From 56b5284580debf0b7fe71d8ec9aaecf6b1a2f5f6 Mon Sep 17 00:00:00 2001
From: protectionsmachine
 <72879786+protectionsmachine@users.noreply.github.com>
Date: Wed, 3 Jun 2026 10:06:23 +0000
Subject: [PATCH] Updating artifacts

---
 ...uest_by_suspicious_process_executable.toml | 97 +++++++++++++++++++
 ...dynamic_dns_via_suspicious_executable.toml | 20 ++--
 ...e_initiated_egress_network_connection.toml | 28 +++++-
 ...inux_tunneling_and_or_port_forwarding.toml | 10 +-
 ...ction_from_deleted_executable_by_root.toml |  4 +-
 ...e_descriptor_via_interactive_session.toml} |  6 +-
 ...e_descriptor_child_process_execution.toml} |  4 +-
 ...ry_file_descriptor_process_execution.toml} |  4 +-
 ...activity_from_memory_file_descriptor.toml} | 44 +++++----
 ...evasion_system_binary_copied_or_moved.toml | 10 +-
 ...ocess_execution_via_interactive_shell.toml |  8 +-
 ...eduled_task_unusual_command_execution.toml |  5 +-
 ...e_setcap_setuid_setgid_capability_set.toml |  6 +-
 ..._execution_via_systemd_scheduled_task.toml | 11 ++-
 ...ocal_privilege_escalation_via_unshare.toml | 56 +++++++++++
 ...tandard_path_with_root_effective_user.toml |  5 +-
 ...formation_stealer_collection_via_find.toml |  8 +-
 ...porary_directory_by_hidden_executable.toml | 16 +--
 ...suspicious_archive_creation_via_ditto.toml |  6 +-
 ...ious_image_creation_via_screencapture.toml |  7 +-
 ...squerading_via_invalid_code_signature.toml |  7 +-
 ...n_suspicious_task_for_pid_system_call.toml |  5 +-
 ...file_extracted_to_temporary_directory.toml |  5 +-
 ...en_python_script_execution_via_nodejs.toml | 69 -------------
 ...mote_javascript_evaluation_via_nodejs.toml |  6 +-
 ...tion_via_microsoft_office_application.toml |  3 +-
 ...work_connect_api_from_unbacked_memory.toml |  6 +-
 ...nsitive_file_access_cloud_credentials.toml |  5 +-
 ...on_amsi_bypass_from_suspicious_module.toml |  3 +-
 ...ess_api_activity_with_truncated_stack.toml |  3 +-
 ..._native_api_call_from_unsigned_module.toml | 12 +--
 ...tential_etw_bypass_via_virtualprotect.toml | 77 +++++++++++++++
 ...tial_suspended_process_code_injection.toml |  5 +-
 ...orer_device_access_by_unusual_process.toml |  4 +-
 ...emory_write_to_trusted_target_process.toml |  4 +-
 ...i_call_via_a_windows_installer_module.toml | 14 +--
 ...dress_discovery_via_untrusted_program.toml |  5 +-
 ...ous_api_call_from_a_powershell_script.toml |  7 +-
 ...ing_value_written_to_registry_run_key.toml |  4 +-
 39 files changed, 411 insertions(+), 188 deletions(-)
 create mode 100644 behavior/rules/linux/command_and_control_dns_request_by_suspicious_process_executable.toml
 rename behavior/rules/linux/{defense_evasion_execution_of_in_memory_file_via_interactive_session.toml => defense_evasion_execution_of_memory_file_descriptor_via_interactive_session.toml} (93%)
 rename behavior/rules/linux/{defense_evasion_in_memory_child_process_execution.toml => defense_evasion_memory_file_descriptor_child_process_execution.toml} (96%)
 rename behavior/rules/linux/{defense_evasion_in_memory_process_execution.toml => defense_evasion_memory_file_descriptor_process_execution.toml} (96%)
 rename behavior/rules/linux/{defense_evasion_network_activity_from_in_memory_file.toml => defense_evasion_network_activity_from_memory_file_descriptor.toml} (53%)
 create mode 100644 behavior/rules/linux/privilege_escalation_potential_local_privilege_escalation_via_unshare.toml
 delete mode 100644 behavior/rules/macos/execution_hidden_python_script_execution_via_nodejs.toml
 create mode 100644 behavior/rules/windows/defense_evasion_potential_etw_bypass_via_virtualprotect.toml

diff --git a/behavior/rules/linux/command_and_control_dns_request_by_suspicious_process_executable.toml b/behavior/rules/linux/command_and_control_dns_request_by_suspicious_process_executable.toml
new file mode 100644
index 00000000..b5c8e979
--- /dev/null
+++ b/behavior/rules/linux/command_and_control_dns_request_by_suspicious_process_executable.toml
@@ -0,0 +1,97 @@
+[rule]
+description = """
+This rule detects DNS requests initiated by suspicious process executables. Malware authors may use these requests to
+communicate with command and control infrastructure, exfiltrate data from the target system, or to download payloads for
+later execution.
+"""
+id = "503823dd-722f-4f23-84fc-8a6024f505f2"
+license = "Elastic License v2"
+name = "DNS Request by Suspicious Process Executable"
+os_list = ["linux"]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=10s
+  [process where event.type == "start" and event.action == "exec" and (
+    process.executable like (
+      "./*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
+      "/lost+found/*", "/var/mail/*"
+    ) or
+    process.name like ".*"
+  ) and
+  not (
+    process.executable like (
+      "./usr/bin/podman", "./", "/dev/.buildkit_qemu_emulator", "/u01/*/webtier/ohs/bin/.apachectl",
+      "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode",
+      "./usr/bin/qemu-aarch64-static"
+    ) or
+    process.parent.executable in ("/usr/bin/skopeo", "/usr/bin/buildah") or
+    process.args == "datadog-ipc-helper"
+  )]
+  [dns where event.action == "lookup_result" and dns.question.name != "localhost" and
+  not (
+    dns.question.name == "pypi.org" or
+    (process.executable like "/home/*/.elastic-ramen" and dns.question.name in ("registry.npmjs.org", "models.dev")) 
+  )
+  ]
+'''
+
+min_endpoint_version = "9.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1204"
+name = "User Execution"
+reference = "https://attack.mitre.org/techniques/T1204/"
+[[threat.technique.subtechnique]]
+id = "T1204.002"
+name = "Malicious File"
+reference = "https://attack.mitre.org/techniques/T1204/002/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "9.3.0"
diff --git a/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml b/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
index 20721180..666c4903 100644
--- a/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
+++ b/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "DNS Request to Dynamic DNS via Suspicious Executable"
 os_list = ["linux"]
 reference = ["https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/"]
-version = "1.0.3"
+version = "1.0.4"
 
 query = '''
 sequence by process.entity_id with maxspan=10s
@@ -20,18 +20,20 @@ sequence by process.entity_id with maxspan=10s
       "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
       "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
     )
-  ) and not (
+  ) and
+  not (
+    (
+      process.parent.name in ("bash", "node") and
       (
-        process.parent.name in ("bash", "node") and
-        (
-          process.working_directory in ("/usr/local/meshcentral", "/opt/meshcentral/meshcentral", "/usr/local/mesh_services/meshagent") or
-          process.parent.args in ("/usr/local/meshcentral/node_modules/meshcentral", "/home/periodic/dyndns-noip.sh")
-        )
-      ) or
+        process.working_directory in ("/usr/local/meshcentral", "/opt/meshcentral/meshcentral", "/usr/local/mesh_services/meshagent") or
+        process.parent.args in ("/usr/local/meshcentral/node_modules/meshcentral", "/home/periodic/dyndns-noip.sh")
+      )
+    ) or
     (
       process.command_line == "python3 -m app.run_scheduled_update" and
       process.parent.args == "./workflow_unified.sh"
-    )
+    ) or
+    process.executable == "/usr/bin/qbittorrent-nox"
   )]
   [dns where event.action == "lookup_result" and dns.question.name like~ (
     "*.no-ip.com", "*.no-ip.org", "*.no-ip.biz", "*.no-ip.info", "*.noip.com", "*.afraid.org", "*.changeip.com",
diff --git a/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml b/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
index e63bfc9e..09891446 100644
--- a/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
+++ b/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
@@ -7,16 +7,19 @@ id = "c14705f7-ebd3-4cf7-88b3-6bff2d832f1b"
 license = "Elastic License v2"
 name = "Hidden Executable Initiated Egress Network Connection"
 os_list = ["linux"]
-version = "1.0.6"
+version = "1.0.7"
 
 query = '''
 sequence by process.entity_id with maxspan=10s
   [process where event.type == "start" and event.action == "exec" and process.name like ".*" and
    process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and
-   not process.executable like (
-     "/home/*/.npm/_npx/*/node_modules/opencode-ai/bin/.opencode",
-     "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode"
-   )]
+   not (
+     process.executable like (
+       "/home/*/.npm/_npx/*/node_modules/opencode-ai/bin/.opencode",
+       "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode"
+     ) or
+     process.parent.executable == "/usr/bin/buildah"
+  )]
   [network where event.type == "start" and event.action == "connection_attempted" and not (
      destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
        destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
@@ -31,11 +34,26 @@ sequence by process.entity_id with maxspan=10s
 
 min_endpoint_version = "7.15.0"
 optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
 [[actions]]
 action = "kill_process"
 field = "process.parent.entity_id"
 state = 0
 
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
 [[threat]]
 framework = "MITRE ATT&CK"
 [[threat.technique]]
diff --git a/behavior/rules/linux/command_and_control_potential_linux_tunneling_and_or_port_forwarding.toml b/behavior/rules/linux/command_and_control_potential_linux_tunneling_and_or_port_forwarding.toml
index 56e82b3d..ea09aa24 100644
--- a/behavior/rules/linux/command_and_control_potential_linux_tunneling_and_or_port_forwarding.toml
+++ b/behavior/rules/linux/command_and_control_potential_linux_tunneling_and_or_port_forwarding.toml
@@ -19,7 +19,7 @@ reference = [
     "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding",
     "https://github.com/erebe/wstunnel",
 ]
-version = "1.0.3"
+version = "1.0.4"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and (
@@ -103,8 +103,12 @@ not (
     process.args like "ssh*"
   ) or
   process.parent.args == "/usr/bin/crun" or
-  process.executable in ("/usr/bin/podman", "/usr/bin/crontab", "/usr/bin/rg", "/usr/bin/ssh", "/usr/bin/autossh") or
-  process.parent.command_line == "runc init"
+  process.executable in (
+    "/usr/bin/podman", "/usr/bin/crontab", "/usr/bin/rg", "/usr/bin/ssh", "/usr/bin/autossh", "/usr/local/bin/rtk", "/usr/lib/autossh/autossh"
+  ) or
+  process.executable like "/tmp/.mount_cursor*/ripgrep/bin/rg" or
+  process.parent.command_line == "runc init" or
+  process.args == "/usr/bin/autossh"
 )
 '''
 
diff --git a/behavior/rules/linux/defense_evasion_egress_network_connection_from_deleted_executable_by_root.toml b/behavior/rules/linux/defense_evasion_egress_network_connection_from_deleted_executable_by_root.toml
index 49bdbf2c..8e771a40 100644
--- a/behavior/rules/linux/defense_evasion_egress_network_connection_from_deleted_executable_by_root.toml
+++ b/behavior/rules/linux/defense_evasion_egress_network_connection_from_deleted_executable_by_root.toml
@@ -7,7 +7,7 @@ id = "49ab63a4-ed52-49ac-855b-c298b38b0cb9"
 license = "Elastic License v2"
 name = "Egress Network Connection from Deleted Executable by Root"
 os_list = ["linux"]
-version = "1.0.16"
+version = "1.0.17"
 
 query = '''
 network where event.type == "start" and event.action == "connection_attempted" and process.executable like "* (deleted)" and 
@@ -25,7 +25,7 @@ not (
     "/var/lib/waagent/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*", "/usr/local/lib/*",
     "/usr/lib64/*", "/var/tmp/go-build*", "/app/extra/slack*", "/projects/hash-manager/dist/*/hash-manager*",
     "/nextcloud/custom_apps/notify_push/bin/x86_64/notify_push*", "/usr/local/lad/bin/mdsd*",
-    "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*/longhorn*",
+    "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*/longhorn*", "/tmp/*/bin/kilo*",
     "/root/.antigravity-server/bin/*/extensions/antigravity/bin/language_server_linux_x64*"
   ) or
   process.name in ("dockerd", "teleport", "zed-editor", "datacollector", "exe")
diff --git a/behavior/rules/linux/defense_evasion_execution_of_in_memory_file_via_interactive_session.toml b/behavior/rules/linux/defense_evasion_execution_of_memory_file_descriptor_via_interactive_session.toml
similarity index 93%
rename from behavior/rules/linux/defense_evasion_execution_of_in_memory_file_via_interactive_session.toml
rename to behavior/rules/linux/defense_evasion_execution_of_memory_file_descriptor_via_interactive_session.toml
index dc4688bd..27f7437e 100644
--- a/behavior/rules/linux/defense_evasion_execution_of_in_memory_file_via_interactive_session.toml
+++ b/behavior/rules/linux/defense_evasion_execution_of_memory_file_descriptor_via_interactive_session.toml
@@ -7,17 +7,17 @@ it via command and control.
 """
 id = "fbc224a0-5469-4c0c-953d-fc57e0293197"
 license = "Elastic License v2"
-name = "Execution of In-Memory File via Interactive Session"
+name = "Execution of Memory File Descriptor via Interactive Session"
 os_list = ["linux"]
 reference = [
     "https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
     "https://x-c3ll.github.io/posts/fileless-memfd_create/",
 ]
-version = "1.0.20"
+version = "1.0.21"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
-process.executable like "/proc/*/fd/*" and process.interactive == true and
+process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" and process.interactive == true and
 not (
   process.command_line in ("runc init", "/var/gdn/assets/linux/bin/runc init", "/usr/sbin/pfman", "lxc-attach -n rdsd.lv") or
   process.args == "datadog-ipc-helper" or
diff --git a/behavior/rules/linux/defense_evasion_in_memory_child_process_execution.toml b/behavior/rules/linux/defense_evasion_memory_file_descriptor_child_process_execution.toml
similarity index 96%
rename from behavior/rules/linux/defense_evasion_in_memory_child_process_execution.toml
rename to behavior/rules/linux/defense_evasion_memory_file_descriptor_child_process_execution.toml
index 08ca1ce3..150b4339 100644
--- a/behavior/rules/linux/defense_evasion_in_memory_child_process_execution.toml
+++ b/behavior/rules/linux/defense_evasion_memory_file_descriptor_child_process_execution.toml
@@ -6,10 +6,10 @@ child process execution is uncommon and may indicate an attempt to evade securit
 """
 id = "edc713a8-f352-4b12-ba50-b24944dfbd2d"
 license = "Elastic License v2"
-name = "In-Memory Child Process Execution"
+name = "Memory File Descriptor Child Process Execution"
 os_list = ["linux"]
 reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable like "?memfd:*" and
diff --git a/behavior/rules/linux/defense_evasion_in_memory_process_execution.toml b/behavior/rules/linux/defense_evasion_memory_file_descriptor_process_execution.toml
similarity index 96%
rename from behavior/rules/linux/defense_evasion_in_memory_process_execution.toml
rename to behavior/rules/linux/defense_evasion_memory_file_descriptor_process_execution.toml
index 343375bb..3e94c64a 100644
--- a/behavior/rules/linux/defense_evasion_in_memory_process_execution.toml
+++ b/behavior/rules/linux/defense_evasion_memory_file_descriptor_process_execution.toml
@@ -6,10 +6,10 @@ execution is uncommon and may indicate an attempt to evade security controls.
 """
 id = "de860e9f-be00-4045-ba04-ba8a5008d3b4"
 license = "Elastic License v2"
-name = "In-Memory Process Execution"
+name = "Memory File Descriptor Process Execution"
 os_list = ["linux"]
 reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
-version = "1.0.1"
+version = "1.0.2"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.executable like "?memfd:*"
diff --git a/behavior/rules/linux/defense_evasion_network_activity_from_in_memory_file.toml b/behavior/rules/linux/defense_evasion_network_activity_from_memory_file_descriptor.toml
similarity index 53%
rename from behavior/rules/linux/defense_evasion_network_activity_from_in_memory_file.toml
rename to behavior/rules/linux/defense_evasion_network_activity_from_memory_file_descriptor.toml
index 6149fa55..4379cfc8 100644
--- a/behavior/rules/linux/defense_evasion_network_activity_from_in_memory_file.toml
+++ b/behavior/rules/linux/defense_evasion_network_activity_from_memory_file_descriptor.toml
@@ -6,35 +6,37 @@ and then execute it after which is establishes outbound network connections (C2)
 """
 id = "4c8b9c6f-4d85-4fa9-9104-16f7a99aded6"
 license = "Elastic License v2"
-name = "Network Activity from In-Memory File"
+name = "Network Activity from Memory File Descriptor"
 os_list = ["linux"]
 reference = [
     "https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
     "https://x-c3ll.github.io/posts/fileless-memfd_create/",
 ]
-version = "1.0.16"
+version = "1.0.17"
 
 query = '''
 sequence by process.entity_id with maxspan=10s
-[process where event.type == "start" and event.action == "exec" and process.executable like "/proc/*/fd/*" and
- not (
-   process.args like ("/usr/lib/systemd/systemd-executor", "/nix/store/*/systemd-executor*") or
-   process.parent.executable like (
-     "/usr/sbin/runc", "/usr/bin/dockerd", "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/nix/store/*/systemd",
-     "/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas", "/usr/sbin/nordlayerd", "/sbin/init",
-     "/proc/self/fd/*/*"
-   ) or
-   process.command_line == "runc init"
- )]
-[network where event.type == "start" and event.action == "connection_attempted" and not (
-  cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
-    "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
-    "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
-    "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
-    "FE80::/10", "FF00::/8"
-   ) or
-   process.name == "check-new-release-gtk"
- )]
+  [process where event.type == "start" and event.action == "exec" and
+  process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" and
+  not (
+    process.args like ("/usr/lib/systemd/systemd-executor", "/nix/store/*/systemd-executor*") or
+    process.parent.executable like (
+      "/usr/sbin/runc", "/usr/bin/dockerd", "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/nix/store/*/systemd",
+      "/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas", "/usr/sbin/nordlayerd", "/sbin/init",
+      "/proc/self/fd/*/*"
+    ) or
+    process.command_line == "runc init"
+  )]
+  [network where event.type == "start" and event.action == "connection_attempted" and
+  not (
+    cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
+      "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
+      "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
+      "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
+      "FE80::/10", "FF00::/8"
+    ) or
+    process.name == "check-new-release-gtk"
+  )]
 '''
 
 min_endpoint_version = "8.3.0"
diff --git a/behavior/rules/linux/defense_evasion_system_binary_copied_or_moved.toml b/behavior/rules/linux/defense_evasion_system_binary_copied_or_moved.toml
index 19168823..4a401d13 100644
--- a/behavior/rules/linux/defense_evasion_system_binary_copied_or_moved.toml
+++ b/behavior/rules/linux/defense_evasion_system_binary_copied_or_moved.toml
@@ -7,7 +7,7 @@ id = "4daceba6-54be-4dfc-95ab-a4a9c19c77af"
 license = "Elastic License v2"
 name = "System Binary Copied or Moved"
 os_list = ["linux"]
-version = "1.0.15"
+version = "1.0.16"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.name in ("cp", "mv") and 
@@ -65,18 +65,20 @@ process.args in (
   process.args like ("/var/tmp/dracut.*/initramfs/*", "/var/tmp/mkinitramfs_*", "/opt/jail/driver-jail/*") or
   process.parent.args like (
     "/var/tmp/rpm-tmp*", "/usr/sbin/rear", "/usr/lib/usrmerge/convert-usrmerge", "/usr/share/initramfs-tools/hooks/zz-busybox",
-    "./libtool", "/var/lib/dpkg/info/dash.postinst", "*./libtool*", "/usr/bin/mkinitcpio"
+    "./libtool", "/var/lib/dpkg/info/dash.postinst", "*./libtool*", "/usr/bin/mkinitcpio", "/sbin/rear"
   ) or
   process.command_line in (
     "mv kubectl /usr/bin/kubectl", "mv ./kubectl /usr/bin/kubectl", "cp kubectl /usr/local/bin/kubectl",
-    "mv kubectl /usr/local/bin/kubectl", "mv ./kubectl /usr/local/bin/kubectl"
+    "mv kubectl /usr/local/bin/kubectl", "mv ./kubectl /usr/local/bin/kubectl",
+    "/usr/bin/coreutils --coreutils-prog-shebang=cp /usr/bin/cp /usr/bin/sh /tmp"
   ) or
   (process.parent.command_line like "/nix/store/*" and process.command_line == "mv /bin/.sh.tmp /bin/sh") or
   (process.parent.name == "shtool" and process.command_line == "mv /usr/local/bin/#INST@*# /usr/local/bin/php") or
   (
     process.args like "./curl.leap*.x86_64" and
     process.working_directory like "/opt/SIGOS/sitedata/exec/*"
-  )
+  ) or
+  process.parent.command_line == "/usr/bin/runc init"
 )
 '''
 
diff --git a/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml b/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
index 53656f53..acd764dc 100644
--- a/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
+++ b/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
@@ -8,7 +8,7 @@ id = "aa02591f-c9e6-4317-841e-0b075b9515ff"
 license = "Elastic License v2"
 name = "Linux Suspicious Child Process Execution via Interactive Shell"
 os_list = ["linux"]
-version = "1.0.22"
+version = "1.0.23"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.args in ("-i", "-il", "-li") and process.args_count <= 2 and
@@ -23,13 +23,15 @@ process.parent.name like (
     "/usr/scratch/xar/23e8559c/bin/python"
   ) or
   process.parent.command_line in (
-    "/bin/sh -c bash -i </dev/tty >/dev/tty 2>/dev/tty", "/bin/bash --login --posix", "bash -c sudo su - oracle; $SHELL -i"
+    "/bin/sh -c bash -i </dev/tty >/dev/tty 2>/dev/tty", "/bin/bash --login --posix", "bash -c sudo su - oracle; $SHELL -i",
+    "/bin/bash /opt/scripts/health-check.sh"
   ) or
   process.parent.command_line like (
     "/usr/scratch/*poetry shell", "*/u01/app/oracle.ahf/tfa/internal/tmp/*.sh*", "*/opt/oracle/oracle.ahf/tfa/internal/*.sh*",
     "bash -c ls -al; $SHELL -i", "bash -c cd ~/GIT/salt/pillars; $SHELL -i", "bash -c cd ~/GIT/ansible-infra; $SHELL -i",
     "bash -c cd ~/GIT/salt/states; $SHELL -i", "bash -c cd ~/GIT/puppet/hieradata; $SHELL -i",
-    "bash -c cd ~/GIT/puppet/ind_legacy; $SHELL -i"
+    "bash -c cd ~/GIT/puppet/ind_legacy; $SHELL -i",
+    """bash -c sudo -iu oracle bash -ic 'do_host P1 "hostname;/home/*/scripts/get_status;"'; $SHELL -i"""
   ) or
   process.command_line == "/opt/cursor.appimage -i" or
   process.parent.executable like (
diff --git a/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml b/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
index 30eb6afa..2f87a391 100644
--- a/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
+++ b/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
@@ -12,7 +12,7 @@ reference = [
     "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
     "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
 ]
-version = "1.0.20"
+version = "1.0.21"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.name in ("systemd", "cron", "crond") and
@@ -30,7 +30,8 @@ not (
     "sh -c ldd /var/tmp/dracut*/initramfs/usr/bin/mkfifo*",
     """/bin/sh -c curl*http://127.0.0.1:*""",
     "/bin/sh -c curl -sSL https://*/scripts/linux/syslog-archival/report_syslog_v3.sh | bash -x > /var/log/report_syslog_v3.debug.out 2>&1",
-    "*cpanel*.zendesk.com/api/v2/ticket_metrics.json*, *fortigate-backup.sh*hc-ping.com*", "/bin/sh -c /usr/bin/curl -s http://scripts.*.lan:8080/*"
+    "*cpanel*.zendesk.com/api/v2/ticket_metrics.json*, *fortigate-backup.sh*hc-ping.com*", "/bin/sh -c /usr/bin/curl -s http://scripts.*.lan:8080/*",
+    "*/ec/tr/docflow/logs/tc.session.expire*", "*get.upwind.io/sensor.sh*", "*/usr/contact/ela/bin/ela_lic_prot.py*"
   ) or
   process.command_line in (
   "/bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null",
diff --git a/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml b/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
index a9622651..85a55482 100644
--- a/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
+++ b/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
@@ -9,14 +9,16 @@ id = "c1556f07-4184-42dc-a55c-866011a63715"
 license = "Elastic License v2"
 name = "Setcap setuid/setgid Capability Set"
 os_list = ["linux"]
-version = "1.0.1"
+version = "1.0.2"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and
 process.name == "setcap" and process.command_line like "*cap_set?id+ep*" and
 not (
   process.parent.name in ("jem", "vzctl") or
-  process.args like "/usr/bin/new?idmap"
+  process.args like "/usr/bin/new?idmap" or
+  process.parent.executable like "/var/lib/dpkg/info/*.postinst" or
+  process.parent.args like "/var/lib/dpkg/info/*.postinst"
 )
 '''
 
diff --git a/behavior/rules/linux/persistence_unusual_command_execution_via_systemd_scheduled_task.toml b/behavior/rules/linux/persistence_unusual_command_execution_via_systemd_scheduled_task.toml
index f943f789..d88cf808 100644
--- a/behavior/rules/linux/persistence_unusual_command_execution_via_systemd_scheduled_task.toml
+++ b/behavior/rules/linux/persistence_unusual_command_execution_via_systemd_scheduled_task.toml
@@ -11,7 +11,7 @@ reference = [
     "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
     "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
 ]
-version = "1.0.1"
+version = "1.0.2"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.name == "systemd" and 
@@ -70,7 +70,7 @@ not (
     "/bin/sh -c curl -s https://*/retrieve-validca.sh | bash -s /data/certificate > /data/log/valica.log 2>&1 && supervisorctl apache2 reload >>/data/log/valica.log 2>&1",
     "bash -c chmod +x /opt/forticlientems/bin/ubuntu24_upgrade_check.sh && /opt/forticlientems/bin/ubuntu24_upgrade_check.sh", "/bin/sh -c /bin/chmod 777 /upload/cms-embossing/*",
     """/bin/sh -c /usr/bin/timeout 60 /bin/sh -c 'while ! /usr/bin/timeout 1 /usr/bin/host www.*.com >/dev/null 2>&1; do /bin/sleep 0.1; done' && /bin/echo "DNS works!"""",
-    "*.gr/index.php?option=com_acymailing&ctrl=cron*"
+    "*.gr/index.php?option=com_acymailing&ctrl=cron*", "*_sync_last_success_timestamp_seconds*10.10.20.204:9091/metrics*"
   ) or
   process.command_line in (
     "/bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null",
@@ -78,14 +78,17 @@ not (
     "/bin/bash -c curl -fs https://get.upwind.io/sensor.sh | bash -s -- upgrade",
     "/bin/bash -c curl -s https://get.upwind.io/sensor.sh | bash -s -- upgrade",
     "/bin/sh -c /opt/arcsight/backup_local/backup.sh || /opt/arcsight/backup_local/backup_error.sh",
-    """/usr/bin/sh -c echo date=$(date +"%Y%m%d") > /dev/shm/mag/sptwweb.env"""
+    """/usr/bin/sh -c echo date=$(date +"%Y%m%d") > /dev/shm/mag/sptwweb.env""",
+    "/bin/bash -c curl -fsSLO https://get.upwind.io/sensor.sh && echo \"$(curl -fsSL https://get.upwind.io/sensor.sh.sha256)  sensor.sh\" | sha256sum -c - && bash sensor.sh upgrade",
+    "/bin/bash -lc timeout 45 /usr/bin/claude --model claude-haiku-4-5 -p \"reply: pong\" > /tmp/claude-quota-refresh.last 2>&1 || true",
+    "/bin/sh -c echo \"$(date) $(whoami)\" >>/tmp/log"
   ) or
   process.args like (
     "[ ! -e *", "ansible *", "php -q /var/www/*php > /tmp/datastore*", "wget --proxy=off*cat*batch_trigger.log",
     "sudo curl*raw.githubusercontent.com/*/backup-scripts/refs/heads/main/fortigate-backup.sh*",
     "/usr/bin/curl -s -H*zendesk.com/api/v2/ticket_metrics.json*", "export PM2_HOME=*",    
     "/usr/bin/curl*/var/log/checkdiskusage.log", "ps*/opt/fortinet/fortisiem/linux-agent/tmp/*",
-    "iostat*/tmp/iostat.cache"
+    "iostat*/tmp/iostat.cache", "/usr/local/psa/admin/sbin/modules/aast-dnssec/event*"
   ) or 
   process.working_directory like "/opt/nessus_agent/*"
 )
diff --git a/behavior/rules/linux/privilege_escalation_potential_local_privilege_escalation_via_unshare.toml b/behavior/rules/linux/privilege_escalation_potential_local_privilege_escalation_via_unshare.toml
new file mode 100644
index 00000000..71026238
--- /dev/null
+++ b/behavior/rules/linux/privilege_escalation_potential_local_privilege_escalation_via_unshare.toml
@@ -0,0 +1,56 @@
+[rule]
+description = """
+Identifies an attempt to exploit a local privilege escalation via the unshare command. The unshare command allows a
+process to create a new namespace and set the capabilities of the process. This can be used to escalate privileges to
+root.
+"""
+id = "f483675e-1c8f-4ce4-80b3-34c646911385"
+license = "Elastic License v2"
+name = "Potential Local Privilege Escalation via Unshare"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=60s
+  [process where event.action == "exec" and event.type == "start" and 
+  process.name == "unshare" and process.args in ("-r", "-rm", "-m", "-U", "--user") and user.id != 0]
+  [process where event.action == "uid_change" and event.type == "change" and user.id == 0 and process.parent.user.id != 0]
+'''
+
+min_endpoint_version = "8.2.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1068"
+name = "Exploitation for Privilege Escalation"
+reference = "https://attack.mitre.org/techniques/T1068/"
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "8.2.0"
diff --git a/behavior/rules/linux/privilege_escalation_shell_privileged_mode_from_non_standard_path_with_root_effective_user.toml b/behavior/rules/linux/privilege_escalation_shell_privileged_mode_from_non_standard_path_with_root_effective_user.toml
index 0f62185a..0ae198ce 100644
--- a/behavior/rules/linux/privilege_escalation_shell_privileged_mode_from_non_standard_path_with_root_effective_user.toml
+++ b/behavior/rules/linux/privilege_escalation_shell_privileged_mode_from_non_standard_path_with_root_effective_user.toml
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "Shell Privileged Mode from Non-Standard Path with Root Effective User"
 os_list = ["linux"]
 reference = ["https://gtfobins.github.io/#+suid"]
-version = "1.0.1"
+version = "1.0.2"
 
 query = '''
 process where event.action == "exec" and user.name == "root" and user.Ext.real.name != "root" and
@@ -17,7 +17,8 @@ process where event.action == "exec" and user.name == "root" and user.Ext.real.n
   process.executable != null and process.parent.executable != null and 
   process.executable like ("/var/tmp/*", "/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*") and 
   not (process.executable like "/tmp/newroot/usr/bin/*" and process.parent.executable like "/tmp/newroot/bin/*") and 
-  not (process.executable like "/run/k3s/containerd/*" and process.parent.executable like "/run/k3s/containerd/*")
+  not (process.executable like "/run/k3s/containerd/*" and process.parent.executable like "/run/k3s/containerd/*") and
+  not process.executable in ("/tmp/newroot/usr/sbin/sudo", "/tmp/newroot/usr/bin/sudo")
 '''
 
 min_endpoint_version = "8.6.0"
diff --git a/behavior/rules/macos/collection_information_stealer_collection_via_find.toml b/behavior/rules/macos/collection_information_stealer_collection_via_find.toml
index 8f23c8ca..7f289b65 100644
--- a/behavior/rules/macos/collection_information_stealer_collection_via_find.toml
+++ b/behavior/rules/macos/collection_information_stealer_collection_via_find.toml
@@ -11,13 +11,13 @@ license = "Elastic License v2"
 name = "Information Stealer Collection via Find"
 os_list = ["macos"]
 reference = ["https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester"]
-version = "1.0.3"
+version = "1.0.4"
 
 query = '''
 sequence by process.entity_id with maxspan=10s
-[process where event.type == "start" and event.action == "exec" and process.name == "find" and 
-  process.args like "/Users/*/Library/Application Support/*" and process.args == "-type" and process.args == "f"]
-[file where file.extension == "txt"]
+  [process where event.type == "start" and event.action == "exec" and process.name == "find" and
+    process.args like "/Users/*/Library/Application Support/*" and process.args == "-type" and process.args == "f"]
+  [file where file.extension == "txt" and Effective_process.executable != "/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint"]
 '''
 
 min_endpoint_version = "8.16.0"
diff --git a/behavior/rules/macos/collection_potential_data_collection_in_temporary_directory_by_hidden_executable.toml b/behavior/rules/macos/collection_potential_data_collection_in_temporary_directory_by_hidden_executable.toml
index 4daf0f85..e2110c00 100644
--- a/behavior/rules/macos/collection_potential_data_collection_in_temporary_directory_by_hidden_executable.toml
+++ b/behavior/rules/macos/collection_potential_data_collection_in_temporary_directory_by_hidden_executable.toml
@@ -7,16 +7,18 @@ id = "a6994646-d314-4ee0-be1f-1d694dc969e7"
 license = "Elastic License v2"
 name = "Potential Data Collection in Temporary Directory by Hidden Executable"
 os_list = ["macos"]
-version = "1.0.7"
+version = "1.0.8"
 
 query = '''
 sequence by process.entity_id, file.path with maxspan=30s
-[file where event.action == "modification" and process.name like~ ".*" and
- file.path like ("/private/tmp/*", "/tmp/*", "/var/tmp/*") and
- not process.executable like "/nix/store/*"]
-[file where event.action == "deletion" and process.name like~ ".*" and
- file.path like ("/private/tmp/*", "/tmp/*", "/var/tmp/*") and
- not process.executable like "/nix/store/*"]
+  [file where event.action == "modification" and process.name like~ ".*" and
+   file.path like ("/private/tmp/*", "/tmp/*", "/var/tmp/*") and
+   not process.executable like "/nix/store/*" and
+   not Effective_process.executable == "/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Code - Insiders"]
+  [file where event.action == "deletion" and process.name like~ ".*" and
+   file.path like ("/private/tmp/*", "/tmp/*", "/var/tmp/*") and
+   not process.executable like "/nix/store/*" and
+   not Effective_process.executable == "/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Code - Insiders"]
 '''
 
 min_endpoint_version = "8.11.1"
diff --git a/behavior/rules/macos/collection_suspicious_archive_creation_via_ditto.toml b/behavior/rules/macos/collection_suspicious_archive_creation_via_ditto.toml
index 9a5c90a7..2470ef5b 100644
--- a/behavior/rules/macos/collection_suspicious_archive_creation_via_ditto.toml
+++ b/behavior/rules/macos/collection_suspicious_archive_creation_via_ditto.toml
@@ -11,7 +11,7 @@ reference = [
     "https://moonlock.com/atomic-macos-stealer",
     "https://medium.com/@dineshdevadoss04/breaking-down-atomic-macos-stealer-amos-8cd5eea56024",
 ]
-version = "1.0.8"
+version = "1.0.9"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.name == "ditto" and
@@ -20,7 +20,9 @@ process where event.type == "start" and event.action == "exec" and process.name
  process.args like~ "*.zip*" and
  (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) and
  not process.parent.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*", "/usr/local/Homebrew/*") and 
- not process.Ext.effective_parent.executable like ("/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon", "/opt/homebrew/*")
+ not process.Ext.effective_parent.executable like ("/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
+                                                  "/opt/homebrew/*",
+                                                  "/Applications/Ghostty.app/Contents/MacOS/ghostty")
 '''
 
 min_endpoint_version = "8.11.1"
diff --git a/behavior/rules/macos/collection_suspicious_image_creation_via_screencapture.toml b/behavior/rules/macos/collection_suspicious_image_creation_via_screencapture.toml
index 37bda6b0..1ea2d078 100644
--- a/behavior/rules/macos/collection_suspicious_image_creation_via_screencapture.toml
+++ b/behavior/rules/macos/collection_suspicious_image_creation_via_screencapture.toml
@@ -7,7 +7,7 @@ id = "0701ab8c-9abc-41e1-8af7-2d937778e73f"
 license = "Elastic License v2"
 name = "Suspicious Image Creation via ScreenCapture"
 os_list = ["macos"]
-version = "1.0.7"
+version = "1.0.8"
 
 query = '''
 sequence by process.entity_id with maxspan=10s
@@ -26,7 +26,10 @@ sequence by process.entity_id with maxspan=10s
                                                     "/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/*",
                                                     "/Applications/Codex.app/*",
                                                     "/private/var/folders/*/AppTranslocation/*/Visual Studio Code.app/*",
-                                                    "/Users/*/.local/bin/uv")]
+                                                    "/Users/*/.local/bin/uv",
+                                                    "/Applications/Warp.app/*",
+                                                    "/Applications/Obsidian.app/*",
+                                                    "/Applications/Tabby.app/*")]
 [file where event.action == "modification" and file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*")]
 '''
 
diff --git a/behavior/rules/macos/defense_evasion_potential_binary_masquerading_via_invalid_code_signature.toml b/behavior/rules/macos/defense_evasion_potential_binary_masquerading_via_invalid_code_signature.toml
index 4e314915..baab522f 100644
--- a/behavior/rules/macos/defense_evasion_potential_binary_masquerading_via_invalid_code_signature.toml
+++ b/behavior/rules/macos/defense_evasion_potential_binary_masquerading_via_invalid_code_signature.toml
@@ -8,11 +8,14 @@ id = "4154c8ce-c718-4641-80db-a6a52276f1a4"
 license = "Elastic License v2"
 name = "Potential Binary Masquerading via Invalid Code Signature"
 os_list = ["macos"]
-version = "1.0.39"
+version = "1.0.40"
 
 query = '''
 process where event.action == "exec" and
- process.name like ("com.apple.*", "com.jamf.*", "jamf*", "zoom.us") and
+ (
+   process.name like ("com.apple.*", "com.jamf.*", "jamf*", "zoom.us") or 
+   process.executable like "/Users/*/Library/com.apple.*"
+  ) and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and
  not (process.code_signature.subject_name in ("Software Signing", "com.apple.WebKit.Networking", "com.apple.WebKit.WebContent") and
       process.name in
diff --git a/behavior/rules/macos/defense_evasion_suspicious_task_for_pid_system_call.toml b/behavior/rules/macos/defense_evasion_suspicious_task_for_pid_system_call.toml
index fda36028..b279e474 100644
--- a/behavior/rules/macos/defense_evasion_suspicious_task_for_pid_system_call.toml
+++ b/behavior/rules/macos/defense_evasion_suspicious_task_for_pid_system_call.toml
@@ -15,7 +15,7 @@ reference = [
     "https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/",
     "https://wojciechregula.blog/post/learn-xpc-exploitation-part-3-code-injections/",
 ]
-version = "1.0.37"
+version = "1.0.38"
 
 query = '''
 process where event.action == "process_open" and
@@ -35,7 +35,8 @@ process where event.action == "process_open" and
    startswith~(process.executable, Target.process.executable)) and 
   not process.hash.sha256 : ("d41e02b5366b186a237f33150baa7c5ef4747ba06646a193ab9ba5125fc6ef7a",
                              "bee1a00ffb1c4b7c2c4784a1fdcb849dc7853b9deb5173ff4c5a08209c84bc26",
-                             "6ac6f81d80afff9b6ee9d3608d9964566a39188d0166ae867df97c624e632b98") and 
+                             "6ac6f81d80afff9b6ee9d3608d9964566a39188d0166ae867df97c624e632b98",
+                             "8698f4e54c64667c4a4c7ccde3fbcd7babc6478a5e8e22732732f633cc2fc499") and 
   not (process.executable like "/Users/*/micromamba/envs/grid/bin/python*" and Target.process.executable in ("/bin/bash", "/usr/bin/which", "/usr/bin/uname")) and
   not (process.executable like "/Users/*/.local/share/uv/python/cpython-*-macos-aarch64-none/bin/python*" and Target.process.executable like "/Users/*/Code/eis-ray/.venv/lib/python*/site-packages/ray/core/src/ray/gcs/gcs_server") and 
   not (process.executable like "/Users/*/anaconda?/bin/python*" and Target.process.executable like "/Users/*/anaconda?/envs/python*/bin/python*")
diff --git a/behavior/rules/macos/execution_executable_file_extracted_to_temporary_directory.toml b/behavior/rules/macos/execution_executable_file_extracted_to_temporary_directory.toml
index 838fed1c..4608bebf 100644
--- a/behavior/rules/macos/execution_executable_file_extracted_to_temporary_directory.toml
+++ b/behavior/rules/macos/execution_executable_file_extracted_to_temporary_directory.toml
@@ -11,7 +11,7 @@ os_list = ["macos"]
 reference = [
     "https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs/?utm_source=twitter&utm_medium=social&utm_campaign=blog-promo&utm_content=2023-02-23_shared_",
 ]
-version = "1.0.36"
+version = "1.0.37"
 
 query = '''
 file where event.action != "deletion" and 
@@ -28,7 +28,8 @@ file where event.action != "deletion" and
                                       "/Library/Developer/PrivateFrameworks/CoreSimulator.framework/Versions/A/XPCServices/SimulatorTrampoline.xpc/Contents/MacOS/SimulatorTrampoline",
                                       "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                       "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
-                                      "/opt/jc/bin/jumpcloud-agent")
+                                      "/opt/jc/bin/jumpcloud-agent",
+                                      "/Library/Iru/Iru Agent.app/Contents/Helpers/Iru Library Manager.app/Contents/MacOS/kandji-library-manager")
 '''
 
 min_endpoint_version = "8.10.2"
diff --git a/behavior/rules/macos/execution_hidden_python_script_execution_via_nodejs.toml b/behavior/rules/macos/execution_hidden_python_script_execution_via_nodejs.toml
deleted file mode 100644
index 0ecd7529..00000000
--- a/behavior/rules/macos/execution_hidden_python_script_execution_via_nodejs.toml
+++ /dev/null
@@ -1,69 +0,0 @@
-[rule]
-description = """
-Detects when Node spawns Python in order to execute a hidden Python script in the /Users directory on macOS. North
-Korean threat groups have been observed distributing malicious Nodejs applications that unpack a malicious Python script
-in the current users home directory and execute it in order to download and execute a follow on second stage payload.
-"""
-id = "235f605a-3d3e-4c00-bed9-58d068ccca13"
-license = "Elastic License v2"
-name = "Hidden Python Script Execution via Nodejs"
-os_list = ["macos"]
-reference = ["https://x.com/dimitribest/status/1782609281897902426"]
-version = "1.0.4"
-
-query = '''
-process where event.type == "start" and event.action == "exec" and 
- process.args like~ "python*" and process.args like~ ("/Users/*/.*", "/tmp/.*", "/private/tmp/.*") and 
- process.args_count == 2 and process.name like~ "python*" and process.parent.name == "node" and
- not process.args like~ ("/Users/*/.vscode/*", "/Users/*/.claude/*")
-'''
-
-min_endpoint_version = "8.10.2"
-optional_actions = []
-[[actions]]
-action = "kill_process"
-field = "process.entity_id"
-state = 0
-
-[[actions]]
-action = "kill_process"
-field = "process.parent.entity_id"
-state = 0
-
-[[threat]]
-framework = "MITRE ATT&CK"
-[[threat.technique]]
-id = "T1059"
-name = "Command and Scripting Interpreter"
-reference = "https://attack.mitre.org/techniques/T1059/"
-[[threat.technique.subtechnique]]
-id = "T1059.006"
-name = "Python"
-reference = "https://attack.mitre.org/techniques/T1059/006/"
-
-[[threat.technique.subtechnique]]
-id = "T1059.007"
-name = "JavaScript"
-reference = "https://attack.mitre.org/techniques/T1059/007/"
-
-
-
-[threat.tactic]
-id = "TA0002"
-name = "Execution"
-reference = "https://attack.mitre.org/tactics/TA0002/"
-[[threat]]
-framework = "MITRE ATT&CK"
-[[threat.technique]]
-id = "T1105"
-name = "Ingress Tool Transfer"
-reference = "https://attack.mitre.org/techniques/T1105/"
-
-
-[threat.tactic]
-id = "TA0011"
-name = "Command and Control"
-reference = "https://attack.mitre.org/tactics/TA0011/"
-
-[internal]
-min_endpoint_version = "8.10.2"
diff --git a/behavior/rules/macos/execution_suspicious_remote_javascript_evaluation_via_nodejs.toml b/behavior/rules/macos/execution_suspicious_remote_javascript_evaluation_via_nodejs.toml
index e43e4da5..1883ca55 100644
--- a/behavior/rules/macos/execution_suspicious_remote_javascript_evaluation_via_nodejs.toml
+++ b/behavior/rules/macos/execution_suspicious_remote_javascript_evaluation_via_nodejs.toml
@@ -9,12 +9,14 @@ license = "Elastic License v2"
 name = "Suspicious Remote Javascript Evaluation via Nodejs"
 os_list = ["macos"]
 reference = ["https://kl4r10n.tech/blog/dprk-new-malware"]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 sequence with maxspan=20s
 [network where event.action == "connection_attempted" and process.name == "node" and
-  not destination.domain in ("registry.npmjs.org", "classic.yarnpkg.com")] by process.entity_id
+  not destination.domain in ("registry.npmjs.org", "classic.yarnpkg.com", "platform.claude.com", "api.anthropic.com", "registry.yarnpkg.com", "api.z.ai", 
+                             "telemetry.nuxt.com", "api.fontshare.com", "yarnpkg.com", "telemetry-staging.elastic.co", "elastic.litellm-prod.ai", 
+                             "chatgpt.com", "bedrock-runtime.us-east-1.amazonaws.com")] by process.entity_id
 [process where event.type == "start" and event.action == "exec" and process.name == "node" and
  process.args == "-e" and process.args_count == 3 and
  not process.command_line : ("*try*require*postinstall*catch*", "*import*postinstall*catch*")] by process.parent.entity_id
diff --git a/behavior/rules/macos/initial_access_initial_access_or_execution_via_microsoft_office_application.toml b/behavior/rules/macos/initial_access_initial_access_or_execution_via_microsoft_office_application.toml
index 2f07adf8..0d7e8b0d 100644
--- a/behavior/rules/macos/initial_access_initial_access_or_execution_via_microsoft_office_application.toml
+++ b/behavior/rules/macos/initial_access_initial_access_or_execution_via_microsoft_office_application.toml
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Initial Access or Execution via Microsoft Office Application"
 os_list = ["macos"]
 reference = ["https://objective-see.com/blog/blog_0x4B.html"]
-version = "1.0.40"
+version = "1.0.41"
 
 query = '''
 process where event.action == "exec" and
@@ -74,6 +74,7 @@ process where event.action == "exec" and
           "/usr/sbin/networksetup"
         ) and
    not (process.name == "sh" and process.command_line like~ "*$CFFIXED_USER_HOME/.zoteroIntegrationPipe*") and
+   not (process.name in ("sh", "bash", "curl") and process.command_line like~ "*http://127.0.0.1:6969/binary*ppShuttle_*.bin*") and
    not process.Ext.effective_parent.executable like~ (
         "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
         "/Applications/Docker.app/Contents/MacOS/com.docker.backend",
diff --git a/behavior/rules/windows/command_and_control_network_connect_api_from_unbacked_memory.toml b/behavior/rules/windows/command_and_control_network_connect_api_from_unbacked_memory.toml
index 39152f9a..7f80aa15 100644
--- a/behavior/rules/windows/command_and_control_network_connect_api_from_unbacked_memory.toml
+++ b/behavior/rules/windows/command_and_control_network_connect_api_from_unbacked_memory.toml
@@ -7,7 +7,7 @@ id = "720e0265-03bc-4cb7-9116-7fad5ea9cdfc"
 license = "Elastic License v2"
 name = "Network Connect API from Unbacked Memory"
 os_list = ["windows"]
-version = "1.0.16"
+version = "1.0.17"
 
 query = '''
 api where process.Ext.api.name == "connect" and process.Ext.api.summary: "*ipv4*" and
@@ -87,7 +87,9 @@ api where process.Ext.api.name == "connect" and process.Ext.api.summary: "*ipv4*
                                    "f834e4447d0b4c421ac2a0a9b10304a47688f358a6db9c1281bffe44957bcc4e",
                                    "d0615bcbcaf0c64b2613c224924fce9e891a62287acc243a9b142ee0d021b207",
                                    "7c71327ab87990b1ac0446813f2f1e69c33cc634afab5857cfa9fca17d0cc37e",
-                                   "ecbd9f72fe48043302f547643b26e2da9c12c4d8030d28e53f1651fb0e06a2ca") and
+                                   "ecbd9f72fe48043302f547643b26e2da9c12c4d8030d28e53f1651fb0e06a2ca",
+                                   "c11d8f8d419aee8d67166ae9eeed3999364fa41a7d701ede076f2d2ad8acb8be",
+                                   "ad71a3681f0fa629133a67f04d64c626d995da07d04322238aa4997a2671735a") and
 
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
                   $entry.callsite_trailing_bytes :
diff --git a/behavior/rules/windows/credential_access_sensitive_file_access_cloud_credentials.toml b/behavior/rules/windows/credential_access_sensitive_file_access_cloud_credentials.toml
index 09d8854b..2f6fcb30 100644
--- a/behavior/rules/windows/credential_access_sensitive_file_access_cloud_credentials.toml
+++ b/behavior/rules/windows/credential_access_sensitive_file_access_cloud_credentials.toml
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Sensitive File Access - Cloud Credentials"
 os_list = ["windows"]
 reference = ["https://github.com/GhostPack/Seatbelt"]
-version = "1.0.34"
+version = "1.0.35"
 
 query = '''
 sequence by process.entity_id with maxspan=5m
@@ -46,6 +46,9 @@ sequence by process.entity_id with maxspan=5m
                  "?:\\users\\*\\AppData\\*\\gcloud\\access_tokens.db",
                  "?:\\users\\*\\.azure\\accessTokens.json",
                  "?:\\users\\*\\.azure\\azureProfile.json",
+                 "?:\\users\\*\\.azure\\msal_token_cache.json",
+                 "?:\\users\\*\\.azure\\msal_token_cache.bin",
+                 "?:\\users\\*\\.azure\\msal_http_cache.bin",
                  "?:\\users\\*\\.aws\\credentials",
                  "?:\\Users\\*\\.config\\git\\credentials")]
 '''
diff --git a/behavior/rules/windows/defense_evasion_amsi_bypass_from_suspicious_module.toml b/behavior/rules/windows/defense_evasion_amsi_bypass_from_suspicious_module.toml
index ce2b56ef..0c1058ee 100644
--- a/behavior/rules/windows/defense_evasion_amsi_bypass_from_suspicious_module.toml
+++ b/behavior/rules/windows/defense_evasion_amsi_bypass_from_suspicious_module.toml
@@ -11,7 +11,7 @@ reference = [
     "https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
     "https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
 ]
-version = "1.0.7"
+version = "1.0.8"
 
 query = '''
 api where process.Ext.api.metadata.target_address_name like "amsi.dll*" and
@@ -52,6 +52,7 @@ api where process.Ext.api.metadata.target_address_name like "amsi.dll*" and
                                       "c:\\windows\\assembly\\nativeimages_*.ni.dll",
                                       "c:\\windows\\winsxs\\temp\\pendingdeletes\\$$deleteme*",
                                       "c:\\windows\\system32\\mrt\\*\\mpengine.dll",
+                                      "c:\\windows\\system32\\wbem\\fastprox.dll",
                                       "c:\\windows\\winsxs\\*.dll",
                                       "c:\\program files (x86)\\*",
                                       "c:\\program files\\*",
diff --git a/behavior/rules/windows/defense_evasion_cross_process_api_activity_with_truncated_stack.toml b/behavior/rules/windows/defense_evasion_cross_process_api_activity_with_truncated_stack.toml
index 78a5fd62..c1e1b1e1 100644
--- a/behavior/rules/windows/defense_evasion_cross_process_api_activity_with_truncated_stack.toml
+++ b/behavior/rules/windows/defense_evasion_cross_process_api_activity_with_truncated_stack.toml
@@ -7,7 +7,7 @@ id = "002d9a6d-c09e-4d3f-a1c1-05b92dbdbb67"
 license = "Elastic License v2"
 name = "Cross Process API Activity with Truncated Stack"
 os_list = ["windows"]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 api where process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors == "truncated_stack" and
@@ -24,6 +24,7 @@ api where process.Ext.api.behaviors == "cross-process" and process.Ext.api.behav
                            "C:\\Program Files (x86)\\Adobe\\Acrobat *\\Acrobat\\AcroRd32.exe",
                            "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
                            "C:\\Program Files\\Git\\usr\\bin\\sh.exe",
+                           "C:\\Program Files\\Git\\usr\\bin\\mintty.exe",
                            "C:\\Program Files\\ESET\\ESET Security\\ekrn.exe",
                            "C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
                            "C:\\Program Files (x86)\\Globus Connect Personal\\bin\\ext\\relaytool.exe") and
diff --git a/behavior/rules/windows/defense_evasion_native_api_call_from_unsigned_module.toml b/behavior/rules/windows/defense_evasion_native_api_call_from_unsigned_module.toml
index cd7823c4..3d801431 100644
--- a/behavior/rules/windows/defense_evasion_native_api_call_from_unsigned_module.toml
+++ b/behavior/rules/windows/defense_evasion_native_api_call_from_unsigned_module.toml
@@ -7,7 +7,7 @@ id = "27202cd8-c5a6-4b82-9bb8-f3da69a4d5d3"
 license = "Elastic License v2"
 name = "Native API Call from Unsigned Module"
 os_list = ["windows"]
-version = "1.0.10"
+version = "1.0.11"
 
 query = '''
 api where
@@ -98,16 +98,14 @@ $entry.subject_name in (
 )) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info like
-                                     ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
-                                      "c:\\windows\\sys?????\\ntdll.dll!LdrResolveDelayLoadedAPI*",
-                                      "c:\\windows\\sys?????\\ntdll.dll!LdrGetProcedureAddress*",
-                                      "c:\\windows\\sys?????\\ntdll.dll!RtlAllocateHeap*",
+                                     ("c:\\windows\\*\\ntdll.dll!Ldr*",
+                                      "c:\\windows\\*\\ntdll.dll!RtlAllocateHeap*",
                                       "c:\\windows\\sys?????\\ntdll.dll!RtlFreeHeap*",
                                       "c:\\windows\\sys?????\\ntdll.dll!RtlReAllocateHeap*",
                                       "c:\\windows\\sys?????\\ntdll.dll!RtlUnlockHeap*",
-                                      "c:\\windows\\sys?????\\ntdll.dll!LdrInitializeThunk*",
                                       "c:\\windows\\sys?????\\ntdll.dll+0x*")) and
-not (process.executable : "\\\\?\\Volume{*}\\*.exe" and process.thread.Ext.call_stack_final_user_module.path like "?:\\*\\docker\\*\\windows\\*")
+not (process.executable : "\\\\?\\Volume{*}\\*.exe" and process.thread.Ext.call_stack_final_user_module.path like "?:\\*\\docker\\*\\windows\\*") and 
+not process.thread.Ext.call_stack_summary like ("ntdll.dll|libpcre*.dll|libgobject-*.dll|ntdll.dll", "ntdll.dll|libffi-*.dll|libpython*.dll|ntdll.dll")
 '''
 
 min_endpoint_version = "8.16.3"
diff --git a/behavior/rules/windows/defense_evasion_potential_etw_bypass_via_virtualprotect.toml b/behavior/rules/windows/defense_evasion_potential_etw_bypass_via_virtualprotect.toml
new file mode 100644
index 00000000..d51c4ed9
--- /dev/null
+++ b/behavior/rules/windows/defense_evasion_potential_etw_bypass_via_virtualprotect.toml
@@ -0,0 +1,77 @@
+[rule]
+description = """
+Identifies attempts to change the memory page permissions of Event Tracing for Windows (ETW) functions in ntdll.dll to
+make them writable from an unsigned or suspicious module. This is a precursor to patching those functions via a raw
+pointer write, which can disable ETW-based telemetry and evade security tooling that relies on it.
+"""
+id = "a26e8618-136d-4988-a8a7-eb45d5f1d468"
+license = "Elastic License v2"
+name = "Potential ETW Bypass via VirtualProtect"
+os_list = ["windows"]
+reference = [
+    "https://blog.xpnsec.com/hiding-your-dotnet-etw/",
+    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
+]
+version = "1.0.3"
+
+query = '''
+api where process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx") and
+ process.Ext.api.metadata.target_address_name like ("ntdll.dll!Etw*", "ntdll.dll!NtTrace*") and
+ process.Ext.api.parameters.protection like "?W*" and
+ process.executable != null and
+ process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and 
+ not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined") and
+ not (process.executable : "?:\\Program Files\\Microsoft Visual Studio\\*\\IDE\\devenv.exe" and 
+      process.Ext.api.metadata.target_address_name like ("ntdll.dll!EtwUnregisterTraceGuid*", "ntdll.dll!EtwRegisterTraceGuids*")) and 
+ not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\system32\\ntdll.dll!Ldr*", "c:\\program files\\microsoft sql server management studio*\\ide\\ssms.exe!SetOnAssertCallback*")) and 
+ not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
+                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
+                                          "Microsoft Windows Software Compatibility Publisher",
+                                          "Palo Alto Networks", "Sentinel Labs, Inc.",
+                                          "Microsoft Corporation", 
+                                          "Check Point Software Technologies Ltd.", 
+                                          "ESET, spol. s r.o.",
+                                          "Promon AS",
+                                          "SAP",
+                                          "NOVASYNC LABS PTE. LTD.",
+                                          "Tonalio GmbH",
+                                          "SentinelOne Inc.",
+                                          "JetBrains s.r.o.",
+                                          "Safetica a.s.",
+                                          "ModuleWorks GmbH",
+                                          "Star Finanz-Software Entwicklung und Vertriebs GmbH", 
+                                          "TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED, TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED")) and 
+  not (process.executable like "C:\\Program Files (x86)\\SFirmV*\\SFEbicsWorker.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path == "c:\\windows\\system32\\rundll32.exe") and 
+  not (process.parent.executable like "C:\\Program Files (x86)\\StarMoney*\\app\\StarMoney.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path == "c:\\windows\\system32\\rundll32.exe") and 
+  process.thread.Ext.call_stack_final_user_module.protection_provenance_path != "c:\\windows\\syswow64\\icu.dll" and 
+  not (process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\syswow64\\combase.dll" and process.Ext.api.summary == "VirtualProtect( ntdll.dll!EtwEventRegister, 0x5, RWX, R-X )")
+'''
+
+min_endpoint_version = "8.16.3"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+tree = true
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "8.16.3"
diff --git a/behavior/rules/windows/defense_evasion_potential_suspended_process_code_injection.toml b/behavior/rules/windows/defense_evasion_potential_suspended_process_code_injection.toml
index 37f8fd44..6235acbd 100644
--- a/behavior/rules/windows/defense_evasion_potential_suspended_process_code_injection.toml
+++ b/behavior/rules/windows/defense_evasion_potential_suspended_process_code_injection.toml
@@ -7,7 +7,7 @@ id = "47167118-ba42-48e8-8555-dd50d98d21c4"
 license = "Elastic License v2"
 name = "Potential Suspended Process Code Injection"
 os_list = ["windows"]
-version = "1.0.15"
+version = "1.0.16"
 
 query = '''
 api where process.Ext.api.name  == "WriteProcessMemory" and
@@ -17,7 +17,8 @@ api where process.Ext.api.name  == "WriteProcessMemory" and
  Target.process.Ext.created_suspended == true and process.Ext.api.behaviors == "cross-process" and
 
  /* WPM triggers multiple times at process creation */
- not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*")) and
+ not _arraysearch(process.thread.Ext.call_stack, $entry, 
+                  $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*", "c:\\windows\\*\\advapi32.dll!CreateProcessAsUser*")) and
  not (process.Ext.api.summary like ("*PEB*", "*PEB32*",  "*ProcessStartupInfo*") and process.thread.Ext.call_stack_summary like "*Unknown*") and
 
  /* unsigned or untrusted code signature */
diff --git a/behavior/rules/windows/defense_evasion_process_explorer_device_access_by_unusual_process.toml b/behavior/rules/windows/defense_evasion_process_explorer_device_access_by_unusual_process.toml
index fa8db969..5afb84c6 100644
--- a/behavior/rules/windows/defense_evasion_process_explorer_device_access_by_unusual_process.toml
+++ b/behavior/rules/windows/defense_evasion_process_explorer_device_access_by_unusual_process.toml
@@ -7,7 +7,7 @@ id = "9c4bd6d6-9e2f-4ce2-8266-923e1799726c"
 license = "Elastic License v2"
 name = "Process Explorer Device Access by Unusual Process"
 os_list = ["windows"]
-version = "1.0.7"
+version = "1.0.8"
 
 query = '''
 api where
@@ -17,7 +17,7 @@ api where
   not (process.thread.Ext.call_stack_final_user_module.name : ("procexp64.exe", "procexp.exe", "handle64.exe", "handle.exe") and
        _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller, $caller.trusted == true and
                      $caller.subject_name : "Microsoft Corporation")) and
-  not (process.name : ("procexp64.exe", "procexp.exe", "Handle64.exe", "Handle.exe") and process.code_signature.subject_name : "Microsoft Corporation" and
+  not (process.name : ("procexp64.exe", "procexp.exe", "Handle64.exe", "Handle.exe", "procexp64a.exe") and process.code_signature.subject_name : "Microsoft Corporation" and
        process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined") and process.code_signature.trusted == true) and
   not (process.thread.Ext.call_stack_final_user_module.name : ("procexp64.exe", "procexp.exe", "handle64.exe") and
        process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
diff --git a/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml b/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
index e4707098..42a44784 100644
--- a/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
+++ b/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
@@ -7,7 +7,7 @@ id = "5c6c166c-a894-4263-918a-c7632014a486"
 license = "Elastic License v2"
 name = "Remote Memory Write to Trusted Target Process"
 os_list = ["windows"]
-version = "1.0.13"
+version = "1.0.14"
 
 query = '''
 api where process.Ext.api.name == "WriteProcessMemory" and
@@ -24,6 +24,8 @@ api where process.Ext.api.name == "WriteProcessMemory" and
  not (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*"))
       and process.Ext.api.summary like ("*PEB*", "*PEB32*",  "*ProcessStartupInfo*")) and
 
+ not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!Ldr*") and 
+
  not (process.Ext.api.summary like ("*PEB*", "*PEB32*",  "*ProcessStartupInfo*") and
       process.thread.Ext.call_stack_summary like "ntdll.dll|*Unknown*") and
 
diff --git a/behavior/rules/windows/defense_evasion_suspicious_api_call_via_a_windows_installer_module.toml b/behavior/rules/windows/defense_evasion_suspicious_api_call_via_a_windows_installer_module.toml
index fe4d7643..6d68ef83 100644
--- a/behavior/rules/windows/defense_evasion_suspicious_api_call_via_a_windows_installer_module.toml
+++ b/behavior/rules/windows/defense_evasion_suspicious_api_call_via_a_windows_installer_module.toml
@@ -7,7 +7,7 @@ id = "43e9d254-28e9-463d-9bc3-5e51721d4b8a"
 license = "Elastic License v2"
 name = "Suspicious API call via a Windows Installer Module"
 os_list = ["windows"]
-version = "1.0.10"
+version = "1.0.11"
 
 query = '''
 api where process.name : "msiexec.exe" and
@@ -19,12 +19,11 @@ api where process.name : "msiexec.exe" and
    /* noisy patterns - VP and WPM due to Image Load and Process Creation */
    not (process.Ext.api.metadata.target_address_name in ("ProcessStartupInfo", "PEB", "PEB32", "Data") and process.Ext.api.parameters.size <= 4544) and
    not _arraysearch(process.thread.Ext.call_stack, $entry,
-                    $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
-                                             "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*",
-                                             "c:\\windows\\sys?????\\ntdll.dll!LdrUnloadDll*",
-                                             "c:\\windows\\sys?????\\ntdll.dll!LdrResolveDelayLoadedAPI*",
-                                             "c:\\windows\\system32\\ntdll.dll!LdrGetProcedureAddress*",
-                                             "?:\\windows\\sys?????\\kernelbase.dll!CreateProcess*")) and
+                    $entry.symbol_info like ("c:\\windows\\*\\ntdll.dll!Ldr*",
+                                             "c:\\windows\\*\\kernelbase.dll!LoadLibrary*",
+                                             "?:\\windows\\*\\kernelbase.dll!CreateProcess*", 
+                                             "c:\\windows\\system32\\ntdll.dll!wcsnlen+*", 
+                                             "c:\\windows\\system32\\kernelbase.dll!GetProductInfo*")) and
    not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.callsite_trailing_bytes in ("5a8bf850528b338b432003c28b08894b208b431c03c28b08894b1c03f28b4b0c03ca8d431c505756ffd15a580343088bf8528bf08b46fc83c0042bf08956088b")) and
    not (process.Ext.api.metadata.target_address_path like "c:\\windows\\syswow64\\*.dll" and process.Ext.api.parameters.size <= 4096) and
@@ -35,6 +34,7 @@ api where process.name : "msiexec.exe" and
                                           ("85da69c82e3d1faff1e60e6853e30230fc5e3b64faf4245e20089fe75912d910",
                                            "09e957a1d31b9cf8666add20613bf60b6a2d294586f8887961cc6a0e24680fb8",
                                            "3c60786fddc7fb00b2dab7bd2b6c33340e07c73ea8e3d6c47754bb9d15d83166",
+                                           "e10c6189c60b9bc3b0e2603930b55eda886e0de4520b0c8ba7f060fbf3b30549",
                                            /* Kaspersky  */
                                            "0c9891da5c64a519c11e7603a41e93e0ff3057cca238ee59ffb5b4a82985011a",
                                            "80f84a7b8aad0bdceba677e6a501f71b6b57878e34b6b557e1892083a32b7bd5",
diff --git a/behavior/rules/windows/discovery_external_ip_address_discovery_via_untrusted_program.toml b/behavior/rules/windows/discovery_external_ip_address_discovery_via_untrusted_program.toml
index 2c1f572b..fb11f108 100644
--- a/behavior/rules/windows/discovery_external_ip_address_discovery_via_untrusted_program.toml
+++ b/behavior/rules/windows/discovery_external_ip_address_discovery_via_untrusted_program.toml
@@ -7,7 +7,7 @@ id = "dfe28e03-9b0b-47f5-9753-65ed2666663f"
 license = "Elastic License v2"
 name = "External IP Address Discovery via Untrusted Program"
 os_list = ["windows"]
-version = "1.0.43"
+version = "1.0.44"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
@@ -48,7 +48,8 @@ sequence by process.entity_id with maxspan=1m
                     "821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431",
                     "0b7161d83ea48142a8593ad721a1546440fcbe09fb83cf644fecd456e3a0c38e",
                     "ef1941d82bb658e614b9857493bb2e0eedf14f619d28404294628d136573b3cd",
-                    "96ada02d961dcfacb396a911c495073887d8bd2a0dda4b491294c573e76af750")]
+                    "96ada02d961dcfacb396a911c495073887d8bd2a0dda4b491294c573e76af750", 
+                    "f60c5057286d6f5ca454be1f59f519e6480111868b52a70af1c3ff1b6e736f4b")]
   [dns where
     dns.question.name :
          (
diff --git a/behavior/rules/windows/execution_suspicious_api_call_from_a_powershell_script.toml b/behavior/rules/windows/execution_suspicious_api_call_from_a_powershell_script.toml
index 46620618..e006afd3 100644
--- a/behavior/rules/windows/execution_suspicious_api_call_from_a_powershell_script.toml
+++ b/behavior/rules/windows/execution_suspicious_api_call_from_a_powershell_script.toml
@@ -4,7 +4,7 @@ id = "6ad0c702-ddf0-4631-ac43-37eeea444ee6"
 license = "Elastic License v2"
 name = "Suspicious API Call from a PowerShell Script"
 os_list = ["windows"]
-version = "1.0.22"
+version = "1.0.23"
 
 query = '''
 api where
@@ -105,9 +105,8 @@ not _arraysearch(process.thread.Ext.call_stack, $entry,
                                                       "8bf0488b4c2428488bf9488bcf488bf985f67479*")) and
 not (process.Ext.api.name in ("VirtualProtect", "VirtualAlloc") and
      _arraysearch(process.thread.Ext.call_stack, $entry,
-                  $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
-                                           "c:\\windows\\sys?????\\ntdll.dll!LdrGetDllHandle*",
-                                           "c:\\windows\\system32\\ntdll.dll!LdrResolveDelayLoadedAPI*",
+                  $entry.symbol_info like ("c:\\windows\\sy*\\ntdll.dll!Ldr*",
+                                           "c:\\windows\\sy*\\kernelbase.dll!PackageSidFromProductId",
                                            "c:\\windows\\sys?????\\ntdll.dll!RtlAllocateHeap*",
                                            "c:\\windows\\sys?????\\dbgeng.dll!DebugCreateEx*",
                                            "c:\\windows\\system32\\ntdll.dll!LdrGetProcedureAddress*",
diff --git a/behavior/rules/windows/persistence_suspicious_string_value_written_to_registry_run_key.toml b/behavior/rules/windows/persistence_suspicious_string_value_written_to_registry_run_key.toml
index 90df5e31..c6046631 100644
--- a/behavior/rules/windows/persistence_suspicious_string_value_written_to_registry_run_key.toml
+++ b/behavior/rules/windows/persistence_suspicious_string_value_written_to_registry_run_key.toml
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "Suspicious String Value Written to Registry Run Key"
 os_list = ["windows"]
 reference = ["https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"]
-version = "1.0.41"
+version = "1.0.42"
 
 query = '''
 registry where registry.data.strings != null and process.executable != null and
@@ -90,6 +90,8 @@ registry where registry.data.strings != null and process.executable != null and
              "*:\\Users\\*\\Pictures\\*",
              "*:\\Users\\*\\Music\\*",
              "*:\\Users\\*\\Pictures\\*",
+			 "?:\\Users\\*\\Downloads\\*",
+             "?:\\Users\\*\\Desktop\\*",
              "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
              "\\\\*.exe",
              "*javaw.exe* -jar *") and not