From 5d716fbaf525d8e1afc7a91da78dfd25f80840f4 Mon Sep 17 00:00:00 2001
From: protectionsmachine
 <72879786+protectionsmachine@users.noreply.github.com>
Date: Thu, 7 May 2026 10:09:15 +0000
Subject: [PATCH] Updating artifacts

---
 ..._of_github_actions_runner_process_pid.toml |  93 ++++++
 ...l_reverse_shell_activity_via_terminal.toml |   6 +-
 ...ious_interpreter_execution_from_stdin.toml |  79 +++++
 ...multi_value_secret_searching_via_grep.toml | 120 ++++++++
 ...equest_by_recently_created_executable.toml | 100 +++++++
 ...l_dns_request_to_crypto_miner_service.toml | 130 +++++++++
 ...dynamic_dns_via_suspicious_executable.toml |  92 ++++++
 ...spicious_file_upload_download_service.toml | 110 +++++++
 ...ork_traffic_tunneling_via_proxychains.toml |  47 +++
 ...to_clear_kernel_ring_buffer_via_dmesg.toml |  60 ++++
 ..._attempt_to_clear_logs_via_journalctl.toml |  64 +++++
 ...ion_attempt_to_disable_auditd_service.toml |  60 ++++
 ...se_evasion_attempt_to_disable_selinux.toml |  54 ++++
 ..._decoded_payload_piped_to_interpreter.toml |   8 +-
 ...on_multiple_system_log_files_deletion.toml |  98 +++++++
 ...asion_potential_disabling_of_apparmor.toml |  59 ++++
 ...tion_via_process_environment_variable.toml |   5 +-
 ...cious_binary_execution_via_path_alias.toml |  58 ++++
 ..._filter_applied_using_traffic_control.toml |  68 +++++
 ...ecution_non_interactive_shell_upgrade.toml |  68 +++++
 ...rse_shell_activity_via_tcp_udp_socket.toml |   9 +-
 ...suspicious_interactive_terminal_spawn.toml |  77 +++++
 ...te_code_execution_via_database_server.toml | 272 ++++++++++++++++++
 ...remote_code_execution_via_mail_server.toml | 272 ++++++++++++++++++
 ...loaded_via_curl_or_wget_by_web_server.toml | 215 ++++++++++++++
 ...yload_execution_by_node.js_web_server.toml | 184 ++++++++++++
 ...e_setcap_setuid_setgid_capability_set.toml |  78 +++++
 ...persistence_suspicious_echo_execution.toml |  19 +-
 ...th_configuration_file_(.pth)_creation.toml |  78 +++++
 ...alation_via_suid_sgid_proxy_execution.toml | 112 ++++++++
 ...keystroke_capture_by_unsigned_process.toml |   4 +-
 ...inary_masquerading_via_untrusted_path.toml |   8 +-
 ...suspicious_image_load_from_smb_shares.toml |  19 +-
 ..._suspicious_parent_child_relationship.toml |   8 +-
 ...t_via_jscript9_from_internet_explorer.toml |   4 +-
 ...p_persistence_via_a_windows_installer.toml |   7 +-
 36 files changed, 2708 insertions(+), 37 deletions(-)
 create mode 100644 behavior/rules/cross-platform/discovery_discovery_of_github_actions_runner_process_pid.toml
 create mode 100644 behavior/rules/cross-platform/execution_suspicious_interpreter_execution_from_stdin.toml
 create mode 100644 behavior/rules/linux/collection_multi_value_secret_searching_via_grep.toml
 create mode 100644 behavior/rules/linux/command_and_control_dns_request_by_recently_created_executable.toml
 create mode 100644 behavior/rules/linux/command_and_control_dns_request_to_crypto_miner_service.toml
 create mode 100644 behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
 create mode 100644 behavior/rules/linux/command_and_control_dns_request_to_suspicious_file_upload_download_service.toml
 create mode 100644 behavior/rules/linux/command_and_control_potential_network_traffic_tunneling_via_proxychains.toml
 create mode 100644 behavior/rules/linux/defense_evasion_attempt_to_clear_kernel_ring_buffer_via_dmesg.toml
 create mode 100644 behavior/rules/linux/defense_evasion_attempt_to_clear_logs_via_journalctl.toml
 create mode 100644 behavior/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml
 create mode 100644 behavior/rules/linux/defense_evasion_attempt_to_disable_selinux.toml
 create mode 100644 behavior/rules/linux/defense_evasion_multiple_system_log_files_deletion.toml
 create mode 100644 behavior/rules/linux/defense_evasion_potential_disabling_of_apparmor.toml
 create mode 100644 behavior/rules/linux/defense_evasion_suspicious_binary_execution_via_path_alias.toml
 create mode 100644 behavior/rules/linux/execution_bpf_filter_applied_using_traffic_control.toml
 create mode 100644 behavior/rules/linux/execution_non_interactive_shell_upgrade.toml
 create mode 100644 behavior/rules/linux/execution_suspicious_interactive_terminal_spawn.toml
 create mode 100644 behavior/rules/linux/initial_access_potential_remote_code_execution_via_database_server.toml
 create mode 100644 behavior/rules/linux/initial_access_potential_remote_code_execution_via_mail_server.toml
 create mode 100644 behavior/rules/linux/persistence_payload_downloaded_via_curl_or_wget_by_web_server.toml
 create mode 100644 behavior/rules/linux/persistence_payload_execution_by_node.js_web_server.toml
 create mode 100644 behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
 create mode 100644 behavior/rules/linux/persistence_suspicious_python_path_configuration_file_(.pth)_creation.toml
 create mode 100644 behavior/rules/linux/privilege_escalation_potential_privilege_escalation_via_suid_sgid_proxy_execution.toml

diff --git a/behavior/rules/cross-platform/discovery_discovery_of_github_actions_runner_process_pid.toml b/behavior/rules/cross-platform/discovery_discovery_of_github_actions_runner_process_pid.toml
new file mode 100644
index 00000000..dd11352f
--- /dev/null
+++ b/behavior/rules/cross-platform/discovery_discovery_of_github_actions_runner_process_pid.toml
@@ -0,0 +1,93 @@
+[rule]
+description = """
+This rule detects the discovery of the GitHub Actions Runner process PID using the pgrep command. Adversaries may use
+this technique to identify the PID of the GitHub Actions Runner process, which can be used to execute commands on the
+runner host. This behavior may indicate malicious or unexpected workflow activity, including code execution, file
+manipulation, or network exfiltration initiated through a compromised repository or unauthorized workflow.
+"""
+id = "d908caa5-2d4c-4ba7-9ce8-5f1ff4315397"
+license = "Elastic License v2"
+name = "Discovery of GitHub Actions Runner Process PID"
+os_list = ["linux", "macos"]
+reference = [
+    "https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise",
+    "https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release",
+    "https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/",
+]
+version = "1.0.2"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=3s
+  [process where event.type == "start" and event.action == "exec" and process.name == "pgrep" and
+  process.args in ("Runner.Listener", "Runner.Worker", "Runner.PluginHost", "run.sh", "svc.sh", "runsvc.sh")] as event0
+  [process where event.type == "start" and event.action == "exec" and process.name == "pgrep" and
+  not startswith~(process.command_line, event0.process.command_line) and
+  process.args in ("Runner.Listener", "Runner.Worker", "Runner.PluginHost", "run.sh", "svc.sh", "runsvc.sh")]
+'''
+
+min_endpoint_version = "8.4.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1195"
+name = "Supply Chain Compromise"
+reference = "https://attack.mitre.org/techniques/T1195/"
+[[threat.technique.subtechnique]]
+id = "T1195.001"
+name = "Compromise Software Dependencies and Development Tools"
+reference = "https://attack.mitre.org/techniques/T1195/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1057"
+name = "Process Discovery"
+reference = "https://attack.mitre.org/techniques/T1057/"
+
+
+[threat.tactic]
+id = "TA0007"
+name = "Discovery"
+reference = "https://attack.mitre.org/tactics/TA0007/"
+
+[internal]
+min_endpoint_version = "8.4.0"
diff --git a/behavior/rules/cross-platform/execution_potential_reverse_shell_activity_via_terminal.toml b/behavior/rules/cross-platform/execution_potential_reverse_shell_activity_via_terminal.toml
index 2a8ffb1a..230be73a 100644
--- a/behavior/rules/cross-platform/execution_potential_reverse_shell_activity_via_terminal.toml
+++ b/behavior/rules/cross-platform/execution_potential_reverse_shell_activity_via_terminal.toml
@@ -9,7 +9,7 @@ reference = [
     "https://github.com/WangYihang/Reverse-Shell-Manager",
     "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
 ]
-version = "1.0.43"
+version = "1.0.44"
 
 query = '''
 process where event.action == "exec" and process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
@@ -31,7 +31,9 @@ not (
     "/opt/cdf/data/containerd/*", "/usr/bin/consul", "/usr/sbin/sshd", "/usr/bin/runc", "/usr/share/cursor/cursor", 
     "/home/*/.nvm/versions/node/*/bin/node", "/home/*/t38-k8s/*/k8sts", "/home/*/.opencode/bin/opencode",
     "/usr/bin/gnome-shell", "/usr/bin/coreutils", "/home/*/.local/bin/kiro-cli-chat",
-    "/opt/Tychon/Endpoint/bin/TychonCoreService"
+    "/opt/Tychon/Endpoint/bin/TychonCoreService", "/usr/local/bin/teleport", "/opt/teleport/system/bin/teleport",
+    "/usr/bin/claude-bin", "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode",
+    "/home/*/.local/share/claude/versions/*", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl"
   ) or
   (process.parent.name == "sudo" and process.parent.command_line like "*teleport-installer*") or
   (
diff --git a/behavior/rules/cross-platform/execution_suspicious_interpreter_execution_from_stdin.toml b/behavior/rules/cross-platform/execution_suspicious_interpreter_execution_from_stdin.toml
new file mode 100644
index 00000000..c9bcbc78
--- /dev/null
+++ b/behavior/rules/cross-platform/execution_suspicious_interpreter_execution_from_stdin.toml
@@ -0,0 +1,79 @@
+[rule]
+description = """
+Identifies interpreters started with - (stdin) where the command line suggests executing code from stdin. This is a
+common technique used by attackers to execute code without leaving a trace in the command line.
+"""
+id = "4aed9b17-873d-48b2-86eb-1af2f695f7fe"
+license = "Elastic License v2"
+name = "Suspicious Interpreter Execution from Stdin"
+os_list = ["linux", "macos"]
+reference = [
+    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
+    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
+]
+version = "1.0.3"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+process.executable like (
+ "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
+ "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
+ "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
+ "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
+ "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
+ ) and
+process.args == "-" and process.args_count <= 2 and
+process.parent.executable like (
+ "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
+ "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
+ "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
+ "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
+ "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
+) and
+not process.parent.args in ("/usr/sbin/needrestart", "/sbin/needrestart")
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.006"
+name = "Python"
+reference = "https://attack.mitre.org/techniques/T1059/006/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1027"
+name = "Obfuscated Files or Information"
+reference = "https://attack.mitre.org/techniques/T1027/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/collection_multi_value_secret_searching_via_grep.toml b/behavior/rules/linux/collection_multi_value_secret_searching_via_grep.toml
new file mode 100644
index 00000000..8cd351f3
--- /dev/null
+++ b/behavior/rules/linux/collection_multi_value_secret_searching_via_grep.toml
@@ -0,0 +1,120 @@
+[rule]
+description = """
+Identifies the execution of the grep, egrep, fgrep or pgrep commands with a multi-value search pattern to collect
+sensitive information. This is a common technique used by attackers to collect sensitive information from the system.
+"""
+id = "2d00bedd-28aa-4a54-a1e0-92fa00765540"
+license = "Elastic License v2"
+name = "Multi-Value Secret Searching via Grep"
+os_list = ["linux"]
+reference = [
+    "https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester",
+    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
+    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
+]
+version = "1.0.3"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=10s
+  [process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
+  process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
+  process.command_line like~ (
+    "*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
+    "*|conf*", "*conf|*", "*|cnf*", "*cnf|*",  "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
+    "*|auth*", "*auth|*", "*|passwd*",  "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
+    "*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
+  )] as event0
+  [process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
+  not startswith~(process.command_line, event0.process.command_line) and
+  process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
+  process.command_line like~ (
+    "*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
+    "*|conf*", "*conf|*", "*|cnf*", "*cnf|*",  "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
+    "*|auth*", "*auth|*", "*|passwd*",  "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
+    "*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
+  )] as event1
+  [process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
+  not startswith~(process.command_line, event1.process.command_line) and
+  process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
+  process.command_line like~ (
+    "*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
+    "*|conf*", "*conf|*", "*|cnf*", "*cnf|*",  "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
+    "*|auth*", "*auth|*", "*|passwd*",  "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
+    "*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
+  )]
+'''
+
+min_endpoint_version = "8.4.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1082"
+name = "System Information Discovery"
+reference = "https://attack.mitre.org/techniques/T1082/"
+
+[[threat.technique]]
+id = "T1083"
+name = "File and Directory Discovery"
+reference = "https://attack.mitre.org/techniques/T1083/"
+
+
+[threat.tactic]
+id = "TA0007"
+name = "Discovery"
+reference = "https://attack.mitre.org/tactics/TA0007/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1074"
+name = "Data Staged"
+reference = "https://attack.mitre.org/techniques/T1074/"
+[[threat.technique.subtechnique]]
+id = "T1074.001"
+name = "Local Data Staging"
+reference = "https://attack.mitre.org/techniques/T1074/001/"
+
+
+[[threat.technique]]
+id = "T1119"
+name = "Automated Collection"
+reference = "https://attack.mitre.org/techniques/T1119/"
+
+
+[threat.tactic]
+id = "TA0009"
+name = "Collection"
+reference = "https://attack.mitre.org/tactics/TA0009/"
+
+[internal]
+min_endpoint_version = "8.4.0"
diff --git a/behavior/rules/linux/command_and_control_dns_request_by_recently_created_executable.toml b/behavior/rules/linux/command_and_control_dns_request_by_recently_created_executable.toml
new file mode 100644
index 00000000..0b8d81c1
--- /dev/null
+++ b/behavior/rules/linux/command_and_control_dns_request_by_recently_created_executable.toml
@@ -0,0 +1,100 @@
+[rule]
+description = """
+This rule detects DNS requests initiated by recently created executables in world/user-writable directories. Malware
+authors may use these requests to communicate with command and control infrastructure or to exfiltrate data from the
+target system.
+"""
+id = "0c393c67-6eb3-4936-ab44-b807ef8af0f7"
+license = "Elastic License v2"
+name = "DNS Request by Recently Created Executable"
+os_list = ["linux"]
+version = "1.0.2"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=10s
+  [file where event.type == "creation" and (
+    process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
+    process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
+    process.executable like (
+      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
+      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
+    )
+  ) and
+  file.path like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*/*", "/root/*", "/var/www/*") and
+  not (
+    file.path like (
+      "/home/*/.claude/downloads/claude-*-linux-x64", "/home/*/.aimee-code/bin/aimee-code"
+    ) or
+    (
+      process.executable like "/home/*/go/pkg/mod/golang.org/*/pkg/tool/linux_amd64/link" and
+      file.path like "/tmp/go-*/exe/vuln-stats"
+    )
+  )] as event0
+  [dns where event.action == "lookup_result" and startswith~(process.executable, event0.file.path) and
+  dns.question.name != "localhost"]
+'''
+
+min_endpoint_version = "9.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1204"
+name = "User Execution"
+reference = "https://attack.mitre.org/techniques/T1204/"
+[[threat.technique.subtechnique]]
+id = "T1204.002"
+name = "Malicious File"
+reference = "https://attack.mitre.org/techniques/T1204/002/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+[[threat.technique]]
+id = "T1102"
+name = "Web Service"
+reference = "https://attack.mitre.org/techniques/T1102/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "9.3.0"
diff --git a/behavior/rules/linux/command_and_control_dns_request_to_crypto_miner_service.toml b/behavior/rules/linux/command_and_control_dns_request_to_crypto_miner_service.toml
new file mode 100644
index 00000000..ccf92717
--- /dev/null
+++ b/behavior/rules/linux/command_and_control_dns_request_to_crypto_miner_service.toml
@@ -0,0 +1,130 @@
+[rule]
+description = """
+This rule detects DNS queries to miner services via living-off-the-land executables or executables in
+world/user-writable directories. Malware authors may use these services to mine cryptocurrency to generate revenue.
+"""
+id = "66d449ef-25ee-4fa6-8893-0ced843d1915"
+license = "Elastic License v2"
+name = "DNS Request to Crypto Miner Service"
+os_list = ["linux"]
+reference = ["https://xmrig.com/docs/algorithms"]
+version = "1.0.1"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [process where event.type == "start" and event.action == "exec" and (
+    process.name in (
+      "curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox",
+      "timeout", "env", "node", "deno", "nodejs"
+    ) or
+    process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*") or
+    process.executable like (
+      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
+      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
+    ) or
+    process.working_directory like (
+      "/tmp*", "/var/tmp*", "/dev/shm*", "/run*", "/var/run*", "/boot*", "/sys*", "/lost+found*",
+      "/proc*", "/var/mail*", "/var/www*", "/home/*/*", "/root/*"
+    )
+  )]
+  [dns where event.action == "lookup_result" and dns.question.name like~ (
+    "*cnpool.cc", "*lindon-pool.win", "*supportxmr.com", "*comgandalph3000.com", "*minergate.com",
+    "*fjhan.club", "*emercoin.com", "*poolto.be", "*520fjh.org", "*xmrpool.xyz", "*simka.pw", "*noobxmr.com",
+    "*miner.rocks", "*minerpool.pw", "*minemonero.gq", "*usxmrpool.com", "*moneroocean.stream", "*mypool.online",
+    "*xmrpool.de", "*emergate.net", "*ip28.net", "*mine.bz", "*dwarfpool.com", "*xmrig.com", "*koto-pool.work",
+    "*monerorx.com", "*zarabotaibitok.ru", "*mining-help.ru", "*mine2gether.com", "*moneropool.com", "*viaxmr.com",
+    "*minerrocks.com", "*miningpoolhub.com", "*cortins.tk", "*pooldd.com", "*unmineable.com", "*f2pool.com",
+    "*graef.in", "*nanopool.org", "*myxmr.pw", "*ratchetmining.com", "*cryptmonero.com", "*xmrminer.cc",
+    "*riefly.id", "*iwanttoearn.money", "*herominers.com", "*xmrpool.me", "*miners.pro", "*luckpool.net",
+    "*twotouchauthentication.online", "*hashvault.pro", "*4i7i.com", "*miningocean.org", "*2miners.com",
+    "*xmrpool.eu", "*monerpool.org", "*joulecoin.org", "*suprnova.cc", "*bohemianpool.com",
+    "*crypto-pool.fr", "*xmr.pt", "*alimabi.cn", "*teracycle.net", "*monerogb.com", "*armornetwork.org",
+    "*emercoin.net", "*poolmining.org", "*minexmr.cn", "*moriaxmr.com", "*ethereumpool.co", "*minercircle.com",
+    "*prohash.net", "*zer0day.ru", "*crypto-pool.info", "*pool.support", "*siamining.com", "*5b6b7b.ru",
+    "*c3pool.com", "*somec.cc", "*hellominer.com", "*usa-138.com", "*mixpools.org", "*xmrpool.net",
+    "*moneroworld.com", "*minerxmr.ru", "*d5pool.us", "*hashcity.org", "*hex7e4.ru", "*zpool.ca", "*minexmr.com",
+    "*monerohash.com", "*multipool.us", "*moneropool.nl", "*nbminer.com", "*ppxxmr.com", "*xmrfast.com",
+    "*webhop.net", "*ethpool.org", "*slushpool.com", "*antpool.com", "*nicehash.com", "*nicehash.net",
+    "*zergpool.com", "*mining-dutch.nl", "*blockmasters.co", "*bsod.pw", "*fairpool.xyz", "*miningrigrentals.com",
+    "*hashing24.com", "*ethermine.org", "*flexpool.io", "*hiveon.net", "*sparkpool.com", "*2miners.org",
+    "*poolin.com", "*viabtc.com", "*f2pool.org", "*coinhive.com", "*cryptoloot.pro", "*webmine.cz",
+    "*minero.cc", "*monerohash.org", "*monerohash.net", "*moneropool.ru", "*moneroocean.stream", "*rx.unmineable.com"
+  )]
+'''
+
+min_endpoint_version = "9.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+[[threat.technique]]
+id = "T1102"
+name = "Web Service"
+reference = "https://attack.mitre.org/techniques/T1102/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1496"
+name = "Resource Hijacking"
+reference = "https://attack.mitre.org/techniques/T1496/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "9.3.0"
diff --git a/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml b/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
new file mode 100644
index 00000000..20721180
--- /dev/null
+++ b/behavior/rules/linux/command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
@@ -0,0 +1,92 @@
+[rule]
+description = """
+This rule detects DNS queries to dynamic DNS services via living-off-the-land executables or executables in
+world/user-writable directories. Malware authors may use these requests to communicate with command and control
+infrastructure or to exfiltrate data from the target system.
+"""
+id = "b85d016e-3a28-43bd-8fbf-cbb19b09dc46"
+license = "Elastic License v2"
+name = "DNS Request to Dynamic DNS via Suspicious Executable"
+os_list = ["linux"]
+reference = ["https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/"]
+version = "1.0.3"
+
+query = '''
+sequence by process.entity_id with maxspan=10s
+  [process where event.type == "start" and event.action == "exec" and (
+    process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
+    process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
+    process.executable like (
+      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
+      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
+    )
+  ) and not (
+      (
+        process.parent.name in ("bash", "node") and
+        (
+          process.working_directory in ("/usr/local/meshcentral", "/opt/meshcentral/meshcentral", "/usr/local/mesh_services/meshagent") or
+          process.parent.args in ("/usr/local/meshcentral/node_modules/meshcentral", "/home/periodic/dyndns-noip.sh")
+        )
+      ) or
+    (
+      process.command_line == "python3 -m app.run_scheduled_update" and
+      process.parent.args == "./workflow_unified.sh"
+    )
+  )]
+  [dns where event.action == "lookup_result" and dns.question.name like~ (
+    "*.no-ip.com", "*.no-ip.org", "*.no-ip.biz", "*.no-ip.info", "*.noip.com", "*.afraid.org", "*.changeip.com",
+    "*.ddns.net", "*.dyndns.org", "*.hopto.org", "*.zapto.org", "*.servehttp.com", "*.sytes.net", "*.myftp.biz",
+    "*.myftp.org", "*.ddnsfree.com", "*.duckdns.org", "*.000webhostapp.com", "*.myddns.me", "*.dlinkddns.com",
+    "*.chickenkiller.com", "*.thddns.net", "*.linkpc.net", "*.gotdns.ch", "*.dynv6.net", "*.dns.army",
+    "*.dns.navy", "*.v6.army", "*.v6.navy", "*.v6.rocks", "*.dyndns-office.com", "*.myvnc.com", "*.is-certified.com",
+    "*.instanthq.com", "*.ddnsgeek.com", "*.ygto.com", "*.casacam.com"
+  )]
+'''
+
+min_endpoint_version = "9.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+[[threat.technique]]
+id = "T1102"
+name = "Web Service"
+reference = "https://attack.mitre.org/techniques/T1102/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "9.3.0"
diff --git a/behavior/rules/linux/command_and_control_dns_request_to_suspicious_file_upload_download_service.toml b/behavior/rules/linux/command_and_control_dns_request_to_suspicious_file_upload_download_service.toml
new file mode 100644
index 00000000..ce1ff7b9
--- /dev/null
+++ b/behavior/rules/linux/command_and_control_dns_request_to_suspicious_file_upload_download_service.toml
@@ -0,0 +1,110 @@
+[rule]
+description = """
+This rule detects DNS queries to suspicious file upload/download services via living-off-the-land executables or
+executables in world/user-writable directories. Malware authors may use these services to exfiltrate data from the
+target system or to download payloads for later execution.
+"""
+id = "4b648636-f4d4-4ac8-ac34-df7758201824"
+license = "Elastic License v2"
+name = "DNS Request to Suspicious File Upload/Download Service"
+os_list = ["linux"]
+reference = ["https://lolexfil.github.io/"]
+version = "1.0.2"
+
+query = '''
+sequence by process.entity_id with maxspan=10s
+  [process where event.type == "start" and event.action == "exec" and (
+    process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
+    process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
+    process.executable like (
+      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
+      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
+    )
+  ) and not (
+    process.executable like "/home/*/OtherApps/firefox/firefox-bin" or
+    process.working_directory like "/srv/sao/Processing/Workdir/*" or
+    (
+      process.parent.executable == "/usr/bin/gnome-shell" and
+      process.args like (
+        "/snap/firefox/*/firefox.launcher", "/usr/bin/firefox", "/home/*/OtherApps/firefox/firefox"
+      )
+    )  
+  )]
+  [dns where event.action == "lookup_result" and dns.question.name like~ (
+    /* Generic suspicious upload/download services */
+    "*pastebin.com", "*hastebin.com", "*dpaste.org", "*controlc.com", "*0bin.net", "*p.ip.fi", "*sprunge.us",
+    "*paste.ee", "*paste.ofcode.org", "*textbin.net", "*send.now", "*send.cm", "*pixeldrain.com", "*megaupload.com",
+    "*mediafire.com", "*bashupload.com", "*bujang.online", "*sendit.sh", "*paste4btc.com", "*ghostbin.com", "*filebin.net",
+    "*paste.wakas.org",
+
+    /* https://lolexfil.github.io/ */
+    "*anonfiles.com", "*bayfiles.com" , "*bublup.com", "*catbox.moe", "*dropfiles.org", "*dropmefiles.com",
+    "*easyupload.io", "*file.io", "*filetransfer.io", "*gofile.io", "*qaz.im", "*send.exploit.in", "*sendspace.com",
+    "*share.riseup.net", "*temp.sh", "*tempsend.com", "*transfer.sh", "*ufile.io", "*paste.rs", "*nopaste.net"
+  )]
+'''
+
+min_endpoint_version = "9.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+[[threat.technique]]
+id = "T1102"
+name = "Web Service"
+reference = "https://attack.mitre.org/techniques/T1102/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "9.3.0"
diff --git a/behavior/rules/linux/command_and_control_potential_network_traffic_tunneling_via_proxychains.toml b/behavior/rules/linux/command_and_control_potential_network_traffic_tunneling_via_proxychains.toml
new file mode 100644
index 00000000..b44f92cf
--- /dev/null
+++ b/behavior/rules/linux/command_and_control_potential_network_traffic_tunneling_via_proxychains.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+This rule identifies the use of proxychains to potentially tunnel network traffic. Attackers can leverage proxychains to
+establish hidden communication channels and gain unauthorized access to internal resources, facilitating data
+exfiltration or lateral movement via proxychains while evading direct connection blocking.
+"""
+id = "4484d4b4-499f-4c8e-aa32-be7c0d66eb6c"
+license = "Elastic License v2"
+name = "Potential Network Traffic Tunneling via Proxychains"
+os_list = ["linux"]
+reference = [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding",
+    "https://github.com/haad/proxychains",
+]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.name in ("proxychains", "proxychains4", "proxyresolv")
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1572"
+name = "Protocol Tunneling"
+reference = "https://attack.mitre.org/techniques/T1572/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/defense_evasion_attempt_to_clear_kernel_ring_buffer_via_dmesg.toml b/behavior/rules/linux/defense_evasion_attempt_to_clear_kernel_ring_buffer_via_dmesg.toml
new file mode 100644
index 00000000..5cc5ea05
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_attempt_to_clear_kernel_ring_buffer_via_dmesg.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events
+to evade detection after installing a Linux kernel module (LKM). This activity is commonly observed by intrusions that
+leverage kernel-level rootkits to maintain persistence on a compromised host.
+"""
+id = "116d477e-8dd3-4de6-bbfd-9c19ca37fb8b"
+license = "Elastic License v2"
+name = "Attempt to Clear Kernel Ring Buffer via Dmesg"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+process.name == "dmesg" and process.args in ("-c", "--clear") and
+not process.parent.executable == "/tmp/newroot/usr/bin/sudo"
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1070"
+name = "Indicator Removal"
+reference = "https://attack.mitre.org/techniques/T1070/"
+[[threat.technique.subtechnique]]
+id = "T1070.002"
+name = "Clear Linux or Mac System Logs"
+reference = "https://attack.mitre.org/techniques/T1070/002/"
+
+
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/defense_evasion_attempt_to_clear_logs_via_journalctl.toml b/behavior/rules/linux/defense_evasion_attempt_to_clear_logs_via_journalctl.toml
new file mode 100644
index 00000000..12fc6355
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_attempt_to_clear_logs_via_journalctl.toml
@@ -0,0 +1,64 @@
+[rule]
+description = """
+This rule monitors for attempts to clear logs using the "journalctl" command on Linux systems. Adversaries may use this
+technique to cover their tracks by deleting or truncating log files, making it harder for defenders to investigate their
+activities. The rule looks for the execution of "journalctl" with arguments that indicate log clearing actions, such as
+"--vacuum-time", "--vacuum-size", or "--vacuum-files".
+"""
+id = "2f45b36f-a60d-46c9-9f82-eb80ab62ce7f"
+license = "Elastic License v2"
+name = "Attempt to Clear Logs via Journalctl"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.name == "journalctl" and
+process.args like~ ("--vacuum-time=?s", "--vacuum-size=?M", "--vacuum-files=*") and
+not (
+  process.parent.args in ("/usr/lib/armbian/armbian-truncate-logs", "/root/innovasive_reverseproxy/backupscript/cleanup_hour.sh") or
+  process.parent.executable == "/tmp/newroot/usr/bin/sudo"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1070"
+name = "Indicator Removal"
+reference = "https://attack.mitre.org/techniques/T1070/"
+[[threat.technique.subtechnique]]
+id = "T1070.002"
+name = "Clear Linux or Mac System Logs"
+reference = "https://attack.mitre.org/techniques/T1070/002/"
+
+
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml b/behavior/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml
new file mode 100644
index 00000000..ca9e6154
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system
+auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which
+can be used to detect malicious activity.
+"""
+id = "bf76a9f8-42dd-44cc-9e2f-d8693df31d59"
+license = "Elastic License v2"
+name = "Attempt to Disable Auditd Service"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and (
+  (process.name == "service" and process.args == "stop") or
+  (process.name == "chkconfig" and process.args == "off") or
+  (process.name == "update-rc.d" and process.args in ("remove", "disable")) or
+  (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
+) and
+process.args in ("auditd", "auditd.service") and
+not (
+  process.parent.executable like (
+    "/var/lib/dpkg/info/auditd.prerm", "/usr/libexec/platform-python*"
+  ) or
+  (process.name == "systemctl" and process.parent.args == "/usr/lib/systemd/systemd-update-helper") or
+  process.parent.args like (
+    "/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_*.py", "/var/lib/dpkg/info/auditd.prerm", "/var/tmp/rpm-tmp*"
+  ) or
+  process.parent.executable == "/opt/kaspersky/kesl/libexec/kesl" or
+  process.parent.command_line like "*logrotate_script*"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/defense_evasion_attempt_to_disable_selinux.toml b/behavior/rules/linux/defense_evasion_attempt_to_disable_selinux.toml
new file mode 100644
index 00000000..5372c656
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_attempt_to_disable_selinux.toml
@@ -0,0 +1,54 @@
+[rule]
+description = """
+Adversaries may attempt to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to
+support access control policies. Disabling SELinux can allow malicious activities to continue undetected.
+"""
+id = "54aabfc3-7a78-4241-b0b2-e0de46d8e7b7"
+license = "Elastic License v2"
+name = "Attempt to Disable SELinux"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+process.name == "setenforce" and process.args == "0" and
+not (
+  process.parent.args like (
+    "/tmp/ansible-tmp-*/AnsiballZ_command.py", "/tmp/chef-script*", "/root/fapolicyd_rebuild.sh"
+  ) or
+  process.parent.executable in (
+    "/opt/Tanium/TaniumClient/Tools/TCMClientUpgrade/ClientManagementUpgrade-upgrade.sh", "/usr/libexec/platform-python",
+    "/usr/share/centrifydc/libexec/dzdo"
+  ) or
+  (process.parent.name in ("taskrun", "perl") and process.parent.args == "/usr/local/cpanel/bin/taskrun") or
+  process.parent.executable like "/usr/libexec/platform-python*"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/defense_evasion_decoded_payload_piped_to_interpreter.toml b/behavior/rules/linux/defense_evasion_decoded_payload_piped_to_interpreter.toml
index ede63d0d..e9252fd0 100644
--- a/behavior/rules/linux/defense_evasion_decoded_payload_piped_to_interpreter.toml
+++ b/behavior/rules/linux/defense_evasion_decoded_payload_piped_to_interpreter.toml
@@ -7,7 +7,7 @@ id = "452d6452-a8ec-4cae-9720-567fb44d93b7"
 license = "Elastic License v2"
 name = "Decoded Payload Piped to Interpreter"
 os_list = ["linux"]
-version = "1.0.5"
+version = "1.0.6"
 
 query = '''
 sequence by process.parent.entity_id, process.working_directory with maxspan=1s
@@ -82,9 +82,11 @@ sequence by process.parent.entity_id, process.working_directory with maxspan=1s
     process.parent.executable in ("/usr/share/windsurf/windsurf", "/usr/share/cursor/cursor") or
     process.parent.command_line like ("claude", "*__CURSOR_SANDBOX_ENV_RESTORE*") or
     (
-      process.args like ("eval*1337*SendConductor*", "eval*KITTY_SSH_KITTEN_DATA_DIR*") and
+      process.command_line like~ ("*eval*1337*SendConductor*", "*eval*KITTY_SSH_KITTEN_DATA_DIR*") and
       process.parent.name == "sshd"
-    ) 
+    ) or
+    process.command_line like "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*" or
+    (process.working_directory like "/home/u.*" and process.command_line like "bash -lc printf %s*")
   )]
   [process where event.type == "start" and event.action == "exec" and process.name like (
     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
diff --git a/behavior/rules/linux/defense_evasion_multiple_system_log_files_deletion.toml b/behavior/rules/linux/defense_evasion_multiple_system_log_files_deletion.toml
new file mode 100644
index 00000000..009602dd
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_multiple_system_log_files_deletion.toml
@@ -0,0 +1,98 @@
+[rule]
+description = """
+Monitors for the deletion of multiple sensitive Linux system logs. This may indicate an attempt to evade detection or
+destroy forensic evidence on a system.
+"""
+id = "ffab808c-9944-44eb-8a4b-456a5e6c096d"
+license = "Elastic License v2"
+name = "Multiple System Log Files Deletion"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=10s
+  [file where event.type == "deletion" and process.executable != null and file.path in (
+    "/var/run/utmp", "/var/log/wtmp", "/var/log/btmp", "/var/log/lastlog", "/var/log/faillog",
+    "/var/log/syslog", "/var/log/messages", "/var/log/secure", "/var/log/auth.log", "/var/log/boot.log",
+    "/var/log/kern.log", "/var/log/dmesg"
+  ) and
+  not process.executable like (
+    "/kaniko/executor", "/var/lib/docker/overlay2/*/merged/kaniko/executor", "/kaniko/kaniko-executor"
+  )] as event0
+  [file where event.type == "deletion" and process.executable != null and
+  not startswith~(file.path, event0.file.path) and file.path in (
+    "/var/run/utmp", "/var/log/wtmp", "/var/log/btmp", "/var/log/lastlog", "/var/log/faillog",
+    "/var/log/syslog", "/var/log/messages", "/var/log/secure", "/var/log/auth.log", "/var/log/boot.log",
+    "/var/log/kern.log", "/var/log/dmesg"
+  ) and
+  not process.executable like (
+    "/kaniko/executor", "/var/lib/docker/overlay2/*/merged/kaniko/executor", "/kaniko/kaniko-executor"
+  )] as event1
+  [file where event.type == "deletion" and process.executable != null and
+  not startswith~(file.path, event1.file.path) and file.path in (
+    "/var/run/utmp", "/var/log/wtmp", "/var/log/btmp", "/var/log/lastlog", "/var/log/faillog",
+    "/var/log/syslog", "/var/log/messages", "/var/log/secure", "/var/log/auth.log", "/var/log/boot.log",
+    "/var/log/kern.log", "/var/log/dmesg"
+  ) and
+  not process.executable like (
+    "/kaniko/executor", "/var/lib/docker/overlay2/*/merged/kaniko/executor", "/kaniko/kaniko-executor"
+  )]
+'''
+
+min_endpoint_version = "8.6.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 1
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1070"
+name = "Indicator Removal"
+reference = "https://attack.mitre.org/techniques/T1070/"
+[[threat.technique.subtechnique]]
+id = "T1070.002"
+name = "Clear Linux or Mac System Logs"
+reference = "https://attack.mitre.org/techniques/T1070/002/"
+
+[[threat.technique.subtechnique]]
+id = "T1070.004"
+name = "File Deletion"
+reference = "https://attack.mitre.org/techniques/T1070/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "8.6.0"
diff --git a/behavior/rules/linux/defense_evasion_potential_disabling_of_apparmor.toml b/behavior/rules/linux/defense_evasion_potential_disabling_of_apparmor.toml
new file mode 100644
index 00000000..9895aae5
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_potential_disabling_of_apparmor.toml
@@ -0,0 +1,59 @@
+[rule]
+description = """
+Monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained
+access control policies to restrict the actions and resources that specific applications and processes can access.
+Adversaries may disable AppArmor to avoid possible detection of their tools and activities.
+"""
+id = "5a19f19d-6f94-475e-9eba-2520685c3861"
+license = "Elastic License v2"
+name = "Potential Disabling of AppArmor"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and (
+  (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask") and process.args in ("apparmor", "apparmor.service")) or
+  (process.name == "service" and process.args == "apparmor" and process.args == "stop") or
+  (process.name == "chkconfig" and process.args == "apparmor" and process.args == "off") or
+  (process.name == "update-rc.d" and process.args == "apparmor" and process.args in ("remove", "disable")) or
+  (process.name == "ln" and process.args like~ "/etc/apparmor.d/*" and process.args == "/etc/apparmor.d/disable/")
+) and
+not (
+  process.parent.executable in ("/opt/puppetlabs/puppet/bin/ruby", "/lib/systemd/systemd-sysv-install") or
+  process.parent.args like "/var/lib/dpkg/info/*.postinst" or
+  process.working_directory == "/home/ansible"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml b/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
index f0b907ac..842cd54e 100644
--- a/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
+++ b/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "Shared Object Injection via Process Environment Variable"
 os_list = ["linux"]
 reference = ["https://attack.mitre.org/techniques/T1574/006/"]
-version = "1.0.47"
+version = "1.0.48"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.env_vars like "LD_PRELOAD=?*" and 
@@ -58,7 +58,8 @@ process where event.type == "start" and event.action == "exec" and process.env_v
     "LD_PRELOAD=/lib/x86_64-linux-gnu/libSegFault.so", "LD_PRELOAD=/usr/lib/libnss_wrapper.so",
     "LD_PRELOAD=/tmp/*/openwrt-imagebuilder*/runas.so", "LD_PRELOAD=/tmp/pressure-vessel-libs-*/libMangoHud_shim.so",
     "LD_PRELOAD=/home/libjemalloc.so.2", "LD_PRELOAD=/tmp/libredirectnull.so", "LD_PRELOAD=/tmp/libcuda_trace.so",
-    "LD_PRELOAD=:/usr/lib/libjemalloc.so", "LD_PRELOAD=/lib/libSegFault.so"
+    "LD_PRELOAD=:/usr/lib/libjemalloc.so", "LD_PRELOAD=/lib/libSegFault.so", "LD_PRELOAD=/tmp/baum/easybuild/*",
+    "LD_PRELOAD=/home/*/.local/share/WebexLauncher/*/bin/../lib/libCefMallinfoShim.so"
   ) or
   (process.env_vars == "LD_PRELOAD=./getrandom.so" and process.parent.command_line == "/opt/perlbrew/perls/perl-5.40.3/bin/perl t/getrandom.t") or
   process.parent.command_line == "runc init" or
diff --git a/behavior/rules/linux/defense_evasion_suspicious_binary_execution_via_path_alias.toml b/behavior/rules/linux/defense_evasion_suspicious_binary_execution_via_path_alias.toml
new file mode 100644
index 00000000..50185f93
--- /dev/null
+++ b/behavior/rules/linux/defense_evasion_suspicious_binary_execution_via_path_alias.toml
@@ -0,0 +1,58 @@
+[rule]
+description = """
+Detects execution of binaries through the /proc/self/root procfs path alias. This technique resolves to the filesystem
+root through procfs and can bypass path-based denylists or security controls that match on canonical paths like
+/usr/bin/. An AI coding agent (Claude Code) was observed using this technique autonomously to evade its own permission
+denylist without any adversarial prompting. This is also a general defense evasion technique usable by any process.
+"""
+id = "5b95dcac-7e0a-4f3c-ab4b-a94cf84d793e"
+license = "Elastic License v2"
+name = "Suspicious Binary Execution via Path Alias"
+os_list = ["linux"]
+reference = [
+    "https://awesomeagents.ai/news/claude-code-sandbox-escape-denylist/",
+    "https://man7.org/linux/man-pages/man5/proc.5.html",
+]
+version = "1.0.3"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+(
+  process.executable like "/proc/*/root/*" or
+  process.args regex """/proc/(self|[0-9]{1,7})/root/[a-z].*"""
+) and
+not process.args like ("/proc/*/root/etc/*", "/proc/1/root/var/lib/rancher/*", "/proc/1/root/var/lib/cni/*", "cat", "readlink", "ls")
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.005"
+name = "Match Legitimate Name or Location"
+reference = "https://attack.mitre.org/techniques/T1036/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/execution_bpf_filter_applied_using_traffic_control.toml b/behavior/rules/linux/execution_bpf_filter_applied_using_traffic_control.toml
new file mode 100644
index 00000000..0fe5590d
--- /dev/null
+++ b/behavior/rules/linux/execution_bpf_filter_applied_using_traffic_control.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Detects when the tc (traffic control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface.
+Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat
+actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This
+technique is not at all common and should indicate abnormal, suspicious or malicious activity.
+"""
+id = "bde36476-0c2c-40df-b3b1-941b0b31e444"
+license = "Elastic License v2"
+name = "BPF Filter Applied using Traffic Control"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.name == "tc" and
+process.args == "filter" and process.args == "add" and process.args == "bpf" and
+not process.parent.executable == "/usr/sbin/libvirtd"
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/execution_non_interactive_shell_upgrade.toml b/behavior/rules/linux/execution_non_interactive_shell_upgrade.toml
new file mode 100644
index 00000000..215f2f42
--- /dev/null
+++ b/behavior/rules/linux/execution_non_interactive_shell_upgrade.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Identifies when a non-interactive terminal (tty) is being upgraded to a fully interactive shell. Attackers may upgrade a
+simple reverse shell to a fully interactive tty after obtaining initial access to a host, in order to obtain a more
+stable connection.
+"""
+id = "f1e932e5-41c5-465f-823b-83fc6f379bb4"
+license = "Elastic License v2"
+name = "Non-interactive Shell Upgrade"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and (
+  (
+    process.name == "stty" and
+    process.args == "raw" and
+    process.args == "-echo" and
+    process.args_count >= 3
+  ) or
+  (
+    process.name == "script" and
+    process.args in ("-qc", "-c") and
+    process.args == "/dev/null" and
+    process.args_count == 4
+  )
+) and
+not (
+  process.parent.command_line like ("linode-longview", "*bootstrap*", "*homebrew*", "*/home/*/.claude/shell-snapshots/snapshot*") or
+  process.parent.executable in ("/usr/bin/expect", "/usr/bin/nsh-single-command", "/usr/bin/runc") or
+  process.command_line == "stty -echo raw min 0 time 2" or
+  process.args like ("/dev/tty*", "/dev/serial/*") or
+  process.parent.args == "/usr/share/emacs/site-lisp/emacspeak/servers/dtk-exp"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/execution_potential_reverse_shell_activity_via_tcp_udp_socket.toml b/behavior/rules/linux/execution_potential_reverse_shell_activity_via_tcp_udp_socket.toml
index 1b193723..a19eb33b 100644
--- a/behavior/rules/linux/execution_potential_reverse_shell_activity_via_tcp_udp_socket.toml
+++ b/behavior/rules/linux/execution_potential_reverse_shell_activity_via_tcp_udp_socket.toml
@@ -12,7 +12,7 @@ reference = [
     "https://github.com/WangYihang/Reverse-Shell-Manager",
     "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
 ]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
@@ -29,14 +29,15 @@ process where event.type == "start" and event.action == "exec" and process.paren
 process.command_line like ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
 process.command_line like ("*&>*", "*<>*", "*>&*", "*<&*") and
 not (
-  process.command_line like ("*/dev/tcp/127.0.0.1/*", "*/dev/tcp/localhost/*") or
-  process.parent.command_line == "/usr/bin/runc init" or
+  process.command_line like ("*/dev/tcp/127.0.0.1/*", "*/dev/tcp/localhost/*", "*/home/*/.claude/shell-snapshots/snapshot*") or
+  process.parent.command_line like ("/usr/bin/runc init", "*/home/*/.claude/shell-snapshots/snapshot*") or
   process.parent.args in ("/usr/bin/testssl.sh", "/usr/local/bin/testssl.sh", "/usr/bin/crun") or
   process.parent.executable like (
     "/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64", "/home/*/.cursor-server/bin/*/node", "/root/.cursor-server/cli/servers/*/server/node",
     "/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex", "/opt/teleport/system/bin/teleport",
     "/home/*/.local/bin/claude", "/usr/bin/claude-bin", "/home/*/.config/Claude/claude-code-vm/*/claude", "/usr/share/cursor/cursor", "/usr/local/bin/teleport",
-    "/home/*/.local/share/claude/versions/*"
+    "/home/*/.local/share/claude/versions/*", "/home/*/.local/bin/kiro-cli-chat", "./runc", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl",
+    "/home/*/.opencode/bin/opencode"
   )
 )
 '''
diff --git a/behavior/rules/linux/execution_suspicious_interactive_terminal_spawn.toml b/behavior/rules/linux/execution_suspicious_interactive_terminal_spawn.toml
new file mode 100644
index 00000000..6ae2b034
--- /dev/null
+++ b/behavior/rules/linux/execution_suspicious_interactive_terminal_spawn.toml
@@ -0,0 +1,77 @@
+[rule]
+description = """
+Identifies when an interactive terminal is spawned via an interpreter parent process. This behavior indicates an
+attacker is attempting to gain a more stable connection to a host after obtaining initial access.
+"""
+id = "442f824f-a2bb-4052-83d0-4c9514d31214"
+license = "Elastic License v2"
+name = "Suspicious Interactive Terminal Spawn"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and (
+  (
+    process.name == "perl" and process.args like "-e*" and process.command_line like "*exec*" and
+    process.command_line like ("*\"*sh\";*", "*'*sh';*")
+  ) or
+  (
+    process.parent.name like "python*" and
+    process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
+    (
+      (
+        process.parent.args_count >= 3 and
+        process.parent.args like~ "*pty.spawn*" and
+        process.parent.args == "-c"
+      ) or
+      (
+        process.args in (
+          "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox",
+          "/bin/bash", "/bin/dash", "/bin/ash", "/bin/sh", "/bin/tcsh", "/bin/csh",
+          "/bin/zsh", "/bin/ksh", "/bin/fish", "/bin/mksh", "/bin/busybox",
+          "/usr/bin/bash", "/usr/bin/dash", "/usr/bin/ash", "/usr/bin/sh", "/usr/bin/tcsh", "/usr/bin/csh",
+          "/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish", "/usr/bin/mksh", "/usr/bin/busybox",
+          "/usr/local/bin/bash", "/usr/local/bin/dash", "/usr/local/bin/ash", "/usr/local/bin/sh",
+          "/usr/local/bin/tcsh", "/usr/local/bin/csh", "/usr/local/bin/zsh", "/usr/local/bin/ksh",
+          "/usr/local/bin/fish", "/usr/local/bin/mksh", "/usr/local/bin/busybox"
+        ) and
+        process.args_count == 1 and
+        process.parent.args_count == 1
+      )
+    )
+  )
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/initial_access_potential_remote_code_execution_via_database_server.toml b/behavior/rules/linux/initial_access_potential_remote_code_execution_via_database_server.toml
new file mode 100644
index 00000000..c71c691e
--- /dev/null
+++ b/behavior/rules/linux/initial_access_potential_remote_code_execution_via_database_server.toml
@@ -0,0 +1,272 @@
+[rule]
+description = """
+This rule detects potential remote code execution attempts via commonly used database server applications, by monitoring
+for unusual child processes and command line arguments.
+"""
+id = "057bd963-2dce-4951-87ce-5923803158ff"
+license = "Elastic License v2"
+name = "Potential Remote Code Execution via Database Server"
+os_list = ["linux"]
+version = "1.0.7"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
+  process.parent.name in (
+    "redis-server", "mongod", "mysqld", "oracle", "tnslsnr", "postgres", "mariadbd", "sqlservr",
+    "beam.smp", "db2sysc", "clickhouse-server"
+  ) or
+  (process.parent.name == "redis-check-rdb" and process.parent.command_line like "*redis-server*")
+) and
+not (
+  (process.parent.name == "oracle" and process.args like "/bin/grep -q kubepods /proc/self/cgroup*") or
+  (process.parent.name == "beam.smp" and process.name == "erl_child_setup") or
+  (process.parent.name == "erl_child_setup" and process.command_line like ("*rabbitmq-env.conf*echo*VARS*set", "inet_gethost 4")) or
+  (process.name == "epmd" and process.command_line == "epmd -daemon")
+) and
+(
+  process.name in (
+    "scp", "gzip", "bzip2", "xz", "tar", "getcap", "capsh", "find", "nohup", "setsid", "timeout", "disown",
+    "mkfifo", "printenv", "env", "chpasswd", "touch", "echo"
+  ) or
+  process.name like ".*" or
+  (
+    process.name in ("whoami", "id", "hostname", "uname", "ps", "netstat", "ss", "ip", "ifconfig") and
+    process.interactive == true and process.parent.interactive == false
+  ) or
+  process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/root/*", "./*") or
+  (
+    process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and (
+      process.args == "-c" or
+      (
+        process.args_count <= 2 and
+        process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/root/*", "/home/*/*", "./*.py") and
+        process.args like "*.py*"
+      )
+    ) and
+    not process.args in ("--version", "app.py")
+  ) or
+  (
+    process.executable like (
+      "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
+      "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
+      "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
+      "/bin/node", "/usr/bin/node", "/usr/local/bin/node"
+    ) and
+    (process.args like "-e*" or process.args_count <= 2)
+  ) or
+  (
+    process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
+    (process.args like "-r*" or process.args_count <= 2) and
+    not (
+      process.args like "var_export*" or
+      process.command_line in ("php -r echo get_current_user().PHP_EOL;", "php -r echo date('T');")
+    ) 
+  ) or
+  (
+    process.name in ("netcat", "nc", "ncat", "nc.traditional", "nc.openbsd") and (
+      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
+      process.command_line like "*http*"
+    ) and
+    not process.args in ("localhost", "127.0.0.1", "-z", "-zv") 
+  ) or
+  (
+    process.name == "socat" and
+    process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
+    process.command_line like~ ("*tcp*", "*udp*", "*openssl*")
+  ) or
+  (
+    process.name == "openssl" and (
+      process.command_line like ("*s_server*", "*s_client*") or
+      (process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A"))
+    )
+  ) or
+  (
+    process.name in ("curl", "wget") and process.args like~ ("-o", "--output*", "-o-") and (
+      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
+      process.command_line like "*http*"
+    ) and
+    process.command_line like ("* /tmp/*", "* /var/tmp/*", "* /dev/shm/*", "* /var/www/*", "* ~/*", "* /home/*", "* /run/*", "* /var/run/*")
+  ) or
+  (
+    process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
+    process.args like~ "-*d*"
+  ) or
+  (
+    process.name == "xxd" and process.args like~ ("-*r*", "-*p*")
+  ) or
+  (process.name == "sudo" and process.args == "-l") or
+  (
+    process.executable like ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") and
+    process.args like ("+x", "a+x", "0777", "755", "777", "+s", "u+s", "g+s")
+  ) or
+  (
+    process.executable like ("/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat") and
+    process.args like (
+      "/etc/passwd", "/etc/shadow", "/etc/hostname", "/etc/hosts", "*ssh*", "/proc/self/environ",
+      "*.env*", "*../../../*", "*/secrets/kubernetes.io/serviceaccount/*", "*/.docker/config.json*",
+      "*/.npmrc*", "*.aws/credentials*", "*/.aws/config*"
+    )
+  ) or
+  (
+    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
+    process.args in ("-c", "-cl", "-lc") and (
+      process.command_line like (
+        /* Suspicious Paths */
+        "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",
+
+        /* Interpreter Execution */
+        "*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",
+
+        /* Encoding, Decoding & Piping */
+        "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
+        "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
+        "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
+        "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
+
+        /* Reverse Shells */
+        "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
+
+        /* File Access */
+        "*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",
+
+        /* Helpers */
+        "*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",
+
+        /* Miscellaneous */
+        "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", 
+        
+        /* Decompression */
+        "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
+         
+         /* Path Traversal */
+         "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*"
+      ) or
+      (
+        process.command_line like ("*wget *", "*curl *") and
+        (
+          process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
+          process.command_line like ("*http*", "*ftp*")
+        ) and
+        (
+          (
+            process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
+            process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
+          ) or
+          (
+            (
+              process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
+              process.command_line like~ "*wget* --output-document*"
+            ) and
+          not process.command_line like """*--output-document "-"*"""
+          ) or
+          process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
+          (
+            process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
+            not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
+          )
+        ) and
+        not process.command_line like ("*-O /dev/null*", "*-o /dev/null*")
+      )
+    )
+  )
+) and
+not (
+  process.executable like ("/tmp/newroot/*", "./runc") or
+  process.command_line == "sh -c locale -a" or
+  process.args == "/usr/bin/env" and process.args in ("check_postgres.pl", "/usr/lib/pscheduler/commands/validate-configurables") or
+  (
+    process.parent.executable == "/etc/init.d/redis-server" and
+    process.command_line in ("chmod 755 /var/run/redis", "touch /var/run/redis/redis-server.pid")
+  ) or
+  (
+    process.parent.name == "postgres" and
+    process.command_line in ("ps -p 1", "python2 -c pass")
+  )
+)
+'''
+
+min_endpoint_version = "8.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1505"
+name = "Server Software Component"
+reference = "https://attack.mitre.org/techniques/T1505/"
+[[threat.technique.subtechnique]]
+id = "T1505.001"
+name = "SQL Stored Procedures"
+reference = "https://attack.mitre.org/techniques/T1505/001/"
+
+
+[[threat.technique]]
+id = "T1554"
+name = "Compromise Host Software Binary"
+reference = "https://attack.mitre.org/techniques/T1554/"
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1210"
+name = "Exploitation of Remote Services"
+reference = "https://attack.mitre.org/techniques/T1210/"
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "8.3.0"
diff --git a/behavior/rules/linux/initial_access_potential_remote_code_execution_via_mail_server.toml b/behavior/rules/linux/initial_access_potential_remote_code_execution_via_mail_server.toml
new file mode 100644
index 00000000..9cf0983d
--- /dev/null
+++ b/behavior/rules/linux/initial_access_potential_remote_code_execution_via_mail_server.toml
@@ -0,0 +1,272 @@
+[rule]
+description = """
+This rule detects potential remote code execution attempts via commonly used mail server applications, by monitoring for
+unusual child processes and command line arguments.
+"""
+id = "318e6a4f-fb72-4010-a625-d41bae9e349a"
+license = "Elastic License v2"
+name = "Potential Remote Code Execution via Mail Server"
+os_list = ["linux"]
+version = "1.0.4"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
+(
+  process.parent.name in ("exim4", "postfix", "smtpd", "sendmail", "dovecot", "amavisd-new", "amavisd", "spamd") or
+  (
+    process.parent.name == "master" and
+    process.parent.executable like "/*/postfix*master"
+  )
+) and
+not (
+  (process.parent.name == "exim4" and process.args like "/usr/lib/nagios/plugins/check_file_age*") or
+  (process.parent.name in ("amavisd-new", "amavisd") and process.command_line == "/usr/bin/gzip -d") or
+  (process.parent.name == "dovecot" and process.command_line == "gzip") or
+  (process.parent.name == "amavisd" and process.name == "amavisd")
+) and
+(
+  process.name in (
+    "scp", "gzip", "bzip2", "xz", "tar", "getcap", "capsh", "find", "nohup", "setsid", "timeout", "disown",
+    "mkfifo", "printenv", "env", "chpasswd", "echo"
+  ) or
+  (
+    process.name == "touch" and
+    not process.args like (
+      "/home/*/.esmtp_queue/*/lock", "/root/.esmtp_queue/*/lock", "/prod/prod/data/prodstage/possum/error/"
+    )
+  ) or
+  process.name like ".*" or
+  (
+    process.name in ("whoami", "id", "hostname", "uname", "ps", "netstat", "ss", "ip", "ifconfig") and
+    process.interactive == true and process.parent.interactive == false
+  ) or
+  process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/root/*", "./*") or
+  (
+    process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and (
+      process.args == "-c" or
+      (
+        process.args_count <= 2 and
+        process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/root/*", "/home/*/*", "./*.py") and
+        process.args like "*.py*"
+      )
+    ) and
+    not process.args in ("--version", "app.py")
+  ) or
+  (
+    process.executable like (
+      "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
+      "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
+      "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
+      "/bin/node", "/usr/bin/node", "/usr/local/bin/node"
+    ) and
+    (process.args like "-e*" or process.args_count <= 2)
+  ) or
+  (
+    process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
+    (process.args like "-r*" or process.args_count <= 2) and
+    not (
+      process.args like "var_export*" or
+      process.command_line in ("php -r echo get_current_user().PHP_EOL;", "php -r echo date('T');")
+    ) 
+  ) or
+  (
+    process.name in ("netcat", "nc", "ncat", "nc.traditional", "nc.openbsd") and (
+      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
+      process.command_line like "*http*"
+    ) and
+    not process.args in ("localhost", "127.0.0.1", "-z", "-zv") 
+  ) or
+  (
+    process.name == "socat" and
+    process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
+    process.command_line like~ ("*tcp*", "*udp*", "*openssl*")
+  ) or
+  (
+    process.name == "openssl" and (
+      process.command_line like ("*s_server*", "*s_client*") or
+      (process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A"))
+    )
+  ) or
+  (
+    process.name in ("curl", "wget") and process.args like~ ("-o", "--output*", "-o-") and (
+      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
+      process.command_line like "*http*"
+    ) and
+    process.command_line like ("* /tmp/*", "* /var/tmp/*", "* /dev/shm/*", "* /var/www/*", "* ~/*", "* /home/*", "* /run/*", "* /var/run/*")
+  ) or
+  (
+    process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
+    process.args like~ "-*d*"
+  ) or
+  (
+    process.name == "xxd" and process.args like~ ("-*r*", "-*p*")
+  ) or
+  (process.name == "sudo" and process.args == "-l") or
+  (
+    process.executable like ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") and
+    process.args like ("+x", "a+x", "0777", "755", "777", "+s", "u+s", "g+s")
+  ) or
+  (
+    process.executable like ("/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat") and
+    process.args like (
+      "/etc/passwd", "/etc/shadow", "/etc/hostname", "/etc/hosts", "*ssh*", "/proc/self/environ",
+      "*.env*", "*../../../*", "*/secrets/kubernetes.io/serviceaccount/*", "*/.docker/config.json*",
+      "*/.npmrc*", "*.aws/credentials*", "*/.aws/config*"
+    )
+  ) or
+  (
+    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
+    process.args in ("-c", "-cl", "-lc") and (
+      process.command_line like (
+        /* Suspicious Paths */
+        "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",
+
+        /* Interpreter Execution */
+        "*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",
+
+        /* Encoding, Decoding & Piping */
+        "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
+        "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
+        "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
+        "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
+
+        /* Reverse Shells */
+        "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
+
+        /* File Access */
+        "*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",
+
+        /* Helpers */
+        "*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",
+
+        /* Miscellaneous */
+        "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", 
+        
+        /* Decompression */
+        "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
+         
+         /* Path Traversal */
+         "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*"
+      ) or
+      (
+        process.command_line like ("*wget *", "*curl *") and
+        (
+          process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
+          process.command_line like ("*http*", "*ftp*")
+        ) and
+        (
+          (
+            process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
+            process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
+          ) or
+          (
+            (
+              process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
+              process.command_line like~ "*wget* --output-document*"
+            ) and
+          not process.command_line like """*--output-document "-"*"""
+          ) or
+          process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
+          (
+            process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
+            not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
+          )
+        ) and
+        not process.command_line like ("*-O /dev/null*", "*-o /dev/null*")
+      )
+    )
+  )
+) and
+not (
+  process.executable like ("/tmp/newroot/*", "/opt/lxc/*", "/var/snap/lxd/*") or
+  process.parent.command_line == "runc init" or
+  process.command_line in ("pickup -l -t unix -u", "pickup -l -t unix -u -c") or
+  (
+    process.parent.executable == "/etc/init.d/postfix" and process.command_line == "/bin/echo -n postfix is running"
+  ) or
+  (
+    process.parent.executable == "/usr/libexec/postfix/master" and
+    process.command_line in ("/usr/bin/hostname", "ps -eo pid,args", "uname -m")
+  ) or
+  (
+    process.parent.executable == "/usr/sbin/dovecot" and
+    process.command_line like "*/usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli/wpt-wp-cli.php*"
+  )
+)
+'''
+
+min_endpoint_version = "8.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1554"
+name = "Compromise Host Software Binary"
+reference = "https://attack.mitre.org/techniques/T1554/"
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1210"
+name = "Exploitation of Remote Services"
+reference = "https://attack.mitre.org/techniques/T1210/"
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "8.3.0"
diff --git a/behavior/rules/linux/persistence_payload_downloaded_via_curl_or_wget_by_web_server.toml b/behavior/rules/linux/persistence_payload_downloaded_via_curl_or_wget_by_web_server.toml
new file mode 100644
index 00000000..e71e6dc4
--- /dev/null
+++ b/behavior/rules/linux/persistence_payload_downloaded_via_curl_or_wget_by_web_server.toml
@@ -0,0 +1,215 @@
+[rule]
+description = """
+This rule detects when a web server downloads a payload via curl or wget. Attackers may exploit RCE or file upload
+vulnerabilities to download malicious files to web servers to gain/maintain access and to establish a command and
+control channel.
+"""
+id = "aac41cc3-fc4a-4dea-b8d6-252ded1cb3fc"
+license = "Elastic License v2"
+name = "Payload Downloaded via Curl or Wget by Web Server"
+os_list = ["linux"]
+version = "1.0.6"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
+  process.parent.name in (
+    "nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
+    "php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman",
+    "frankenphp", "zabbix_server", "asterisk", "sw-engine-fpm"
+  ) or
+  process.parent.name like ("php-fpm*", "gunicorn*", "*.cgi", "*.fcgi") or
+  (
+    process.parent.name like "ruby*" and
+    process.parent.command_line like~ ("*puma*", "*rails*", "*passenger*") and
+    not process.command_line like "*github.com/phusion/passenger/releases/download/release*"
+  ) or
+  (process.parent.name like "python*" and process.parent.command_line like~ (
+    "*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
+  )) or
+  (process.parent.name like "perl*" and process.parent.command_line like~ "*plackup*") or
+  (process.parent.name == "node" and process.parent.command_line like~ (
+    "*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
+    "*/app/*.js*", "*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*", "*n8n*"
+    ) and
+    not process.parent.args like (
+      "/opt/cursor-agent/*", "/home/*/*", "/root/*", "/opt/vscode-server/*", "/usr/lib/node_modules/openclaw/dist/index.js",
+      "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "openclaw-gateway"
+    )
+  ) or
+  (process.parent.name == "java" and process.parent.args like~ (
+    /* Tomcat */
+    "org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",
+
+    /* Jetty */
+    "org.eclipse.jetty.start.Main", "-Djetty.home=*",
+
+    /* WildFly / JBoss */
+    "org.jboss.modules.Main", "-Djboss.home.dir=*",
+
+    /* WebLogic */
+    "weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",
+
+    /* WebSphere traditional + Liberty */
+    "com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",
+
+    /* GlassFish */
+    "com.sun.enterprise.glassfish.bootstrap.ASMain",
+
+    /* Resin */
+    "com.caucho.server.resin.Resin",
+
+    /* Spring Boot */
+    "org.springframework.boot.loader.*",
+
+    /* Quarkus */
+    "*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",
+
+    /* Micronaut */
+    "io.micronaut.runtime.Micronaut",
+
+    /* Dropwizard */
+    "io.dropwizard.cli.ServerCommand",
+
+    /* Play */
+    "play.core.server.ProdServerStart",
+
+    /* Helidon */
+    "io.helidon.microprofile.server.Main", "io.helidon.webserver*",
+
+    /* Vert.x */
+    "io.vertx.core.Launcher",
+
+    /* Keycloak */
+    "org.keycloak*",
+
+    /* Apereo CAS */
+    "org.apereo.cas*",
+
+    /* Elasticsearch */
+    "org.elasticsearch.bootstrap.Elasticsearch",
+
+    /* Atlassian / Gerrit */
+    "com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",
+
+    /* Solr */
+    "*-Dsolr.solr.home=*"
+    )
+  )
+) and
+process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
+process.args in ("-c", "-cl", "-lc") and
+process.command_line like ("*wget *", "*curl *") and
+(
+  process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
+  process.command_line like ("*http*", "*ftp*")
+) and
+(
+  (
+    process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
+    process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
+  ) or
+  (
+    (
+      process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
+      process.command_line like~ "*wget* --output-document*"
+    ) and
+  not process.command_line like """*--output-document "-"*"""
+  ) or
+  process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
+  (
+    process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
+    not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
+  )
+) and
+not (
+  process.command_line like (
+    "*-O /dev/null*", "*-o /dev/null*", "*wget -qcO --user-agent=*", "*curl * | python -m json.tool",
+    "*http://:8008/dacx/fileoperation*", "*http://${host}:9000/api/system/liveness*"
+  ) or
+  (process.parent.name == "ruby" and process.command_line like "*/tmp/passenger-native-support-*") or
+  (process.parent.name == "asterisk" and process.command_line like "*bapi.*.group/v2/call/outgoing*") or
+  (process.parent.name == "node" and process.command_line like "*/tmp/.claude/shell-snapshots/*") or
+  (process.parent.name == "apache2" and process.command_line like "*/var/www/html/cacti/dati/weathermap/*.jpg")
+)
+'''
+
+min_endpoint_version = "8.2.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1505"
+name = "Server Software Component"
+reference = "https://attack.mitre.org/techniques/T1505/"
+[[threat.technique.subtechnique]]
+id = "T1505.003"
+name = "Web Shell"
+reference = "https://attack.mitre.org/techniques/T1505/003/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1210"
+name = "Exploitation of Remote Services"
+reference = "https://attack.mitre.org/techniques/T1210/"
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "8.2.0"
diff --git a/behavior/rules/linux/persistence_payload_execution_by_node.js_web_server.toml b/behavior/rules/linux/persistence_payload_execution_by_node.js_web_server.toml
new file mode 100644
index 00000000..d4fffa67
--- /dev/null
+++ b/behavior/rules/linux/persistence_payload_execution_by_node.js_web_server.toml
@@ -0,0 +1,184 @@
+[rule]
+description = """
+This rule detects when a Node.js web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities
+to execute malicious payloads on Node.js web servers to gain/maintain access and to establish a command and control
+channel.
+"""
+id = "b982a098-f3c6-42d7-958a-86c46f06360b"
+license = "Elastic License v2"
+name = "Payload Execution by Node.js Web Server"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
+process.parent.name == "node" and process.parent.command_line like~ (
+  "*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
+  "*/app/*.js*", "*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*", "*n8n*"
+) and
+process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
+process.args in ("-c", "-cl", "-lc") and (
+  process.command_line like~ (
+
+    /* Suspicious Paths */
+    "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",
+
+    /* Encoding, Decoding & Piping */
+    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
+    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
+    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
+    "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
+
+    /* Interpreter Execution */
+    "*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",
+
+    /* Reverse Shells */
+    "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
+    "*mkfifo /tmp/*", 
+
+    /* File Access */
+    "*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
+    "*/etc/passwd*", "*/etc/master.passwd*",
+
+    /* Enumeration & Discovery */
+    "*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
+    "*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
+    "*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",
+
+    /* AWS Credentials */
+    "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
+    "*.aws/credentials*", "*/.aws/config*",
+
+    /* Azure Credentials */
+    "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
+    "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
+    "*/run/secrets/azure/*",
+
+    /* GCP Credentials */
+    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
+    "*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",
+
+    /* Misc. Cloud */
+    "*/.docker/config.json*", "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",
+
+    /* Helpers */
+    "*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",
+
+    /* Miscellaneous */
+    "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
+    "*<?php*?>*", "*kworker*",
+    
+    /* Decompression */
+    "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
+    
+    /* Path Traversal */
+    "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",
+
+    /* File Upload/Download */
+    "*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
+  ) or
+  process.args in ("id", "whoami", "hostname")
+) and
+not (
+  process.command_line like (
+    "sh -c node -v || nodejs -v", "*./postinstall*", "*./_postinstall*", "/bin/sh -c lsb_release -sd",
+    "*/etc/freepbx.conf*", "*betterme/image-processing-service-admin-frontend*"
+  ) or
+  process.parent.args like (
+    "/opt/bitdefender/*", "/opt/cursor-agent/*", "/home/*/*", "/root/*", "/var/www/html/ext/.deloreanbuild",
+    "/usr/lib/node_modules/openclaw/dist/index.js", "/opt/yarn*", "*anthropic-ai/claude-code/cli.js*",
+    "/usr/bin/docker-builder", "/opt/jenkins/.nvm/versions/node/*/bin/npm", "/usr/local/renovate/node",
+    "/opt/buildagent/work/*/node_modules/.bin/cypress", "/var/www/html/ext/node_modules/.bin/webpack",
+    "/opt/containerbase/tools/node/*/bin/node", "/opt/*/bin/*/node_modules/.bin/bower"
+  ) or
+  process.args like ("npx *", "node /var/www/html/ext/node_modules/.bin/webpack*", "grep* | awk*") or
+  process.parent.executable like (
+    "/user/*/.vscode-server/cli/servers/*/server/node", "/scratch/*/.vscode-server/cli/servers/*/server/node",
+    "/users/*/.vscode-server/*/node", "/opt/code-server/*/lib/node", "/opt/jenkins/workspace/*/bin/node",
+    "/scratch/user/*/.cursor-server/bin/linux-x64/*/node"
+  ) or
+  process.working_directory == "/runner/_work/personify/personify/node_modules/snyk" or
+  (process.command_line like "*REPO_NAME*" and process.parent.args == "/usr/bin/n8n")
+)
+'''
+
+min_endpoint_version = "8.2.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1505"
+name = "Server Software Component"
+reference = "https://attack.mitre.org/techniques/T1505/"
+[[threat.technique.subtechnique]]
+id = "T1505.003"
+name = "Web Shell"
+reference = "https://attack.mitre.org/techniques/T1505/003/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1210"
+name = "Exploitation of Remote Services"
+reference = "https://attack.mitre.org/techniques/T1210/"
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "8.2.0"
diff --git a/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml b/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
new file mode 100644
index 00000000..a9622651
--- /dev/null
+++ b/behavior/rules/linux/persistence_setcap_setuid_setgid_capability_set.toml
@@ -0,0 +1,78 @@
+[rule]
+description = """
+This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabilities via setcap. Setuid (Set User ID)
+and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated privileges, based on the
+file owner or group. Threat actors can exploit these attributes to achieve persistence by creating malicious binaries,
+allowing them to maintain control over a compromised system with elevated permissions.
+"""
+id = "c1556f07-4184-42dc-a55c-866011a63715"
+license = "Elastic License v2"
+name = "Setcap setuid/setgid Capability Set"
+os_list = ["linux"]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+process.name == "setcap" and process.command_line like "*cap_set?id+ep*" and
+not (
+  process.parent.name in ("jem", "vzctl") or
+  process.args like "/usr/bin/new?idmap"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.001"
+name = "Setuid and Setgid"
+reference = "https://attack.mitre.org/techniques/T1548/001/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.001"
+name = "Setuid and Setgid"
+reference = "https://attack.mitre.org/techniques/T1548/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/persistence_suspicious_echo_execution.toml b/behavior/rules/linux/persistence_suspicious_echo_execution.toml
index 632dd365..934937dc 100644
--- a/behavior/rules/linux/persistence_suspicious_echo_execution.toml
+++ b/behavior/rules/linux/persistence_suspicious_echo_execution.toml
@@ -9,7 +9,7 @@ id = "a13c8f01-36a5-4ad7-a282-8d297cf62860"
 license = "Elastic License v2"
 name = "Suspicious Echo Execution"
 os_list = ["linux"]
-version = "1.0.30"
+version = "1.0.31"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -77,7 +77,15 @@ not (
     "/home/*/*/codex/codex", "/home/*/.cache/JetBrains/*/codex-x86_64-unknown-linux-musl", "/home/*/.cursor-server/extensions/*/codex",
     "/scratch/user/*/.vscode-server/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex", "/home/*/.aimee-code/bin/claude",
     "/root/.opencode/bin/opencode", "/scratch/user/*/.nvm/versions/node/*/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe",
-    "/user/*/.vscode-server/extensions/openai.chatgpt-*/bin/linux-x86_64/codex", "/usr/local/bin/teleport", "/usr/bin/coreutils"
+    "/user/*/.vscode-server/extensions/openai.chatgpt-*/bin/linux-x86_64/codex", "/usr/local/bin/teleport", "/usr/bin/coreutils",
+    "/mnt/fast/nobackup/users/*/.local/share/code-server/extensions/*-linux-x64/resources/native-binary/claude",
+    "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl", "/usr/local/lib/claude-code/claude-bin",
+    "/home/*/.vscode/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex", "/home/*/.chipagents/chipagents/*/bin/chipagents-linux-x64",
+    "/home/*/.windsurf-server/extensions/anthropic.claude-code-*-linux-x64/resources/native-binary/claude",
+    "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode",
+    "/var/lib/docker/overlay2/*/merged/app/node_modules/@anthropic-ai/claude-agent-sdk-linux-x64/claude",
+    "/usr/local/share/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe", "/home/*/.opencode/bin/opencode",
+    "/mnt/*/user/home/*/.local/share/claude/versions/*"
   ) or
   process.parent.command_line in (
     "runc init", "buildkit-runc init", "/usr/local/bin/runc init", "python ./ssh.py --update-fingerprints bi_team",
@@ -116,14 +124,17 @@ not (
     "/nix/store/*", "/usr/bin/swatchdog*", "/usr/local/hostguard/data/benchmark/module/SSH/playbook.py",
     "/tmp/kubectl*.yaml", "./mmicro-control.pl", "/usr/local/bin/vncserver", "buildah-chroot-exec", "/usr/libexec/crio/crun",
     "/usr/bin/crun", "/usr/bin/vncserver", "/tmp/ansible_*/ansible_module_command.py", "/opt/calculus/farmer/app/farmer.py",
-    "openclaw-gateway", "lxc-attach", "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "/home/*/openclaw/openclaw.mjs"
+    "openclaw-gateway", "lxc-attach", "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "/home/*/openclaw/openclaw.mjs",
+    "/bin/segfaultsh"
   ) or
   process.working_directory like ("/var/local/InterMapper_Settings/Tools", "/usr/local/gateway-*", "/repo/o11y/out/*/.terraform/*") or
   (process.working_directory == "/etc/prometheus" and process.parent.command_line == "tmux -Lwarp -CC") or
   (process.parent.name == "node" and process.command_line like~ ("*/tmp/claude*", "/usr/bin/bash -O extglob -c*")) or
   (process.parent.name == "php" and process.command_line like "sh -c timeout 7200 ssh*") or
   (process.parent.name == "node" and process.args == "extglob") or
-  (process.parent.name like "python*" and process.args like ("declare -A categories*", "files=*", "set -x*$BACKUP_NAME.tar.gz*", "*while_finding_grubconfigs*"))
+  (process.parent.name like "python*" and process.args like ("declare -A categories*", "files=*", "set -x*$BACKUP_NAME.tar.gz*", "*while_finding_grubconfigs*")) or
+  (process.parent.executable == "/usr/local/bin/php" and process.args like "timeout*/var/www/html/storage/app/ssh/mux/mux*") or
+  (process.parent.executable == "/usr/bin/perl" and process.command_line like "*/tmp/recover_SAP/settings*")
 )
 '''
 
diff --git a/behavior/rules/linux/persistence_suspicious_python_path_configuration_file_(.pth)_creation.toml b/behavior/rules/linux/persistence_suspicious_python_path_configuration_file_(.pth)_creation.toml
new file mode 100644
index 00000000..ca841790
--- /dev/null
+++ b/behavior/rules/linux/persistence_suspicious_python_path_configuration_file_(.pth)_creation.toml
@@ -0,0 +1,78 @@
+[rule]
+description = """
+Detects creation or change of a Python path configuration file (.pth) with a suspicious import preface, file size or
+entropy. This rule matches .pth files whose leading bytes correspond to UTF-8 text beginning with an import-style
+preface (for example, the string starting with "import os, subpr" as used before subprocess or similar calls). That
+pattern is atypical and may indicate code execution via the .pth mechanism.
+"""
+id = "983dc90f-7eb0-4832-a537-3854b40d31fa"
+license = "Elastic License v2"
+name = "Suspicious Python Path Configuration File (.pth) Creation"
+os_list = ["linux"]
+reference = [
+    "https://dfir.ch/posts/publish_python_pth_extension/",
+    "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/",
+    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
+    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
+]
+version = "1.0.1"
+
+query = '''
+file where event.type in ("change", "creation") and file.extension like "pth" and (
+  file.Ext.header_bytes like "696d706f7274206f732c207375627072" or
+  (
+    file.path like "*site-packages*" and
+    (file.size >= 30000 or file.Ext.entropy >= 5.5)
+  )
+)
+'''
+
+min_endpoint_version = "9.3.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.006"
+name = "Python"
+reference = "https://attack.mitre.org/techniques/T1059/006/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1546"
+name = "Event Triggered Execution"
+reference = "https://attack.mitre.org/techniques/T1546/"
+
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "9.3.0"
diff --git a/behavior/rules/linux/privilege_escalation_potential_privilege_escalation_via_suid_sgid_proxy_execution.toml b/behavior/rules/linux/privilege_escalation_potential_privilege_escalation_via_suid_sgid_proxy_execution.toml
new file mode 100644
index 00000000..ad097218
--- /dev/null
+++ b/behavior/rules/linux/privilege_escalation_potential_privilege_escalation_via_suid_sgid_proxy_execution.toml
@@ -0,0 +1,112 @@
+[rule]
+description = """
+Detects potential privilege escalation via SUID/SGID proxy execution on Linux systems. Attackers may exploit binaries
+with the SUID/SGID bit set to execute commands with elevated privileges. This rule identifies instances where a process
+is executed with root privileges (user ID 0 or group ID 0) while the real user or group ID is non-root, indicating
+potential misuse of SUID/SGID binaries.
+"""
+id = "86ef3949-5a1e-4e71-93a8-8e0ee90a71af"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via SUID/SGID Proxy Execution"
+os_list = ["linux"]
+reference = [
+    "https://dfir.ch/posts/today_i_learned_binfmt_misc/",
+    "https://gtfobins.github.io/#+suid",
+    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
+]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+startswith~(process.command_line, process.executable) and process.parent.args_count == 1 and
+(
+  (process.user.id == 0 and process.real_user.id != 0) or
+  (process.group.id == 0 and process.real_group.id != 0)
+) and
+process.args in (
+  "/bin/su", "/usr/bin/su",
+  "/bin/umount", "/usr/bin/umount",
+  "/bin/chfn", "/usr/bin/chfn",
+  "/bin/chsh", "/usr/bin/chsh",
+  "/bin/gpasswd", "/usr/bin/gpasswd",
+  "/bin/newgrp", "/usr/bin/newgrp",
+  "/usr/bin/newuidmap", "/usr/bin/newgidmap",
+  "/usr/lib/dbus-1.0/dbus-daemon-launch-helper", "/usr/libexec/dbus-daemon-launch-helper",
+  "/usr/lib/openssh/ssh-keysign", "/usr/libexec/openssh/ssh-keysign",
+  "/usr/bin/pkexec", "/usr/libexec/pkexec", "/usr/lib/polkit-1/pkexec",
+  "/usr/lib/snapd/snap-confine"
+) and
+process.args_count <= 2
+/*
+Need to exclude this in the future.
+Leaving this in now because of the current CopyFail CVE-2026-24061, but it does not detect what this rule is supposed to detect.
+and not process.name == "su" and process.args == "-"
+*/
+'''
+
+min_endpoint_version = "8.6.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1068"
+name = "Exploitation for Privilege Escalation"
+reference = "https://attack.mitre.org/techniques/T1068/"
+
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.001"
+name = "Setuid and Setgid"
+reference = "https://attack.mitre.org/techniques/T1548/001/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "System Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.001"
+name = "Setuid and Setgid"
+reference = "https://attack.mitre.org/techniques/T1548/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "8.6.0"
diff --git a/behavior/rules/windows/collection_keystroke_capture_by_unsigned_process.toml b/behavior/rules/windows/collection_keystroke_capture_by_unsigned_process.toml
index 9fc02463..17daa3b5 100644
--- a/behavior/rules/windows/collection_keystroke_capture_by_unsigned_process.toml
+++ b/behavior/rules/windows/collection_keystroke_capture_by_unsigned_process.toml
@@ -12,14 +12,14 @@ reference = [
     "https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexa",
     "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
 ]
-version = "1.0.2"
+version = "1.0.3"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
  [process where event.action == "start" and
   process.Ext.relative_file_creation_time <= 300 and user.id != "S-1-5-18" and
   (process.code_signature.trusted == false or process.code_signature.exists == false) and
-  not process.executable : ("?:\\Prgram Files\\*.exe", "?:\\Prgram Files (x86)\\*.exe")]
+  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")]
  [api where process.Ext.api.name == "SetWindowsHookEx" and
   process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL" and process.Ext.api.parameters.hook_module == "null" and
   _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
diff --git a/behavior/rules/windows/defense_evasion_binary_masquerading_via_untrusted_path.toml b/behavior/rules/windows/defense_evasion_binary_masquerading_via_untrusted_path.toml
index 64428c4c..bed78e0c 100644
--- a/behavior/rules/windows/defense_evasion_binary_masquerading_via_untrusted_path.toml
+++ b/behavior/rules/windows/defense_evasion_binary_masquerading_via_untrusted_path.toml
@@ -12,7 +12,7 @@ reference = [
     "https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine",
     "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
 ]
-version = "1.0.54"
+version = "1.0.55"
 
 query = '''
 process where event.action == "start" and
@@ -129,7 +129,7 @@ process where event.action == "start" and
   not (process.name : "services.exe" and process.args : "-i*" and process.parent.name : "monitor.exe") and
   not (process.name : "RegAsm.exe" and process.args : ("directdeposit.vb.tlb", "?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")) and
   not process.executable : "D:\\Reform V*\\Reform_PDC_Server_v*\\Plugins\\Monitoring\\CScript.exe" and
-  not (process.name : "rundll32.exe" and process.code_signature.subject_name in ("Teramind Inc.", "STAKHANOVETS LIMITED LIABILITY COMPANY") and process.code_signature.trusted == true) and
+  not (process.name : "rundll32.exe" and process.code_signature.subject_name : ("Teramind Inc.", "STAKHANOVETS LIMITED LIABILITY COMPANY") and process.code_signature.trusted == true) and
   not (process.name : "regsvr32.exe" and
        process.args : ("?:\\Sage\\Sage300 Programs\\GL69A\\FRCOM690.DLL",
                        "?:\\Program Files (x86)\\*.dll",
@@ -162,6 +162,10 @@ process where event.action == "start" and
   not (process.executable : "C:\\ProgramData\\baramundi\\bma\\Downloads\\Temp\\netsh.exe" and
        process.args : "exec" and process.args : "\\\\*.txt") and
   not (process.name : "bcdedit.exe" and process.args : "/enum") and
+  not (process.executable : "?:\\Windows\\LFSAgent\\services.exe" and
+       process.code_signature.trusted == true and
+       process.code_signature.subject_name : "LEPIDE SOFTWARE PRIVATE LIMITED") and
+  not (process.name : "ping.exe" and process.executable : "?:\\Windows\\Temp\\pdk-SYSTEM-*\\ping.exe") and
   not (process.code_signature.subject_name : ("JetBrains s.r.o.", "LG Electronics Inc.", "Timothy Hugh Perry", "Code Systems Corporation", "Douyin Vision Co., Ltd.", "Hangzhou Hikvision Digital Tech.Co.,Ltd") and process.code_signature.trusted == true) and
   not process.hash.sha256 :
                   ("7c621ec91b71d14494beddaae8edb67ed26baa257d750546772aa90653ad6016",
diff --git a/behavior/rules/windows/defense_evasion_suspicious_image_load_from_smb_shares.toml b/behavior/rules/windows/defense_evasion_suspicious_image_load_from_smb_shares.toml
index 86058dfa..63c919ff 100644
--- a/behavior/rules/windows/defense_evasion_suspicious_image_load_from_smb_shares.toml
+++ b/behavior/rules/windows/defense_evasion_suspicious_image_load_from_smb_shares.toml
@@ -7,7 +7,7 @@ id = "c9674e88-8423-442a-9712-ba6271bcff10"
 license = "Elastic License v2"
 name = "Suspicious Image Load from SMB Shares"
 os_list = ["windows"]
-version = "1.0.22"
+version = "1.0.23"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
@@ -24,21 +24,16 @@ sequence by process.entity_id with maxspan=1m
   process.executable != null and
   (
    (dll.name : ("ws2_32.dll", "wininet.dll", "psapi.dll") and
-    process.thread.Ext.call_stack_summary : "*kernelbase.dll|Unbacked*" and
-    not process.thread.Ext.call_stack_summary :
-            ("*mscorlib.dll*","*|clr.dll*", "*coreclr.dll*", "*mscoreei.dll*", "*mscoree.dll*", "*system.ni.dll*",
-             "*mscorlib.ni.dll*", "*mscorwks.dll*", "*mscorsvc.dll*", "*system.private.corelib.dll*", 
-             "*java.dll|Unbacked*", "*system.data.ni.dll*", "*|ntdll.dll|Unbacked|ntdll.dll", "*windowsbase.ni.dll*",
-             "*presentationframework.ni.dll*", "*system.windows.forms.ni.dll|Unbacked*")) or
+    process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|Unbacked") or
 
    dll.name : ("dsquery.dll", "System.Management.Automation.dll")
   ) and 
   not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
-  not dll.hash.sha256 in ("fb26504a5d5a1b2045e526f873b84bbba57ea5715a16d2f48e26919abc273240",
-                          "69f405cc2dd111d208799ad47273551e9d572423bcf251bc9347d481a162b207",
-                          "550c6c449f101e9eebf00906ef04de5427f9e8dc27fef57bd03cb02f8cd3a0f7",
-                          "aee47f2535e0196552513d37be8411a9b9c649a50c3d847488162580d8b88793") and
-
+  not (dll.name : "ws2_32.dll" and process.executable : "\\Device\\Mup\\*.edu\\*\\IDTest.exe") and 
+  not (dll.name : "wininet.dll" and process.executable : "\\Device\\Mup\\nf01\\Application\\*.exe") and 
+  not (process.name : "UiPath.ActivityCompiler.CommandLine.exe" and process.code_signature.subject_name : "UiPath, Inc." and 
+       process.code_signature.trusted == true and dll.name : "System.Management.Automation.dll") and 
+       
   not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_leading_bytes :
                          ("ffeb1e8d4e0ce86482000083660400684c5*",
diff --git a/behavior/rules/windows/defense_evasion_suspicious_parent_child_relationship.toml b/behavior/rules/windows/defense_evasion_suspicious_parent_child_relationship.toml
index c52d05ff..6fb8a727 100644
--- a/behavior/rules/windows/defense_evasion_suspicious_parent_child_relationship.toml
+++ b/behavior/rules/windows/defense_evasion_suspicious_parent_child_relationship.toml
@@ -12,7 +12,7 @@ reference = [
     "https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware",
     "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
 ]
-version = "1.0.43"
+version = "1.0.44"
 
 query = '''
 process where event.action == "start" and
@@ -89,7 +89,11 @@ process where event.action == "start" and
         process.parent.executable : ("?:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Starter.exe",
                                      "?:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Container Helper.exe")) and
    not (process.executable : "C:\\Windows\\Sys?????\\wbem\\WmiPrvSE.exe" and process.args : "/RegServer" and process.parent.name : ("powershell.exe", "cmd.exe")) and 
-   not (process.parent.name == "lsass.exe" and process.args : "C:\\Program` Files\\PasswordRBL\\passwdfw.ps1")
+   not (process.parent.name == "lsass.exe" and process.args : "C:\\Program Files\\PasswordRBL\\passwdfw.ps1") and
+   not (process.name : "services.exe" and process.parent.executable : "?:\\Windows\\LFSAgent\\lasrv.exe" and
+        process.code_signature.trusted == true and
+        process.code_signature.subject_name : "LEPIDE SOFTWARE PRIVATE LIMITED") and
+   not (process.name : "LogonUI.exe" and process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\FileCoAuth.exe")
 '''
 
 min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/windows/initial_access_suspicious_virtualprotect_via_jscript9_from_internet_explorer.toml b/behavior/rules/windows/initial_access_suspicious_virtualprotect_via_jscript9_from_internet_explorer.toml
index e1cdd71c..e2cb8e4c 100644
--- a/behavior/rules/windows/initial_access_suspicious_virtualprotect_via_jscript9_from_internet_explorer.toml
+++ b/behavior/rules/windows/initial_access_suspicious_virtualprotect_via_jscript9_from_internet_explorer.toml
@@ -11,7 +11,7 @@ reference = [
     "https://asec.ahnlab.com/en/83877/",
     "https://medium.com/s2wblog/unmasking-cve-2024-38178-the-silent-threat-of-windows-scripting-engine-91ad954dbf83",
 ]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 api where process.Ext.api.name == "VirtualProtect" and
@@ -31,7 +31,7 @@ api where process.Ext.api.name == "VirtualProtect" and
  process.Ext.api.metadata.target_address_path != "c:\\program files\\cerner\\ietools (64-bit)\\ietools.dll" and
  not process.thread.Ext.call_stack_final_user_module.path like 
                                      ("c:\\windows\\syswow64\\msvbvm??.dll", 
-                                      "c:\\windows\\microsoft.net\\frameworkv*\\mscorwks.dll", 
+                                      "c:\\windows\\microsoft.net\\framework\\v*\\mscorwks.dll", 
                                       "c:\\windows\\syswow64\\mfcore.dll") and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
     $entry.subject_name in (
diff --git a/behavior/rules/windows/persistence_suspicious_startup_persistence_via_a_windows_installer.toml b/behavior/rules/windows/persistence_suspicious_startup_persistence_via_a_windows_installer.toml
index bee7e230..831526b7 100644
--- a/behavior/rules/windows/persistence_suspicious_startup_persistence_via_a_windows_installer.toml
+++ b/behavior/rules/windows/persistence_suspicious_startup_persistence_via_a_windows_installer.toml
@@ -7,7 +7,7 @@ id = "9f7aece1-355c-4e72-a7ea-767d5cccb12d"
 license = "Elastic License v2"
 name = "Suspicious Startup Persistence via a Windows Installer"
 os_list = ["windows"]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 any where process.name : "msiexec.exe" and
@@ -20,7 +20,10 @@ any where process.name : "msiexec.exe" and
     registry.data.strings : ("*C:\\Users*\\*\\Contacts\\*", "*cmd*/c*", "*powershell*", "*node.exe*.js*", "*rundll32*",
                              "*mshta.exe*", "*wscript.exe*", "*cscript.exe*", "*C:\\Users\\Public\\*") and
     not registry.data.strings :
-                  ("rundll32.exe \"C:\\Program Files\\VMware\\VMware View\\Agent\\bin\\MessageFrameWork.dll\",EnvSyncW",
+                  ("rundll32.exe \"?:\\Program Files\\VMware\\VMware View\\Agent\\bin\\MessageFrameWork.dll\",EnvSyncW",
+                   "rundll32.exe ?:\\PROGRA~1\\Omnissa\\Horizon\\Agent\\bin\\MESSAG~1.DLL,EnvSyncW",
+                   "rundll32.exe \"?:\\Program Files\\Omnissa\\Horizon\\Agent\\bin\\MessageFrameWork.dll\",EnvSyncW",
+                   "rundll32.exe DR*Svc.dll,EntryPointUserMessage",
                    "rundll32.exe DR*SVC.dll, EntryPointUserMessage",
                    "rundll32.exe P*Svc.dll, EntryPointUserMessage",
                    "rundll32.exe DRV*.dll,EntryPointUserMessage",