": 214
   },
   "e4feea34-3b62-4c83-b77f-018fbef48c00": {
     "min_stack_version": "9.2",
@@ -11446,6 +11627,12 @@
     "type": "eql",
     "version": 4
   },
+  "e5420ced-bc42-4783-a8df-99320567e090": {
+    "rule_name": "Entra ID OAuth Device Code Phishing via AiTM",
+    "sha256": "8bde43506fd1c2d1913d4fd289c639bf62d870c4fafc812c8d964ce2ebee5ee0",
+    "type": "query",
+    "version": 1
+  },
   "e555105c-ba6d-481f-82bb-9b633e7b4827": {
     "rule_name": "MFA Disabled for Google Workspace Organization",
     "sha256": "a6c636f24c7cf63487a0db4ee93fdb305a9e7766647d78bc310af47ac06f4733",
@@ -11538,21 +11725,21 @@
   },
   "e760c72b-bb1f-44f0-9f0d-37d51744ee75": {
     "rule_name": "Unusual Execution via Microsoft Common Console File",
-    "sha256": "e80bd4c0aced2a70668f8e19c3570f377d60d152d9baaa79c02cd9bf97d29419",
+    "sha256": "f55de11949383e8ffb3a4192eecf14866875ceeaa57bde8ee624939ca76fd6be",
     "type": "eql",
-    "version": 207
+    "version": 208
   },
   "e7856173-6489-449f-80ec-c1f5fcd7b87c": {
     "rule_name": "Suspicious SUID Binary Execution",
-    "sha256": "6bd584f1d16f040129a26cae8109dcf87db5067d5f2c179e516e43aed9b929d3",
-    "type": "query",
-    "version": 1
+    "sha256": "3ab2883a81df88c4292ed8b020245160915a89cf093f6328b0214b58896d1ccd",
+    "type": "eql",
+    "version": 2
   },
   "e7b2c3d4-5a6b-4e8f-9c0d-1a2b3e4f5a6b": {
     "rule_name": "Curl or Wget Execution from Container Context",
-    "sha256": "8f366e09f9e245ce0ba56adb44531b854bedb456939e125c7f713d7d02b76cc1",
+    "sha256": "3f8ae9fc98a4b5464696708a194db0dadf788ad1d2c77233c68f478030024d14",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "e7cb3cfd-aaa3-4d7b-af18-23b89955062c": {
     "rule_name": "Potential Linux Credential Dumping via Unshadow",
@@ -11815,9 +12002,9 @@
   },
   "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6": {
     "rule_name": "Mimikatz Memssp Log File Detected",
-    "sha256": "faf606497245f3d7e09a8ae6abe6afb788c439573a1eae221c0786d44878c8a4",
+    "sha256": "56231d3c8e57ad67eef559e631d5025fa3d21b1307ebe044ebf1101c9f679348",
     "type": "eql",
-    "version": 418
+    "version": 419
   },
   "ebf1adea-ccf2-4943-8b96-7ab11ca173a5": {
     "rule_name": "IIS HTTP Logging Disabled",
@@ -11939,9 +12126,9 @@
   },
   "ee7726cc-babc-4885-988c-f915173ac0c0": {
     "rule_name": "Suspicious Execution from a WebDav Share",
-    "sha256": "193a9582b8a88c80c2ec2d4d03cc840cba670833923fc58cb2815ed2e060ab0f",
+    "sha256": "cb9ecbc855c3a9bf371ed5766b1f1a6cef2acba08494acf22942d88981b9a3c8",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "eea82229-b002-470e-a9e1-00be38b14d32": {
     "rule_name": "Potential Privacy Control Bypass via TCCDB Modification",
@@ -12059,9 +12246,9 @@
   },
   "f0dbff4c-1aa7-4458-9ed5-ada472f64970": {
     "rule_name": "dMSA Account Creation by an Unusual User",
-    "sha256": "09d110d157380492d4d0de9d37dff770be9757b6528fca4da3a5aa560b964348",
+    "sha256": "28416e6918e51a300324bffb33451ff11a943ec5dc6075a7cd04e1d85f4fcb07",
     "type": "new_terms",
-    "version": 4
+    "version": 5
   },
   "f0eb70e9-71e9-40cd-813f-bf8e8c812cb1": {
     "rule_name": "Execution with Explicit Credentials via Scripting",
@@ -12081,6 +12268,12 @@
     "type": "eql",
     "version": 106
   },
+  "f1a2b3c4-d5e6-4789-a012-3456789abc01": {
+    "rule_name": "Kubernetes Pod Exec Potential Reverse Shell",
+    "sha256": "c7e91f6c8b2f39082470926c780b65b578a79523ed0d2eef013c950f9b6f150a",
+    "type": "esql",
+    "version": 1
+  },
   "f1a6d0f4-95b8-11ed-9517-f661ea17fbcc": {
     "rule_name": "Forwarded Google Workspace Security Alert",
     "sha256": "fa20fb477b98059cdcedc8515e55e02f1f0f705253f61f5f68683154a52bf7c8",
@@ -12153,6 +12346,12 @@
     "type": "query",
     "version": 1
   },
+  "f2a8c4d1-6b3e-4a9f-8c2d-1e5f7a9b0c4d": {
+    "rule_name": "Potential Privilege Escalation in Container via Runc Init",
+    "sha256": "6fbd2f2d731383ed9178b410b4cafc180a818c0b740dd9a77422871ea17e10e1",
+    "type": "query",
+    "version": 1
+  },
   "f2c3caa6-ea34-11ee-a417-f661ea17fbce": {
     "rule_name": "Malicious File - Detected - Elastic Defend",
     "sha256": "41ad2b2030986dcdd6d5acd828d369cbf10f4b53afd0cbc73f44834f48ac57aa",
@@ -12263,9 +12462,9 @@
   },
   "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c": {
     "rule_name": "Persistence via Microsoft Office AddIns",
-    "sha256": "65c544d6e400d0909d79ad3a1e0f79b5cf5fcdd3fb01a1a073adc46c69aafb31",
+    "sha256": "553406e7a5fe05f12c98e908e130c595f11aad5ba24d6521b3cb95431f1220cf",
     "type": "eql",
-    "version": 313
+    "version": 314
   },
   "f48ecc44-7d02-437d-9562-b838d2c41987": {
     "rule_name": "Pluggable Authentication Module or Configuration Creation",
@@ -12471,9 +12670,9 @@
   },
   "f770ce79-05fd-4d74-9866-1c5d66c9b34b": {
     "rule_name": "Potential Malicious PowerShell Based on Alert Correlation",
-    "sha256": "16873d6b08a266ce4c13f00b9cccef6dd41c64d850c8a5f83b593c93662d037c",
+    "sha256": "18fe52692212c76a8aa0b987ba3acfd8a6000f9c822bed35cf9ff4813f183040",
     "type": "esql",
-    "version": 5
+    "version": 6
   },
   "f772ec8a-e182-483c-91d2-72058f76a44c": {
     "rule_name": "AWS CloudWatch Alarm Deletion",
@@ -12497,6 +12696,12 @@
     "type": "eql",
     "version": 106
   },
+  "f7a131f8-44b7-4957-99a4-e6c54d93d816": {
+    "rule_name": "Potential Kubeletctl Execution",
+    "sha256": "89f8d852aa107f4487eef99b1e6a9d81950c954a0b6533b2f283a5dfdd9a07e5",
+    "type": "eql",
+    "version": 1
+  },
   "f7a1c536-9ac0-11ef-9911-f661ea17fbcd": {
     "rule_name": "AWS IAM Create User via Assumed Role on EC2 Instance",
     "sha256": "0df65b003548a28c9f18c010d2dd59a06433f01121e7a155c496e0b44d3cb6c1",
@@ -12536,9 +12741,9 @@
   },
   "f81ee52c-297e-46d9-9205-07e66931df26": {
     "rule_name": "Microsoft Exchange Worker Spawning Suspicious Processes",
-    "sha256": "19fa275f01d141046af620130c54383997bbfb159cc343503bd148ff624abf21",
+    "sha256": "e1093b274ee488b7ae91e618e9198f2f5fbb2e38c105ebe0d065545ffadd5cf9",
     "type": "eql",
-    "version": 315
+    "version": 316
   },
   "f85ce03f-d8a8-4c83-acdc-5c8cd0592be7": {
     "rule_name": "Suspicious Child Process of Adobe Acrobat Reader Update Service",
@@ -12572,9 +12777,9 @@
   },
   "f8a31c62-0d4e-4b9a-b7e1-6c2a9d4e8f10": {
     "rule_name": "Kubernetes Secret get or list from Node or Pod Service Account",
-    "sha256": "c8c9c251cc5939d6149f56787247eac3841a1012d35b82125ec7fc7bb70ab005",
+    "sha256": "54c8912357a44e55f6e5f02a278d9037893b4919c7b4af99370d5049ef288546",
     "type": "query",
-    "version": 1
+    "version": 2
   },
   "f909075d-afc7-42d7-b399-600b94352fd9": {
     "rule_name": "Untrusted DLL Loaded by Azure AD Connect Authentication Agent",
@@ -12754,9 +12959,9 @@
   },
   "fbad57ec-4442-48db-a34f-5ee907b44a22": {
     "rule_name": "Potential Fake CAPTCHA Phishing Attack",
-    "sha256": "33d00e4c6fe087be1ef08b31b40a606e5e9c71ae3c9df80f964991477494d542",
+    "sha256": "57236fd56cbb9d847b89d0f3dabc3067acac43e780f46d94437f5c0cbc3599fd",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "fbb10f1e-77cb-42f9-994e-5da17fc3fc15": {
     "min_stack_version": "9.4",
@@ -12976,9 +13181,9 @@
   },
   "ff18d24b-2ba6-4691-a17f-75c4380d0965": {
     "rule_name": "Suspicious JavaScript Execution via Deno",
-    "sha256": "cb55c046d8dfe8230113d03f862c936b4cc6f55c682a4004ef707a95803af2f3",
+    "sha256": "102528b0ebeaf11552f09f3c90c9140833eba1c358f9aa8242bda4fd27742849",
     "type": "eql",
-    "version": 3
+    "version": 4
   },
   "ff320c56-f8fa-11ee-8c44-f661ea17fbce": {
     "rule_name": "AWS S3 Bucket Expiration Lifecycle Configuration Added",
@@ -12988,9 +13193,9 @@
   },
   "ff4599cb-409f-4910-a239-52e4e6f532ff": {
     "rule_name": "LSASS Process Access via Windows API",
-    "sha256": "2c61b250e1b3df4306e4f76d4df13c3f7cd624151ef683d9746e1b5640096676",
+    "sha256": "e8c9c0b5687e154282e78e10cc4a216bb48980b43eb31f266ae4bdbb91e37781",
     "type": "esql",
-    "version": 18
+    "version": 19
   },
   "ff46eb26-0684-4da3-9dd6-21032c9878e1": {
     "rule_name": "Active Directory Discovery using AdExplorer",
diff --git a/docs-dev/ATT&CK-coverage.md b/docs-dev/ATT&CK-coverage.md
index e8630945d..e2b3af83a 100644
--- a/docs-dev/ATT&CK-coverage.md
+++ b/docs-dev/ATT&CK-coverage.md
@@ -231,6 +231,7 @@ coverage from the state of rules in the `main` branch.
 |[Elastic-detection-rules-tags-threat-detection](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-threat-detection.json&leave_site_dialog=false&tabs=false)|
 |[Elastic-detection-rules-tags-traefik](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-traefik.json&leave_site_dialog=false&tabs=false)|
 |[Elastic-detection-rules-tags-triplecross](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-triplecross.json&leave_site_dialog=false&tabs=false)|
+|[Elastic-detection-rules-tags-tycoon2fa](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-tycoon2fa.json&leave_site_dialog=false&tabs=false)|
 |[Elastic-detection-rules-tags-ueba](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-ueba.json&leave_site_dialog=false&tabs=false)|
 |[Elastic-detection-rules-tags-vulnerability](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-vulnerability.json&leave_site_dialog=false&tabs=false)|
 |[Elastic-detection-rules-tags-web-application-compromise](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-web-application-compromise.json&leave_site_dialog=false&tabs=false)|
diff --git a/pyproject.toml b/pyproject.toml
index 8c412817e..935880b02 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.6.39"
+version = "1.6.40"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"