diff --git a/behavior/rules/cross-platform/privilege_escalation_suspicious_privileged_docker_execution.toml b/behavior/rules/cross-platform/privilege_escalation_suspicious_privileged_docker_execution.toml
index 127090ea..c711393e 100644
--- a/behavior/rules/cross-platform/privilege_escalation_suspicious_privileged_docker_execution.toml
+++ b/behavior/rules/cross-platform/privilege_escalation_suspicious_privileged_docker_execution.toml
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Suspicious Privileged Docker Execution"
 os_list = ["linux", "macos"]
 reference = ["https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack"]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.name == "docker" and
@@ -19,7 +19,8 @@ not (
   (process.args == "prepare" and process.args in ("/:/hostfs", "/:/hostfs/")) or
   (process.args == "aktosecurity/mirror-api-logging:k8s_ebpf" and process.args == "akto-api-security-traffic-collector") or
   (process.args == "/usr/sbin/ceph-volume" and process.args == "--group-add=disk" and process.args == "--stop-signal=SIGTERM") or
-  (process.args like "eu.gcr.io/revolut-labs/cardfinder*" and process.parent.args == "/srv/cardfinder/cardfinder.sh")
+  (process.args like "eu.gcr.io/revolut-labs/cardfinder*" and process.parent.args == "/srv/cardfinder/cardfinder.sh") or
+  process.parent.args == "/usr/local/pf/sbin/netdata-docker-wrapper"
 )
 '''
 
diff --git a/behavior/rules/linux/command_and_control_file_download_from_or_upload_to_hosting_service.toml b/behavior/rules/linux/command_and_control_file_download_from_or_upload_to_hosting_service.toml
index 6247c1c9..01ec2529 100644
--- a/behavior/rules/linux/command_and_control_file_download_from_or_upload_to_hosting_service.toml
+++ b/behavior/rules/linux/command_and_control_file_download_from_or_upload_to_hosting_service.toml
@@ -7,7 +7,7 @@ id = "5c18132a-e279-404e-a8d8-922546d469a7"
 license = "Elastic License v2"
 name = "File Download from or Upload to Hosting Service"
 os_list = ["linux"]
-version = "1.0.7"
+version = "1.0.8"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and
@@ -15,7 +15,7 @@ process.command_line like~ (
   "*pastebin.*", "*ghostbin.*", "*hastebin.*", "*termbin.*", "*dpaste.*", "*controlc.*", "*0bin.net*", "*p.ip.fi*", "*sprunge.us*", "*paste.ee*",
   "*paste.ofcode.org*", "*textbin.net*", "*transfer.sh*", "*anonfiles.*", "*easyupload.io*", "*gofile.io*", "*send.cm*", "*ufile.io*",
   "*pixeldrain.com*", "*bayfiles.*", "*megaupload.*", "*mediafire.*", "*zippyshare.com*", "*dropapk.to*", "*shorturl.at*", "*tinyurl.com*",
-  "*bit.ly/*", "*cutt.ly/*", "*is.gd/*", "*rebrand.ly/*", "*adf.ly/*", "*rb.gy/*", "*bashupload.com/*", "*bujang.online/*"
+  "*bit.ly/*", "*cutt.ly/*", "*is.gd/*", "*rebrand.ly/*", "*adf.ly/*", "*rb.gy/*", "*bashupload.com/*", "*bujang.online/*", "*paste.wakas.org*"
 ) and not (
   process.parent.executable in ("/opt/aws/awsagent/bin/update", "/batch/pac.liste.categorie.sh") or
   process.parent.args == "/usr/local/gg/crowdsec-extract.sh"
diff --git a/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml b/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
index 256c97e9..16f1cc16 100644
--- a/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
+++ b/behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
@@ -7,12 +7,13 @@ id = "c14705f7-ebd3-4cf7-88b3-6bff2d832f1b"
 license = "Elastic License v2"
 name = "Hidden Executable Initiated Egress Network Connection"
 os_list = ["linux"]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 sequence by process.entity_id with maxspan=10s
   [process where event.type == "start" and event.action == "exec" and process.name like ".*" and
-   process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"]
+   process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and
+   not process.executable like "/home/*/.npm/_npx/*/node_modules/opencode-ai/bin/.opencode"]
   [network where event.type == "start" and event.action == "connection_attempted" and not (
      destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
        destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
diff --git a/behavior/rules/linux/defense_evasion_potential_process_masquerading_via_exec.toml b/behavior/rules/linux/defense_evasion_potential_process_masquerading_via_exec.toml
index 0adcdc6e..a5a2acf5 100644
--- a/behavior/rules/linux/defense_evasion_potential_process_masquerading_via_exec.toml
+++ b/behavior/rules/linux/defense_evasion_potential_process_masquerading_via_exec.toml
@@ -8,7 +8,7 @@ id = "e6669bc3-cb75-4fb3-91e0-ddaa06dd59b2"
 license = "Elastic License v2"
 name = "Potential Process Masquerading via Exec"
 os_list = ["linux"]
-version = "1.0.13"
+version = "1.0.15"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -20,6 +20,9 @@ process.args == "-c" and process.command_line : "* exec -a *" and not (
     "/usr/NX/bin/nxnode.bin", "/usr/bin/gnome-shell", "/var/lib/dpkg/info/udev.postinst", "/usr/bin/bcompare", 
     "/usr/bin/su"
   ) or
+  process.parent.executable like ("/home/*/.local/share/claude/*", "/home/*/.local/bin/klaude") or
+  process.parent.args == "claude" or
+  process.parent.name == "claude" or
   process.command_line like (
     "*/tmp/fzf-args*", "/opt/sp/serverpilot/*", "*/opt/forticlientems/*", "*WarpTerminal*", "/bin/bash -c exec -a bash*",
     "/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard""",
@@ -31,7 +34,8 @@ process.args == "-c" and process.command_line : "* exec -a *" and not (
     "exec -a sp-monitor /opt/sp/serverpilot/monitor/bin/monitor",
     "exec -a sp-stats /opt/sp/serverpilot/stats/bin/sp-stats",
     "/usr/bin/bcompare", "/usr/lib64/beyondcompare/BCompare"
-  )
+  ) or
+  process.parent.command_line == "runc init"
 )
 '''
 
diff --git a/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml b/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
index 2077b00a..80227e41 100644
--- a/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
+++ b/behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "Shared Object Injection via Process Environment Variable"
 os_list = ["linux"]
 reference = ["https://attack.mitre.org/techniques/T1574/006/"]
-version = "1.0.45"
+version = "1.0.46"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.env_vars like "LD_PRELOAD=?*" and 
@@ -57,7 +57,7 @@ process where event.type == "start" and event.action == "exec" and process.env_v
     "LD_PRELOAD=/usr/lib/libjemalloc.so.2:/opt/zlib-ng/lib/libz.so",
     "LD_PRELOAD=/lib/x86_64-linux-gnu/libSegFault.so", "LD_PRELOAD=/usr/lib/libnss_wrapper.so",
     "LD_PRELOAD=/tmp/*/openwrt-imagebuilder*/runas.so", "LD_PRELOAD=/tmp/pressure-vessel-libs-*/libMangoHud_shim.so",
-    "LD_PRELOAD=/home/libjemalloc.so.2"
+    "LD_PRELOAD=/home/libjemalloc.so.2", "LD_PRELOAD=/tmp/libredirectnull.so", "LD_PRELOAD=/tmp/libcuda_trace.so"
   ) or
   (process.env_vars == "LD_PRELOAD=./getrandom.so" and process.parent.command_line == "/opt/perlbrew/perls/perl-5.40.3/bin/perl t/getrandom.t") or
   process.parent.command_line == "runc init" or
diff --git a/behavior/rules/linux/execution_javascript_execution_via_deno_on_linux.toml b/behavior/rules/linux/execution_javascript_execution_via_deno_on_linux.toml
new file mode 100644
index 00000000..4cbd8893
--- /dev/null
+++ b/behavior/rules/linux/execution_javascript_execution_via_deno_on_linux.toml
@@ -0,0 +1,50 @@
+[rule]
+description = """
+Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this
+utility to execute malicious JavaScript.
+"""
+id = "9c78eda8-68e7-49a8-87d2-5364381ba624"
+license = "Elastic License v2"
+name = "JavaScript Execution via Deno on Linux"
+os_list = ["linux"]
+reference = ["https://deno.com/"]
+version = "1.0.0"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.name == "deno" and
+process.command_line like~ ("*base64*", "*eval(*", "*http*", "*javascript*import*") and
+not process.command_line == "deno run --allow-all --quiet --no-config https://deno.land/x/wmill/main.ts completions zsh"
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml b/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
index 0e516e72..13ae999d 100644
--- a/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
+++ b/behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
@@ -8,7 +8,7 @@ id = "aa02591f-c9e6-4317-841e-0b075b9515ff"
 license = "Elastic License v2"
 name = "Linux Suspicious Child Process Execution via Interactive Shell"
 os_list = ["linux"]
-version = "1.0.19"
+version = "1.0.20"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.args in ("-i", "-il", "-li") and process.args_count <= 2 and
@@ -35,7 +35,8 @@ process.parent.name like (
     "/mnt/*/.vscode-server/bin/*/node", "/vscode/vscode-server/bin/*/node", "/home/*/.vscode-server/bin/*/node",
     "/usr/scratch/*/.vscode-server/bin/*/node", "/home/*/.vscode-server/*/server/node", "/scratch/user/*/.vscode-server/cli/servers/*/server/node",
     "/home/*/.vscode/cli/servers/*/server/node", "/root/.vscode-server/cli/servers/*/server/node", "/mnt/*/.vscode-server/cli/servers/*/server/node",
-    "/home/*/.antigravity-server/bin/*/node", "/user/*/.trae-server/bin/*/node"
+    "/home/*/.antigravity-server/bin/*/node", "/user/*/.trae-server/bin/*/node", "/var/lib/docker/overlay2/*/merged/vscode/vscode-server/bin/linux-x64/*/node",
+    "/home/*/miniforge3/envs/*/bin/python*"
   ) or
   (process.parent.command_line like ("*pipenv*", "*poetry*") and process.parent.args:"shell")
 )
diff --git a/behavior/rules/linux/execution_potential_reverse_shell_via_named_pipe.toml b/behavior/rules/linux/execution_potential_reverse_shell_via_named_pipe.toml
index 397b5727..97fdbb74 100644
--- a/behavior/rules/linux/execution_potential_reverse_shell_via_named_pipe.toml
+++ b/behavior/rules/linux/execution_potential_reverse_shell_via_named_pipe.toml
@@ -7,7 +7,7 @@ id = "40bec6eb-e93b-4d09-8265-66bba186e332"
 license = "Elastic License v2"
 name = "Potential Reverse Shell via Named Pipe"
 os_list = ["linux"]
-version = "1.0.15"
+version = "1.0.16"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -21,7 +21,7 @@ process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish
     process.parent.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
   )
 ) and
-not (process.name == "mknod" and process.args like ("/var/tmp/dracut*", "/tmp/dracut.*", "/var/tmp/portage/*", "/tmp/dib_build*"))
+not (process.name == "mknod" and process.args like ("/var/tmp/dracut*", "/tmp/dracut.*", "/var/tmp/portage/*", "/tmp/dib_build*", "/tmp/bootstrap-salt.logpipe"))
 '''
 
 min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/execution_sleep_execution_from_suspicious_process_path.toml b/behavior/rules/linux/execution_sleep_execution_from_suspicious_process_path.toml
index 61b39d52..4a5bb339 100644
--- a/behavior/rules/linux/execution_sleep_execution_from_suspicious_process_path.toml
+++ b/behavior/rules/linux/execution_sleep_execution_from_suspicious_process_path.toml
@@ -7,7 +7,7 @@ id = "9e879677-2317-4c1d-bddb-8fa4629be810"
 license = "Elastic License v2"
 name = "Sleep Execution from Suspicious Process Path"
 os_list = ["linux"]
-version = "1.0.13"
+version = "1.0.14"
 
 query = '''
 sequence by process.parent.entity_id with maxspan=5s
@@ -21,7 +21,7 @@ sequence by process.parent.entity_id with maxspan=5s
       "/tmp/*/.venv/bin/python", "/tmp/text_templater_*", "/var/tmp/container*/usr/bin/dpkg", "/tmp/container*/usr/bin/dpkg",
       "/run/systemd/mount-rootfs/nix/store/*", "/tmp/xfs-*/yarn", "/tmp/root/spack*", "/tmp/nix-shell-*/node",
       "/tmp/nix-shell-*/yarn", "/var/tmp/portage/*", "/tmp/.*.ansible/ansible-tmp-*", "/tmp/nsjail.1000.root/usr/bin/sleep",
-      "/tmp/usr/bin/*", "/tmp/build/.heroku/node/bin/npm", "/tmp/petalinux/*", "/tmp/tailsampling-*"
+      "/tmp/usr/bin/*", "/tmp/build/.heroku/node/bin/npm", "/tmp/petalinux/*", "/tmp/tailsampling-*", "/tmp/*/.cursor-server/bin/linux-x64/*/node"
     ) or
     process.command_line == "runc init" or
     process.name in ("gcc", "xgcc", "nvim") or
@@ -32,7 +32,7 @@ sequence by process.parent.entity_id with maxspan=5s
     ) or
     process.parent.executable like (
       "/tmp/go-build*", "/tmp/newroot/tmp/.mount*", "/var/lib/containers/*", "/tmp/newroot/usr/bin/ansible-playbook",
-      "/usr/bin/ansible-playbook"
+      "/usr/bin/ansible-playbook", "/tmp/newroot/*", "/tmp/.mount_cursor*/cursorsandbox"
     ) or
     process.parent.args like "source /home/*/.claude/shell-snapshots/snapshot-bash*" or
     process.parent.command_line like "*github.com/community-scripts/ProxmoxVE/*" or
diff --git a/behavior/rules/linux/execution_suspicious_perl_command_execution.toml b/behavior/rules/linux/execution_suspicious_perl_command_execution.toml
index 0ce941ba..7e6493d8 100644
--- a/behavior/rules/linux/execution_suspicious_perl_command_execution.toml
+++ b/behavior/rules/linux/execution_suspicious_perl_command_execution.toml
@@ -8,7 +8,7 @@ id = "13c404cb-7631-4a33-8b59-5545e9a8a598"
 license = "Elastic License v2"
 name = "Suspicious Perl Command Execution"
 os_list = ["linux"]
-version = "1.0.11"
+version = "1.0.12"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -20,7 +20,10 @@ process.args == "-e" and process.command_line like~ (
   "*Marshal.load(*", "*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*base64*", "*zlib*", 
   "*net/http*", "*socket.new*", "*open-uri*", "*pack(*"
 ) and not (
-  process.working_directory like~ ("/builds/*", "/root/.perl-cpm/*/MIME-tools-*", "/root/.cpan*", "/scratch/*") or
+  process.working_directory like~ (
+    "/builds/*", "/root/.perl-cpm/*/MIME-tools-*", "/root/.cpan*", "/scratch/*", "/emulator/snmpAgent/net-snmp*",
+    "/data1/Axway/TSIM/is/instances/*", "/build/linux-x86_64/__build__/__vmbuild__"
+  ) or
   process.command_line like (
     "perl -e eval { use MIME::Base64; print 1; }", "/home/*/bin/sendEmail*", "*transfer fish server*",
     """perl -e $|=1; print "### 100 transfer fish server\n"; while(<STDIN>) { last if /^__END__/; $code.=$_; } exit(eval($code))""",
diff --git a/behavior/rules/linux/execution_suspicious_python_command_execution.toml b/behavior/rules/linux/execution_suspicious_python_command_execution.toml
index 6451ff7f..db86d2b7 100644
--- a/behavior/rules/linux/execution_suspicious_python_command_execution.toml
+++ b/behavior/rules/linux/execution_suspicious_python_command_execution.toml
@@ -8,7 +8,7 @@ id = "028d01ae-bfbf-438e-a0d0-23aee55ea5c9"
 license = "Elastic License v2"
 name = "Suspicious Python Command Execution"
 os_list = ["linux"]
-version = "1.0.16"
+version = "1.0.17"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.name like "python*" and
@@ -50,7 +50,8 @@ process.args == "-c" and (
     "python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
     "python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
     "import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
-    "*Thomas Nagy*"
+    "*Thomas Nagy*",
+    "/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
   ) or
   process.parent.executable like~ (
     "/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
diff --git a/behavior/rules/linux/lateral_movement_potential_netcat_file_listener_established.toml b/behavior/rules/linux/lateral_movement_potential_netcat_file_listener_established.toml
index 950e6702..3e964545 100644
--- a/behavior/rules/linux/lateral_movement_potential_netcat_file_listener_established.toml
+++ b/behavior/rules/linux/lateral_movement_potential_netcat_file_listener_established.toml
@@ -7,7 +7,7 @@ id = "b3ab4040-1289-4a8a-959a-bb71c9b09afe"
 license = "Elastic License v2"
 name = "Potential Netcat File Listener Established"
 os_list = ["linux"]
-version = "1.0.5"
+version = "1.0.6"
 
 query = '''
 sequence by process.entity_id with maxspan=5s
@@ -16,7 +16,10 @@ sequence by process.entity_id with maxspan=5s
   )]
   [process where event.type == "start" and event.action == "exec" and
    process.name in ("nc","ncat","netcat","netcat.openbsd","netcat.traditional") and
-   not process.command_line like ("*127.0.0.1*", "*localhost*", "-*z*")]
+   not (
+     process.command_line like ("*127.0.0.1*", "*localhost*") or
+     process.args like "-*z*"
+   )]
 '''
 
 min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/linux/persistence_egress_network_connection_from_rpm_package.toml b/behavior/rules/linux/persistence_egress_network_connection_from_rpm_package.toml
index c6fd9419..947b3f91 100644
--- a/behavior/rules/linux/persistence_egress_network_connection_from_rpm_package.toml
+++ b/behavior/rules/linux/persistence_egress_network_connection_from_rpm_package.toml
@@ -7,7 +7,7 @@ id = "d20cd4ba-ff65-4e1c-8012-4241d449b16b"
 license = "Elastic License v2"
 name = "Egress Network Connection from RPM Package"
 os_list = ["linux"]
-version = "1.0.11"
+version = "1.0.12"
 
 query = '''
 sequence with maxspan=3s
@@ -24,6 +24,7 @@ sequence with maxspan=3s
        )
      ) or
      (process.name == "curl" and process.args == "sudo" and process.args == "mdatp" and process.args == "--cacert") or
+     process.command_line like "runuser -u mdatp*" or
      process.name == "sudo"
    )
   ] by process.entity_id
diff --git a/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml b/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
index 48b0cdae..eb3ad7ad 100644
--- a/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
+++ b/behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
@@ -12,7 +12,7 @@ reference = [
     "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
     "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
 ]
-version = "1.0.16"
+version = "1.0.17"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.name in ("systemd", "cron", "crond") and
@@ -49,7 +49,8 @@ not (
     "sudo curl*raw.githubusercontent.com/*/backup-scripts/refs/heads/main/fortigate-backup.sh*",
     "/usr/bin/curl -s -H*zendesk.com/api/v2/ticket_metrics.json*",
     "wget --proxy=off*cat*batch_trigger.log",
-    "export PM2_HOME=*"
+    "export PM2_HOME=*",
+    "/usr/bin/curl*/var/log/checkdiskusage.log", "ps*/opt/fortinet/fortisiem/linux-agent/tmp/*"
   ) or 
   process.working_directory like "/opt/nessus_agent/*"
 )
diff --git a/behavior/rules/linux/persistence_suspicious_echo_execution.toml b/behavior/rules/linux/persistence_suspicious_echo_execution.toml
index 4880b081..c1246413 100644
--- a/behavior/rules/linux/persistence_suspicious_echo_execution.toml
+++ b/behavior/rules/linux/persistence_suspicious_echo_execution.toml
@@ -9,7 +9,7 @@ id = "a13c8f01-36a5-4ad7-a282-8d297cf62860"
 license = "Elastic License v2"
 name = "Suspicious Echo Execution"
 os_list = ["linux"]
-version = "1.0.27"
+version = "1.0.28"
 
 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -68,7 +68,11 @@ not (
     "/bin/rphcp", "/u1/grid/*/perl/bin/perl", "/home/*/.vscode-oss/extensions/openai.chatgp*universal/bin/linux-x86_64/codex",
     "/opt/teleport/system/bin/teleport", "/opt/claude-code/bin/claude", "/usr/cachesys/bin/cache", "/usr/bin/sway", "/usr/bin/runc",
     "/usr/bin/sw-engine", "/opt/nvidia/sdkmanager/sdkmanager-gui", "/usr/bin/claude-bin", "/home/*/.vscode-server/*/codex",
-    "/usr/bin/mawk", "/mnt/ssd/wda/tools/nuctl/nuctl-*-linux-amd64"
+    "/usr/bin/mawk", "/mnt/ssd/wda/tools/nuctl/nuctl-*-linux-amd64", "/home/*/.local/share/uv/python/*/bin/python*", "/usr/sbin/qemu-ga",
+    "/usr/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex",
+    "/user/*/.vscode-server/*/claude", "/home/*/.nvm/versions/node/*/codex", "/scratch/user/*/npm-global/lib/node_modules/*/codex",
+    "/snap/docker/*/bin/runc", "/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex",
+    "/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64"
   ) or
   process.parent.command_line in (
     "runc init", "buildkit-runc init", "/usr/local/bin/runc init", "python ./ssh.py --update-fingerprints bi_team",
@@ -105,7 +109,8 @@ not (
   process.parent.args like (
     "/nix/store/*", "/usr/bin/swatchdog*", "/usr/local/hostguard/data/benchmark/module/SSH/playbook.py",
     "/tmp/kubectl*.yaml", "./mmicro-control.pl", "/usr/local/bin/vncserver", "buildah-chroot-exec", "/usr/libexec/crio/crun",
-    "/usr/bin/crun", "/usr/bin/vncserver", "/tmp/ansible_*/ansible_module_command.py", "/opt/calculus/farmer/app/farmer.py"
+    "/usr/bin/crun", "/usr/bin/vncserver", "/tmp/ansible_*/ansible_module_command.py", "/opt/calculus/farmer/app/farmer.py",
+    "openclaw-gateway", "lxc-attach", "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js"
   ) or
   process.working_directory like ("/var/local/InterMapper_Settings/Tools", "/usr/local/gateway-*", "/repo/o11y/out/*/.terraform/*") or
   (process.working_directory == "/etc/prometheus" and process.parent.command_line == "tmux -Lwarp -CC") or
diff --git a/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml b/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
index c2074efb..1d9954a4 100644
--- a/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
+++ b/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
@@ -7,11 +7,11 @@ id = "fb6939a2-1b54-428c-92a2-3a831585af2a"
 license = "Elastic License v2"
 name = "Connection to Dynamic DNS Provider by a Signed Binary Proxy"
 os_list = ["windows"]
-version = "1.0.34"
+version = "1.0.35"
 
 query = '''
 sequence by process.entity_id with maxspan=5m
-  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
     (
      process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                      "powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
diff --git a/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml b/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
index 5c8950e7..a8e6fd36 100644
--- a/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
+++ b/behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
@@ -11,12 +11,12 @@ reference = [
     "https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
     "https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
 ]
-version = "1.0.36"
+version = "1.0.37"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
  /* execution of an unsigned PEfollowed by dns request to dynamic dns provider */
-  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
    not process.code_signature.trusted == true and
    process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and 
    not process.hash.sha256 : 
diff --git a/behavior/rules/windows/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml b/behavior/rules/windows/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
index 154425ed..49fe4db2 100644
--- a/behavior/rules/windows/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
+++ b/behavior/rules/windows/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
@@ -11,20 +11,20 @@ reference = [
     "https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
     "https://www.elastic.co/security-labs/globally-distributed-stealers",
 ]
-version = "1.0.67"
+version = "1.0.68"
 
 query = '''
 sequence by process.entity_id with maxspan=5m
-  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
     (
      process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                      "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
-                     "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe", "certutil.exe", "wmic.exe",
-                     "ssh.exe", "scp.exe", "msiexec.exe") or
+                     "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe", "certutil.exe", "ssh.exe",
+                     "scp.exe", "msiexec.exe", "bitsadmin.exe") or
      process.pe.original_file_name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", 
                                       "vbc.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe", 
                                       "RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe",
-                                      "certutil.exe", "wmic.exe", "msiexec.exe") or
+                                      "certutil.exe", "ssh.exe", "scp.exe", "msiexec.exe", "bitsadmin.exe") or
      process.code_signature.subject_name == "OpenJS Foundation" or
      process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
                            "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
@@ -191,7 +191,8 @@ sequence by process.entity_id with maxspan=5m
         "shorturl.at",
         "bitly.cx",
         "*.netlify.app", 
-        "*.supabase.co"
+        "*.supabase.co",
+        "envs.sh"
     ) and
     /* common to use powershell script by Microsoft Cloud sysadmins */
     not (process.name : ("powershell.exe", "pwsh.exe", "javaw.exe", "node.exe", "dfsvc.exe") and
diff --git a/behavior/rules/windows/command_and_control_dns_over_https_by_an_unusual_process.toml b/behavior/rules/windows/command_and_control_dns_over_https_by_an_unusual_process.toml
index f0cec03b..ebc6abd0 100644
--- a/behavior/rules/windows/command_and_control_dns_over_https_by_an_unusual_process.toml
+++ b/behavior/rules/windows/command_and_control_dns_over_https_by_an_unusual_process.toml
@@ -8,11 +8,11 @@ license = "Elastic License v2"
 name = "DNS Over HTTPS by an Unusual Process"
 os_list = ["windows"]
 reference = ["https://www.blackhillsinfosec.com/dns-over-https-for-cobalt-strike/"]
-version = "1.0.3"
+version = "1.0.4"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
-  [process where event.action == "start" and user.id like "S-1-5-21-*" and
+  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
    (
     (process.executable : "C:\\Windows\\*.exe" and
      process.code_signature.subject_name in ("Microsoft Windows Publisher", "Microsoft Corporation", "Microsoft Windows") and
diff --git a/behavior/rules/windows/command_and_control_execution_from_suspicious_stack_trailing_bytes.toml b/behavior/rules/windows/command_and_control_execution_from_suspicious_stack_trailing_bytes.toml
index 5e976c25..3bec35eb 100644
--- a/behavior/rules/windows/command_and_control_execution_from_suspicious_stack_trailing_bytes.toml
+++ b/behavior/rules/windows/command_and_control_execution_from_suspicious_stack_trailing_bytes.toml
@@ -4,7 +4,7 @@ id = "0a26ccb6-41b9-418d-9314-854aadcb1fba"
 license = "Elastic License v2"
 name = "Execution from Suspicious Stack Trailing Bytes"
 os_list = ["windows"]
-version = "1.0.33"
+version = "1.0.34"
 
 query = '''
 any where event.category in ("library", "api") and
@@ -107,6 +107,16 @@ any where event.category in ("library", "api") and
                                                               "0fb7450641ffc64883c628443bf0728b488b5c24784883c430415f415e415d415c*",
                                                               "488983100300004885c00f8433ffffff488*",
                                                               "488b5c2460488b6c2468488b7424704883c440415f415e5fc3cccc48895c24084889742410574883ec208b41144963f0488bf92b41103bf0*",
+                                                              /* CCS-3 */
+                                                              "*b800000000b9??0000004889d7f348ab*",
+                                                              "*4153415141504883ec20*",
+                                                              "*4151415241534883ec20*",
+                                                              "*4152415041534883ec20*",
+                                                              "*4883ec20b95bbc4a6aba*",
+                                                              "*4883ec20b95d68fa3cba*",
+                                                              "*4889d7f348ab*4883ec20*",
+                                                              "*488b85e8030000488945c048c745c8*488b85e8030000488945d0*",
+                                                              "*89c1488b4578488d9000100000488b85800000004189c84889c1*",
                                                               /* MYHANIB */
                                                               "85c0793ae98f0000004889c1ba5a4ce93be8*48894424684885c07478488b8c2420030000ba8828e950e8*000048894424784885c075a2eb5a488b",
                                                               "ba777791a7488983f00200004889c1e8*488b8bf0020000*48898338020000e8",
@@ -136,6 +146,7 @@ any where event.category in ("library", "api") and
                                                               "488945d0488b05??????00488b55d04889502848837dd0000f8470020000*",
                                                               "48898424100100004883bc241001000000751741b800000000ba00000000b905010000*",
                                                               "4889842430040000488b45104889c1e8????000089c2488d4424204989d0ba000000004889c1*",
+                                                              "*488b55e84889501048837de8007422488b45e8*",
                                                               /* DANTE */
                                                               "8bf085c00f89b80000004983feff0f85ae000000488b5510*"
                                                               ))
diff --git a/behavior/rules/windows/credential_access_access_to_windows_passwords_vault_by_unusual_process.toml b/behavior/rules/windows/credential_access_access_to_windows_passwords_vault_by_unusual_process.toml
index 9d2bb69b..1a014120 100644
--- a/behavior/rules/windows/credential_access_access_to_windows_passwords_vault_by_unusual_process.toml
+++ b/behavior/rules/windows/credential_access_access_to_windows_passwords_vault_by_unusual_process.toml
@@ -11,7 +11,7 @@ reference = [
     "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382",
     "https://www.elastic.co/security-labs/detect-credential-access",
 ]
-version = "1.0.4"
+version = "1.0.5"
 
 query = '''
 any where event.category == "iam" and event.action in ("vault_credentials_read", "vault-credentials-were-read") and
@@ -22,7 +22,8 @@ any where event.category == "iam" and event.action in ("vault_credentials_read",
  not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.executable : "?:\\Windows\\*.exe") and
  not (process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\sppsvc.exe") and process.parent.executable : "?:\\Windows\\System32\\services.exe") and
  not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\Windows\\System32\\msiexec.exe") and
- not (process.name : "rundll32.exe" and process.command_line : "*inetcpl.cpl,ClearMyTracksByProcess*") and
+ not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe") and
+ not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\rundll32.exe") and
  not (process.executable : "C:\\Windows\\explorer.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
  not process.executable :
                 ("?:\\Program Files\\*.exe",
diff --git a/behavior/rules/windows/credential_access_potential_discovery_of_dpapi_master_keys.toml b/behavior/rules/windows/credential_access_potential_discovery_of_dpapi_master_keys.toml
index 4ac295c5..c7889933 100644
--- a/behavior/rules/windows/credential_access_potential_discovery_of_dpapi_master_keys.toml
+++ b/behavior/rules/windows/credential_access_potential_discovery_of_dpapi_master_keys.toml
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Potential Discovery of DPAPI Master Keys"
 os_list = ["windows"]
 reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
-version = "1.0.37"
+version = "1.0.38"
 
 query = '''
 file where event.action == "open" and
@@ -16,7 +16,7 @@ file where event.action == "open" and
               "?:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-12-1-*\\*",
               "?:\\WINDOWS\\SYSTEM32\\MICROSOFT\\PROTECT\\S-1-5-18\\USER\\*") and
  process.executable : ("C:\\*", "\\Device\\Mup\\*") and
- user.id : ("S-1-5-21-*", "S-1-12-1-*") and
+ user.id like ("S-1-5-21*", "S-1-12-*") and
  not file.name : ("desktop.ini", "exclude", ".fdignore", ".rgignore", ".ignore", ".gitignore") and
  not process.executable :
            ("?:\\Program Files\\*",
diff --git a/behavior/rules/windows/credential_access_potential_discovery_of_windows_credential_manager_store.toml b/behavior/rules/windows/credential_access_potential_discovery_of_windows_credential_manager_store.toml
index 1eaf15a7..5b8e529c 100644
--- a/behavior/rules/windows/credential_access_potential_discovery_of_windows_credential_manager_store.toml
+++ b/behavior/rules/windows/credential_access_potential_discovery_of_windows_credential_manager_store.toml
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Potential Discovery of Windows Credential Manager Store"
 os_list = ["windows"]
 reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
-version = "1.0.42"
+version = "1.0.43"
 
 query = '''
 file where event.action == "open" and
@@ -17,7 +17,7 @@ file where event.action == "open" and
  not file.name : ("desktop.ini", ".ignore", ".rgignore", "exclude", ".gitignore", ".fdignore") and
  not file.extension : "?*" and file.name != null and
  process.executable != null and
- user.id : "S-1-5-21-*" and
+ user.id like ("S-1-5-21*", "S-1-12-*") and
  not process.executable :
            ("?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
diff --git a/behavior/rules/windows/credential_access_unusual_kerberos_client_process.toml b/behavior/rules/windows/credential_access_unusual_kerberos_client_process.toml
index a89dfe4f..1ef529fe 100644
--- a/behavior/rules/windows/credential_access_unusual_kerberos_client_process.toml
+++ b/behavior/rules/windows/credential_access_unusual_kerberos_client_process.toml
@@ -7,11 +7,11 @@ id = "b5c91c3e-9d2d-4df6-afb7-c9d236b5ebe2"
 license = "Elastic License v2"
 name = "Unusual Kerberos Client Process"
 os_list = ["windows"]
-version = "1.0.31"
+version = "1.0.32"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
- [any where user.id like "S-1-5-21-*" and
+ [any where user.id like ("S-1-5-21*", "S-1-12-*") and
   (
    (event.category =="library" and dll.name : ("System.DirectoryServices.*.dll", "Wldap32.dll")) or
    (event.category in ("network", "dns") and dns.question.name : "_ldap._tcp.*")
diff --git a/behavior/rules/windows/defense_evasion_api_call_from_a_process_with_a_spoofed_parent.toml b/behavior/rules/windows/defense_evasion_api_call_from_a_process_with_a_spoofed_parent.toml
index 466a2538..3177a2b3 100644
--- a/behavior/rules/windows/defense_evasion_api_call_from_a_process_with_a_spoofed_parent.toml
+++ b/behavior/rules/windows/defense_evasion_api_call_from_a_process_with_a_spoofed_parent.toml
@@ -7,7 +7,7 @@ id = "e62f022c-88e2-403f-9f83-f76a91dd2203"
 license = "Elastic License v2"
 name = "API Call from a Process with a Spoofed Parent"
 os_list = ["windows"]
-version = "1.0.8"
+version = "1.0.9"
 
 query = '''
 sequence by process.entity_id
@@ -33,7 +33,8 @@ sequence by process.entity_id
                                           "cfcaf06eaa34d603ff3a89dd0ddfe4b17c0ee7ad8fa4534634d24e1692a5e352",
                                           "eb278baed0f9c422e9abb6bd947d7934086ea73080575ecb2ef4a7306ca5b037",
                                           "d807a7b13f948f60bc9c299f2b6976bf3988532adc02df5ed4f44538f13f4275",
-                                          "8c5350999da9836037c67fd08bfb4e261d6e288a79c6b4fc3c8e3bd3d1f4171e")]
+                                          "8c5350999da9836037c67fd08bfb4e261d6e288a79c6b4fc3c8e3bd3d1f4171e",
+                                         "108bddeccbd09a4621d7702e53442c236a2623cb03b653ed89a1fa26007388ca")]
  until [process where event.action:"end"]
 '''
 
diff --git a/behavior/rules/windows/defense_evasion_api_call_from_a_suspicious_stack.toml b/behavior/rules/windows/defense_evasion_api_call_from_a_suspicious_stack.toml
new file mode 100644
index 00000000..233ea6e4
--- /dev/null
+++ b/behavior/rules/windows/defense_evasion_api_call_from_a_suspicious_stack.toml
@@ -0,0 +1,45 @@
+[rule]
+description = """
+Identifies the call to some Windows APIs from an unusual call stack. This may be the result of an evasion attempt to
+hide the origin of the API call from the call stack such as unbacked memory region.
+"""
+id = "1089f634-35bd-4877-a638-01e42cb47ae2"
+license = "Elastic License v2"
+name = "API Call from a Suspicious Stack"
+os_list = ["windows"]
+reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
+version = "1.0.1"
+
+query = '''
+api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "ResumeThread") and
+  process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|ntdll.dll" and
+  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like
+                                                                                ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
+                                                                                 "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*",
+                                                                                 "c:\\windows\\sys?????\\kernelbase.dll+0x*",
+                                                                                 "c:\\windows\\sys?????\\ntdll.dll+0x*",
+                                                                                 "c:\\windows\\sys?????\\kernelbase.dll!MsixIsSystemPackageByPackageFullName*"))
+'''
+
+min_endpoint_version = "8.10.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "8.10.0"
diff --git a/behavior/rules/windows/defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml b/behavior/rules/windows/defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml
index 6e34cd01..78b0f0fd 100644
--- a/behavior/rules/windows/defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml
+++ b/behavior/rules/windows/defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml
@@ -12,7 +12,7 @@ reference = [
     "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
     "https://www.microsoft.com/en-us/security/blog/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/",
 ]
-version = "1.0.29"
+version = "1.0.30"
 
 query = '''
 sequence by user.id with maxspan=5m
@@ -39,7 +39,7 @@ sequence by user.id with maxspan=5m
  ] by file.path
  [library where
   process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true and
-  not startswith~(dll.name, process.name) and
+  not startswith~(dll.name, process.name) and dll.hash.sha256 != null and 
   (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
   not dll.code_signature.status : "trusted" and
 
@@ -53,7 +53,8 @@ sequence by user.id with maxspan=5m
                "6c48d66731fcf6a60e7aef335c91e55ee27743df9912856c63302f7dfecde906",
                "2e0559d248a68402d209d65e6009c05628fe6c30f892a1047fa3365a89d7d9a6",
                "c7601b2f8b2439211433de59bda62a09347480bfdbbe03b4c560aa350c543e3a",
-               "7e1a25b50775cb246303ae162bba86c9d5fe2bd7fa98044899ffb58919b4ed3a") and
+               "7e1a25b50775cb246303ae162bba86c9d5fe2bd7fa98044899ffb58919b4ed3a", 
+               "44f3a05334de6ca0b43ebd17f6c7f1935630e026f049f28828566e364b7f41aa") and
 
   not (dll.path : "?:\\$WINDOWS.~BT\\Sources\\*.dll" and process.executable : "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe") and
   not dll.path : "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\*.dll"
diff --git a/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml b/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
index f5304ab8..e4707098 100644
--- a/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
+++ b/behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
@@ -7,7 +7,7 @@ id = "5c6c166c-a894-4263-918a-c7632014a486"
 license = "Elastic License v2"
 name = "Remote Memory Write to Trusted Target Process"
 os_list = ["windows"]
-version = "1.0.12"
+version = "1.0.13"
 
 query = '''
 api where process.Ext.api.name == "WriteProcessMemory" and
@@ -56,7 +56,9 @@ not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 an
                               "c:\\windows\\syswow64\\cwbunpls.dll",
                               "c:\\windows\\system32\\shsvcs.dll",
                               "c:\\windows\\system32\\sxssrv.dll",
-                              "c:\\windows\\syswow64\\pgpce.dll") and
+                              "c:\\windows\\syswow64\\pgpce.dll", 
+                              "c:\\windows\\system32\\hmpalert.dll", 
+                              "c:\\windows\\system32\\cloudap.dll") and
   not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("mfehcthe.dll", "system.core.ni.dll") and
   not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("?:\\program files\\*", "?:\\program files (x86)\\*", "c:\\windows\\assembly\\nativeimages_*") and
   not (process.thread.Ext.call_stack_final_user_module.name == "mscordbi.dll" and
@@ -228,7 +230,9 @@ not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 an
                                    "250c5f755d35a56189c7d557f1ea3b2827f26ff83c563df8a6cedb0114777fc0",
                                    "f3553d5c7a36f67eb9934cc372ded8c2d592ae671ebd4297b0fbfd1cedad4205",
                                    "0740759a6e479b0ff718e00c6f2d5f3c67db2ac31c787d2caa7e683588c23a03",
-                                   "4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a") and
+                                   "4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a", 
+                                   "cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443", 
+                                   "5b6929aaaa7bd05bcaa5baa7ce8c4243804d6989f1c97ca44726ed124b49e9bb") and
   not (process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*\\bin\\lib.exe" and
        Target.process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*.exe" and process.thread.Ext.call_stack_final_user_module.name == "qt5xml.dll")
 '''
diff --git a/behavior/rules/windows/discovery_external_ip_address_discovery_via_a_trusted_program.toml b/behavior/rules/windows/discovery_external_ip_address_discovery_via_a_trusted_program.toml
index 29c34a88..74938532 100644
--- a/behavior/rules/windows/discovery_external_ip_address_discovery_via_a_trusted_program.toml
+++ b/behavior/rules/windows/discovery_external_ip_address_discovery_via_a_trusted_program.toml
@@ -7,15 +7,18 @@ id = "51894221-7657-4b56-9406-e080e19ad159"
 license = "Elastic License v2"
 name = "External IP Address Discovery via a Trusted Program"
 os_list = ["windows"]
-version = "1.0.37"
+version = "1.0.38"
 
 query = '''
 sequence by process.entity_id with maxspan=5m
-  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
     (
      process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                      "powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
-                     "installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or
+                     "installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or 
+                     
+     (process.name : "node.exe" and  process.Ext.relative_file_name_modify_time <= 300) or 
+     
      process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
                            "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
                            "?:\\Program Files\\Java\\jre*\\bin\\java.exe",
@@ -72,7 +75,7 @@ sequence by process.entity_id with maxspan=5m
   ]
 '''
 
-min_endpoint_version = "7.15.0"
+min_endpoint_version = "8.4.0"
 [[actions]]
 action = "kill_process"
 field = "process.entity_id"
@@ -98,4 +101,4 @@ name = "Discovery"
 reference = "https://attack.mitre.org/tactics/TA0007/"
 
 [internal]
-min_endpoint_version = "7.15.0"
+min_endpoint_version = "8.4.0"
diff --git a/behavior/rules/windows/execution_attempt_to_mount_a_remote_webdav_share.toml b/behavior/rules/windows/execution_attempt_to_mount_a_remote_webdav_share.toml
index 101d5084..9f58eb93 100644
--- a/behavior/rules/windows/execution_attempt_to_mount_a_remote_webdav_share.toml
+++ b/behavior/rules/windows/execution_attempt_to_mount_a_remote_webdav_share.toml
@@ -7,12 +7,13 @@ id = "0a364281-5edc-4f75-a839-48b150cec3f2"
 license = "Elastic License v2"
 name = "Attempt to Mount a Remote WebDav Share"
 os_list = ["windows"]
-version = "1.0.9"
+version = "1.0.10"
 
 query = '''
 process where event.action == "start" and
  (
   (process.name : "explorer.exe" and process.args : "\\\\*@*") or
+  (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*" and process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "mshta.exe", "msiexec.exe")) or 
   (process.name : "net.exe" and process.args : "use" and 
    ((process.args : ("http*:*", "*webdav*") and process.args : "/user*@*") or process.command_line : "*\\\\*@ssl\\*") and not process.command_line : "*//localhost*") or
   (process.name : ("expand.exe", "xcopy.exe", "cmd.exe") and process.args : ("\\\\webdav*", "*DavWWWRoot*"))
diff --git a/behavior/rules/windows/execution_suspicious_command_shell_execution_via_windows_run.toml b/behavior/rules/windows/execution_suspicious_command_execution_via_windows_run.toml
similarity index 94%
rename from behavior/rules/windows/execution_suspicious_command_shell_execution_via_windows_run.toml
rename to behavior/rules/windows/execution_suspicious_command_execution_via_windows_run.toml
index 5bf2b78e..5a9fdafe 100644
--- a/behavior/rules/windows/execution_suspicious_command_shell_execution_via_windows_run.toml
+++ b/behavior/rules/windows/execution_suspicious_command_execution_via_windows_run.toml
@@ -5,16 +5,19 @@ victim to copy and paste malicious commands for execution via the Windows Run me
 """
 id = "f4f436c8-5c4a-4f61-b0cc-17b154920887"
 license = "Elastic License v2"
-name = "Suspicious Command Shell Execution via Windows Run"
+name = "Suspicious Command Execution via Windows Run"
 os_list = ["windows"]
 reference = [
     "https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages",
 ]
-version = "1.0.8"
+version = "1.0.9"
 
 query = '''
 process where event.action == "start" and
- process.name : ("cmd.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe") and
+ (
+   process.name : ("cmd.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe") or 
+   (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*")
+ ) and
  process.parent.name : "explorer.exe" and process.args_count >= 2 and
  (
   process.parent.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|kernel32.dll|windows.storage.dll|shell32.dll|user32.dll|shell32.dll|explorer.exe|shcore.dll|*" or
diff --git a/behavior/rules/windows/execution_suspicious_javascript_execution_via_deno.toml b/behavior/rules/windows/execution_suspicious_javascript_execution_via_deno.toml
new file mode 100644
index 00000000..1b6598a1
--- /dev/null
+++ b/behavior/rules/windows/execution_suspicious_javascript_execution_via_deno.toml
@@ -0,0 +1,46 @@
+[rule]
+description = """
+Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this
+utility to execute malicious JavaScript.
+"""
+id = "ff18d24b-2ba6-4691-a17f-75c4380d0965"
+license = "Elastic License v2"
+name = "Suspicious JavaScript Execution via Deno"
+os_list = ["windows"]
+reference = ["https://deno.com/"]
+version = "1.0.1"
+
+query = '''
+process where event.action== "start" and
+ (process.name : "deno.exe" or process.pe.original_file_name == "deno.exe" or process.code_signature.subject_name == "Deno Land Inc.") and
+  process.command_line : ("*javascript*base64*", "*eval(*", "*http*", "*javascript*import*")
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+tree = true
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/windows/execution_suspicious_powershell_execution.toml b/behavior/rules/windows/execution_suspicious_powershell_execution.toml
index 6c412e6d..15491f6d 100644
--- a/behavior/rules/windows/execution_suspicious_powershell_execution.toml
+++ b/behavior/rules/windows/execution_suspicious_powershell_execution.toml
@@ -12,7 +12,7 @@ reference = [
     "https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
     "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
 ]
-version = "1.0.48"
+version = "1.0.49"
 
 query = '''
 process where event.action == "start" and process.name : "powershell.exe" and process.parent.executable != null and
@@ -149,7 +149,10 @@ process where event.action == "start" and process.name : "powershell.exe" and pr
           "*DownloadFile*",
           "*DownloadString*",
           "* iex*",
+          "*;iex*",
           "* iwr*",
+          "*;iwr *",
+          "*;saps *",
           "* aQB3AHIAIABpA*",
           "*Reflection.Assembly*",
           "*Assembly.GetType*",
@@ -187,9 +190,17 @@ process where event.action == "start" and process.name : "powershell.exe" and pr
           "*$env:computername*http*",
           "*;InVoKe-ExpRESsIoN $COntent.CONTENt;*",
           "*WebClient*example.com*",
-          "*=iwr $*;iex $*"
+          "*=iwr $*;iex $*",
+          "*gc *:*|sc *",
+          "*gci *-Recurse*start*",
+          "*Invoke-WebRequest*Start-Process*Hidden*",
+          "*Invoke-WebRequest*msiexec*"
         ) or
 
+      (process.command_line regex~ """.*p\"?o\"?w\"?e\"?r\"?s\"?h\"?e\"?l\"?l.*""" and not process.command_line : "*powershell*") or
+
+      (process.args: "bypass" and process.args : "hidden" and process.command_line : "*start-process*appdata*") or
+
       (process.args : "-c" and process.args : "&{'*") or
 
       (process.args : "-Outfile" and process.args : "Start*") or 
@@ -199,9 +210,9 @@ process where event.action == "start" and process.name : "powershell.exe" and pr
       process.args : "$*$*;set-alias" or
 
       (process.command_line : ("*-encodedCommand*", "*Invoke-webrequest*", "*WebClient*", "*Reflection.Assembly*") and
-       (process.parent.name : ("explorer.exe", "python.exe") or
+       (process.parent.name : ("explorer.exe", "python*.exe") or
         (process.parent.name : "cmd.exe" and
-         descendant of [process where event.action == "start" and process.name : ("explorer.exe", "python.exe")])))
+         descendant of [process where event.action == "start" and process.name : ("explorer.exe", "python*.exe")])))
      )
 '''
 
diff --git a/behavior/rules/windows/execution_suspicious_windows_command_shell_execution.toml b/behavior/rules/windows/execution_suspicious_windows_command_shell_execution.toml
index 956d89b7..fc642e8d 100644
--- a/behavior/rules/windows/execution_suspicious_windows_command_shell_execution.toml
+++ b/behavior/rules/windows/execution_suspicious_windows_command_shell_execution.toml
@@ -7,7 +7,7 @@ id = "8dd7588d-fc28-40c0-adfb-14789c763984"
 license = "Elastic License v2"
 name = "Suspicious Windows Command Shell Execution"
 os_list = ["windows"]
-version = "1.0.56"
+version = "1.0.57"
 
 query = '''
 process where event.action == "start" and
@@ -20,13 +20,13 @@ process where event.action == "start" and
   "* explorer*%CD%*", "*%cd%\\*.js*", "*attrib*%CD%*", "*/?cMD<*", "*/AutoIt3ExecuteScript*..*", "*&cls&cls&cls&cls&cls&*",
   "*&#*;&#*;&#*;&#*;*", "* &&s^eT*", "*& ChrW(*", "*&explorer /root*", "*start __ & __\\*", "*findstr /V /L *forfiles*",
   "*=wscri& set *", "*http*!COmpUternaME!*", "*start *.pdf * start /min cmd.exe /c *\\\\*", "*pip install*System.Net.WebClient*",
-  "*Invoke-WebReques*Start-Process*", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*",
+  "*Invoke-WebRequest*Start-Process*", "*iwr *saps *", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*",
   "*curl --ntlm -u*", "*bat'; iwr $*", "*http*.Content;*", "*&(gcm i?x)*", "*!*!*!*!*!*!*", "*&& !*!!*", "*for %? in (?) do @set*",
-  "*QUIT>>?&FTP/s:*", "*iwr -Uri*Start-Process*", "*irm https*| iex*", "*^S^T^a*",  "*javascript:alert*",
+  "*QUIT>>?&FTP/s:*", "*iwr *Start-Process*", "*irm https*| iex*", "*^S^T^a*",  "*javascript:alert*",
   "* /v /c *&&set *&&set *&&set *&&set *&&set*", "*net use *@ssl*rundll32*", "*echo F | xcopy*/h /y &&*",
   "* if /i \"%cd%\"==\"C:\\Windows\\System32\" ( echo *", "* if /i \"%cd%\"==\"C:\\Windows\\System32\" ( msg*",
   "* if /i \"%cd%\"==\"C:\\Windows\\System32\" (mshta *", "*/c*start*.doc&exit*", "*/k*start msedge*http*&*", "*)) | Invoke-Expression\"", 
-  "*/c *.bat&*.pdf*", "*/c *.bat&*.mp4*") or
+  "*/c *.bat&*.pdf*", "*/c *.bat&*.mp4*", "*set \"*& set \"*& set \"* call %*") or
 
   (process.args_count == 3 and process.args : "%*%" and process.args:"/c") or
 
diff --git a/behavior/rules/windows/execution_windows_script_execution_from_archive_file.toml b/behavior/rules/windows/execution_windows_script_execution_from_archive_file.toml
index 683d9829..91234d4e 100644
--- a/behavior/rules/windows/execution_windows_script_execution_from_archive_file.toml
+++ b/behavior/rules/windows/execution_windows_script_execution_from_archive_file.toml
@@ -7,11 +7,11 @@ id = "816e1e39-e1a3-4935-9b7b-18395d244670"
 license = "Elastic License v2"
 name = "Windows Script Execution from Archive File"
 os_list = ["windows"]
-version = "1.0.29"
+version = "1.0.30"
 
 query = '''
 process where event.action == "start" and
- user.id : "S-1-5-21-*" and process.name : "wscript.exe" and
+ user.id like ("S-1-5-21*", "S-1-12-*") and process.name : "wscript.exe" and
  (
    /* execution from archive temp file */
    process.args : ("?:\\Users\\*\\Temp\\7z*", "?:\\Users\\*\\Temp\\Rar$*", "?:\\Users\\*\\Temp\\Temp?_*") or
diff --git a/behavior/rules/windows/initial_access_execution_from_a_macro_enabled_office_document.toml b/behavior/rules/windows/initial_access_execution_from_a_macro_enabled_office_document.toml
index ec1ff121..bce1d1bd 100644
--- a/behavior/rules/windows/initial_access_execution_from_a_macro_enabled_office_document.toml
+++ b/behavior/rules/windows/initial_access_execution_from_a_macro_enabled_office_document.toml
@@ -11,7 +11,7 @@ os_list = ["windows"]
 reference = [
     "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
 ]
-version = "1.0.31"
+version = "1.0.32"
 
 query = '''
 process where event.action == "start" and
@@ -71,6 +71,7 @@ process where event.action == "start" and
                              "?:\\Windows\\SysWOW64\\DWWIN.EXE",
                              "?:\\WINDOWS\\system32\\dwwin.exe",
                              "?:\\Windows\\System32\\wermgr.exe",
+                             "?:\\Windows\\SysWOW64\\wermgr.exe",
                              "?:\\Windows\\System32\\taskkill.exe",
                              "?:\\Windows\\System32\\Robocopy.exe",
                              "C:\\Windows\\SysWOW64\\verclsid.exe",
diff --git a/behavior/rules/windows/initial_access_suspicious_microsoft_iis_worker_descendant.toml b/behavior/rules/windows/initial_access_suspicious_microsoft_iis_worker_descendant.toml
index 2c73ef08..396c5396 100644
--- a/behavior/rules/windows/initial_access_suspicious_microsoft_iis_worker_descendant.toml
+++ b/behavior/rules/windows/initial_access_suspicious_microsoft_iis_worker_descendant.toml
@@ -10,7 +10,7 @@ os_list = ["windows"]
 reference = [
     "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
 ]
-version = "1.0.35"
+version = "1.0.36"
 
 query = '''
 process where event.action == "start" and
@@ -47,13 +47,12 @@ process where event.action == "start" and
 )
 /* False Positives */
 and not (process.name : "cmd.exe" and process.parent.args : "Icims" and process.command_line : "*vault.azure.net*" and process.parent.name : "w3wp.exe") and
-not (process.name : "curl.exe" and process.args : "https://installerapi.lansweeper.com/v1/cloudsyncversions") and
 not (process.name : "powershell.exe" and process.command_line : "\"powershell.exe\" netsh http show servicestate | ?{$_.Tostring().Contains(*") and
 process.hash.sha256 != "fe1d2ad2781879dc05039d87bd12259f3bcf411c66c925d31827d6a757d33ec4" and
-not (process.name == "curl.exe" and process.args == "https://discovery-gateway.lansweeper.com/versions/v1/cloudSyncVersions" and
-     process.parent.name == "w3wp.exe" and process.parent.args : "Lansweeper AppPool") and
 not (process.name : "cmd.exe" and process.parent.name:"w3wp.exe" and
-     process.args:"'HttpsPortDesktopAgent'),"  and process.args : "echo" and process.parent.args : "DefaultAppPool")
+     process.args:"'HttpsPortDesktopAgent'),"  and process.args : "echo" and process.parent.args : "DefaultAppPool") and
+not (process.name == "conhost.exe" and process.parent.name == "cmd.exe") and
+not (process.name : "curl.exe" and process.args : "https*.lansweeper.com" and process.parent.name : "w3wp.exe" and process.parent.args : "Lansweeper AppPool")
 '''
 
 min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/windows/persistence_persistence_via_extensible_firmware_modification.toml b/behavior/rules/windows/persistence_persistence_via_extensible_firmware_modification.toml
index 2e57aa6f..c6cc16f4 100644
--- a/behavior/rules/windows/persistence_persistence_via_extensible_firmware_modification.toml
+++ b/behavior/rules/windows/persistence_persistence_via_extensible_firmware_modification.toml
@@ -11,7 +11,7 @@ reference = [
     "https://github.com/Cr4sh/s6_pcie_microblaze/blob/master/python/payloads/DmaBackdoorHv/bootkit_installer.ps1",
     "https://securelist.com/finspy-unseen-findings/104322/",
 ]
-version = "1.0.28"
+version = "1.0.29"
 
 query = '''
 sequence by process.entity_id
@@ -52,14 +52,18 @@ sequence by process.entity_id
   not (process.executable : "?:\\Windows\\HP\\Installer.exe" and process.args : "-bestsize" and process.args : "-uefisupport") and 
 
   not (process.code_signature.subject_name :
-           ("Akeo Consulting", "HP Inc.", "Dell Inc", "Veritas Technologies LLC", "Insyde Software Corp.", "Huawei Technologies Co., Ltd.") and
+           ("Akeo Consulting", "HP Inc.", "Dell Inc", "Dell Technologies Inc.", "Veritas Technologies LLC", "Insyde Software Corp.", "Huawei Technologies Co., Ltd.") and
        process.code_signature.trusted == true) and
 
   not (process.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.args : "BDESVC" and process.parent.name : "services.exe") and
 
   not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/sysrepair" and process.parent.name : "svchost.exe") and
 
-  not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/f" and process.args : "?:\\Windows")
+  not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/f" and process.args : "?:\\Windows") and
+
+  not (process.executable : "?:\\Windows\\System32\\taskhostw.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
+       process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Windows" and
+       (process.args : "taskhostw.exe" or process.args : "SBServicing" or process.args : "SYSTEM" or process.args : "ExploitGuardPolicy"))
   ] as event0
  [file where event.action != "deletion" and file.path :"\\Device\\HarddiskVolume*\\EFI\\*" and
 
diff --git a/behavior/rules/windows/persistence_unusual_startup_shell_folder_modification.toml b/behavior/rules/windows/persistence_unusual_startup_shell_folder_modification.toml
index 40478631..ea6bf11b 100644
--- a/behavior/rules/windows/persistence_unusual_startup_shell_folder_modification.toml
+++ b/behavior/rules/windows/persistence_unusual_startup_shell_folder_modification.toml
@@ -8,11 +8,11 @@ id = "377aad38-24e0-4dd7-93c2-bd231cb749e3"
 license = "Elastic License v2"
 name = "Unusual Startup Shell Folder Modification"
 os_list = ["windows"]
-version = "1.0.35"
+version = "1.0.36"
 
 query = '''
 registry where
-  user.id : "S-1-5-21-*" and process.executable != null and
+  user.id like ("S-1-5-21*", "S-1-12-*") and process.executable != null and
   registry.path : (
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
diff --git a/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml b/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
index baddcbf2..ddf838ce 100644
--- a/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
+++ b/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
@@ -12,14 +12,14 @@ reference = [
     "https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-ifileoperation",
     "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
 ]
-version = "1.0.32"
+version = "1.0.33"
 
 query = '''
 sequence with maxspan=1m
   [file where event.action in ("creation", "overwrite", "rename", "modification") and
 
    /* IFileOperation are performed by DllHost */
-   process.name : "dllhost.exe" and user.id : "S-1-5-21-*" and
+   process.name : "dllhost.exe" and user.id like ("S-1-5-21*", "S-1-12-*") and
 
    /* executable file dropped via NewItem, Rename, Move or Copy IFileOperation */
    (file.extension : "dll" or file.Ext.header_bytes : "4d5a*") and
diff --git a/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_setwindowshook_dll_injection.toml b/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_setwindowshook_dll_injection.toml
new file mode 100644
index 00000000..09827550
--- /dev/null
+++ b/behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_setwindowshook_dll_injection.toml
@@ -0,0 +1,54 @@
+[rule]
+description = """
+Identifies a potentially untrusted DLL loaded by a privileged account from a suspicious location where the call stack
+indicates a user-mode callback path consistent with SetWindowsHookEx-style window hook execution. Adversaries can abuse
+window hooks to force a privileged process to load attacker-controlled DLLs and elevate privileges.
+"""
+id = "6eec7771-953c-46a0-9765-93000de1c237"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via SetWindowsHook DLL Injection"
+os_list = ["windows"]
+reference = [
+    "https://attack.mitre.org/techniques/T1055/001/",
+    "https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexa",
+]
+version = "1.0.1"
+
+query = '''
+library where
+  user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+  not dll.code_signature.status like ("trusted", "errorCode_endpoint*") and
+  process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|user32.dll|ntdll.dll" and
+  (dll.Ext.relative_file_creation_time <= 900 or dll.Ext.relative_file_name_modify_time <= 900) and
+  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "?:\\Windows\\System32\\ntdll.dll!KiUserCallbackDispatcher*") and
+  not dll.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\System32\\*")
+'''
+
+min_endpoint_version = "8.12.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+tree = true
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+[[threat.technique.subtechnique]]
+id = "T1055.001"
+name = "Dynamic-link Library Injection"
+reference = "https://attack.mitre.org/techniques/T1055/001/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "8.12.0"
diff --git a/behavior/rules/windows/privilege_escalation_suspicious_desktop_window_manager_api_call.toml b/behavior/rules/windows/privilege_escalation_suspicious_desktop_window_manager_api_call.toml
new file mode 100644
index 00000000..f15f7716
--- /dev/null
+++ b/behavior/rules/windows/privilege_escalation_suspicious_desktop_window_manager_api_call.toml
@@ -0,0 +1,51 @@
+[rule]
+description = """
+Identifies suspicious memory API calls by the Window Desktop Manager process. This may indicate a successful
+vulnerability exploitation for privilege escalation.
+"""
+id = "1ddca85b-866b-4bee-96cd-ac5466f36e0a"
+license = "Elastic License v2"
+name = "Suspicious Desktop Window Manager API Call"
+os_list = ["windows"]
+reference = [
+    "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2023/CVE-2023-36033.html",
+    "https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies",
+    "https://nvd.nist.gov/vuln/detail/cve-2024-30051",
+]
+version = "1.0.1"
+
+query = '''
+api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "ResumeThread", "WinExec", "SetThreadContext") and
+ process.executable : "?:\\Windows\\system32\\dwm.exe" and
+ (
+  process.thread.Ext.call_stack_summary like "*|combase.dll|user32.dll|dwmcore.dll|*" or
+  process.thread.Ext.call_stack_final_user_module.name == "combase.dll" or
+  (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "combase.dll")
+  ) and
+  not (process.Ext.api.name == "VirtualProtect" and
+       _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*")))
+'''
+
+min_endpoint_version = "8.10.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+tree = true
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1068"
+name = "Exploitation for Privilege Escalation"
+reference = "https://attack.mitre.org/techniques/T1068/"
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "8.10.0"