Updating artifacts

2026-06-08 14:02:19 +00:00 · 2026-03-12 10:08:40 +00:00
parent fdf0a3af1e
commit b989fe2091
62 changed files with 820 additions and 115 deletions
@@ -0,0 +1,73 @@
+[rule]
+description = """
+This rule detects shell executions via Velociraptor. Threat actors have been observed installing Velociraptor to execute
+shell commands on compromised systems, blending in with legitimate system processes.
+"""
+id = "b01cdbdd-40a8-4f7b-b89f-75ca40229769"
+license = "Elastic License v2"
+name = "Velociraptor Suspicious Shell Execution"
+os_list = ["linux", "macos"]
+reference = ["https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399"]
+version = "1.0.0"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.parent.name like~ "velociraptor*" and
+process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args in ("-c", "-cl", "-lc", "--command")
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "System Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1219"
+name = "Remote Access Software"
+reference = "https://attack.mitre.org/techniques/T1219/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -0,0 +1,93 @@
+[rule]
+description = """
+Detects network connections originating from a binary located in a potentially suspicious location, followed by command
+execution. This behavior is consistent with C2 agents such as Poseidon and Athena, connecting to a C2 framework such as
+Mythic. The agent polls the C2 for commands through a web request, after which the command gets executed.
+"""
+id = "8c2977dd-07ce-4a8e-8ccd-5e4183138675"
+license = "Elastic License v2"
+name = "Egress Network Connection Followed by Command Execution"
+os_list = ["linux"]
+version = "1.0.14"
+
+query = '''
+sequence with maxspan=5s
+  [network where event.type == "start" and event.action == "connection_attempted" and
+   process.executable like ("./*", "/boot/*", "/dev/shm/*", "/run/*", "/var/run/*", "/tmp/*", "/var/tmp/*") and
+   not (
+      process.executable like "/tmp/*/*" or
+      destination.ip == null or
+      destination.ip == "0.0.0.0" or 
+      cidrmatch(
+        destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
+        "192.0.0.0/24", "192.0.0.0/29","192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
+        "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
+        "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+        "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
+        "FF00::/8"
+      )
+    )
+  ] by process.entity_id
+  [process where event.type == "start" and event.action == "exec" and
+   process.parent.executable like ("./*", "/boot/*", "/dev/shm/*", "/run/*", "/var/run/*", "/tmp/*", "/var/tmp/*") and
+   process.args like (
+     "ip*", "whoami*", "id*", "hostname*", "touch*", "curl*", "wget*", "chmod*", "busybox*", "chattr*", "echo*",
+     "php*", "perl*", "ruby*", "lua*", "openssl*", "nc*", "netcat*", "ncat*"
+   ) and
+   not (
+     process.parent.executable in (
+       "/srv/nessus_agent/sbin/nessus-agent-module", "/var/log/amazon/ssm/patch-baseline-operations", "./app",
+       "./config.json/usr/local/bin/py.test", "./runc"
+     ) or
+     process.parent.name in ("nseserv", "nexserv", "pycharm") or
+     process.parent.command_line == "/usr/bin/php ./boot-watcher.php" or
+     process.working_directory == "/usr/lib/adlumin" or
+     process.parent.executable like ("/run/k3s/containerd/*", "/run/user/*/.bubblewrap/opt/chef/bin/chef-client", "/run/containerd/*")
+   )
+  ] by process.parent.entity_id
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.001"
+name = "Web Protocols"
+reference = "https://attack.mitre.org/techniques/T1071/001/"
+
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -7,7 +7,7 @@ id = "5c18132a-e279-404e-a8d8-922546d469a7"
 license = "Elastic License v2"
 name = "File Download from or Upload to Hosting Service"
 os_list = ["linux"]
-version = "1.0.6"
+version = "1.0.7"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and
@@ -16,7 +16,10 @@ process.command_line like~ (
  "*paste.ofcode.org*", "*textbin.net*", "*transfer.sh*", "*anonfiles.*", "*easyupload.io*", "*gofile.io*", "*send.cm*", "*ufile.io*",
  "*pixeldrain.com*", "*bayfiles.*", "*megaupload.*", "*mediafire.*", "*zippyshare.com*", "*dropapk.to*", "*shorturl.at*", "*tinyurl.com*",
  "*bit.ly/*", "*cutt.ly/*", "*is.gd/*", "*rebrand.ly/*", "*adf.ly/*", "*rb.gy/*", "*bashupload.com/*", "*bujang.online/*"
-) and not process.parent.executable in ("/opt/aws/awsagent/bin/update", "/batch/pac.liste.categorie.sh")
+) and not (
+  process.parent.executable in ("/opt/aws/awsagent/bin/update", "/batch/pac.liste.categorie.sh") or
+  process.parent.args == "/usr/local/gg/crowdsec-extract.sh"
+)
 '''

 min_endpoint_version = "7.15.0"
@@ -7,7 +7,7 @@ id = "49ab63a4-ed52-49ac-855b-c298b38b0cb9"
 license = "Elastic License v2"
 name = "Egress Network Connection from Deleted Executable by Root"
 os_list = ["linux"]
-version = "1.0.14"
+version = "1.0.15"

 query = '''
 network where event.type == "start" and event.action == "connection_attempted" and process.executable like "* (deleted)" and 
@@ -24,7 +24,8 @@ not (
    "/usr/bin/*", "/bin/*", "/opt/*", "/home/*", "/usr/share/*", "/usr/lib/*", "/usr/libexec/*", "/run/k3s/*",
    "/var/lib/waagent/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*", "/usr/local/lib/*",
    "/usr/lib64/*", "/var/tmp/go-build*", "/app/extra/slack*", "/projects/hash-manager/dist/*/hash-manager*",
-    "/nextcloud/custom_apps/notify_push/bin/x86_64/notify_push*", "/usr/local/lad/bin/mdsd*"
+    "/nextcloud/custom_apps/notify_push/bin/x86_64/notify_push*", "/usr/local/lad/bin/mdsd*",
+    "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*/longhorn*"
  ) or
  process.name in ("dockerd", "teleport", "zed-editor", "datacollector", "exe")
 )
@@ -13,7 +13,7 @@ reference = [
    "https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
    "https://x-c3ll.github.io/posts/fileless-memfd_create/",
 ]
-version = "1.0.18"
+version = "1.0.19"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -27,6 +27,7 @@ not (
    "/usr/bin/runc", "/usr/bin/login", "/usr/bin/nvidia-cdi-hook", "/usr/bin/buildkit-runc", "/usr/bin/nordlayer",
    "/usr/sbin/nordlayer", "/usr/libexec/nordlayer/nordlayer-setcap", "/sbin/apk", "/opt/sophos-spl/plugins/runtimedetections/bin/runtimedetections"
  ) or
+  process.parent.executable like "/proc/self/fd/*/*" or
  (process.parent.name == "init" and process.args == "/usr/lib/systemd/systemd-executor") or
  (process.parent.name like "python*" and process.args == "-m" and process.args == "test.regrtest" and process.args == "--pgo")
 )
@@ -12,7 +12,7 @@ reference = [
    "https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
    "https://x-c3ll.github.io/posts/fileless-memfd_create/",
 ]
-version = "1.0.15"
+version = "1.0.16"

 query = '''
 sequence by process.entity_id with maxspan=10s
@@ -21,7 +21,8 @@ sequence by process.entity_id with maxspan=10s
   process.args like ("/usr/lib/systemd/systemd-executor", "/nix/store/*/systemd-executor*") or
   process.parent.executable like (
     "/usr/sbin/runc", "/usr/bin/dockerd", "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/nix/store/*/systemd",
-     "/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas", "/usr/sbin/nordlayerd", "/sbin/init"
+     "/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas", "/usr/sbin/nordlayerd", "/sbin/init",
+     "/proc/self/fd/*/*"
   ) or
   process.command_line == "runc init"
 )]
@@ -8,7 +8,7 @@ id = "e6669bc3-cb75-4fb3-91e0-ddaa06dd59b2"
 license = "Elastic License v2"
 name = "Potential Process Masquerading via Exec"
 os_list = ["linux"]
-version = "1.0.12"
+version = "1.0.13"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -22,7 +22,9 @@ process.args == "-c" and process.command_line : "* exec -a *" and not (
  ) or
  process.command_line like (
    "*/tmp/fzf-args*", "/opt/sp/serverpilot/*", "*/opt/forticlientems/*", "*WarpTerminal*", "/bin/bash -c exec -a bash*",
-    "/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard"""
+    "/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard""",
+    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/upgradeworker_linux_amd64 -config ./goEMS.conf",
+    "bash -c exec -a cubin_gpu_pool_worker sleep *"
  ) or
  process.working_directory in ("/opt/novell/umc/apps/umc-server", "/opt/novell/umc/apps/oes-rest", "/usr/share/epoptes-client") or 
  process.args in (
@@ -0,0 +1,65 @@
+[rule]
+description = """
+This rule detects the execution of processes from the /boot directory. This may indicate an attempt to execute a process
+from a location that is not typical for executable files. This behavior is often associated with malicious activity.
+"""
+id = "87bd993d-d2fa-4047-bc7b-d6a4527d6ab8"
+license = "Elastic License v2"
+name = "Process Execution from Boot Directory"
+os_list = ["linux"]
+version = "1.0.10"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.executable like "/boot/*" and
+not process.executable == "/boot/loader/entries"
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+
+[[threat.technique]]
+id = "T1620"
+name = "Reflective Code Loading"
+reference = "https://attack.mitre.org/techniques/T1620/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -7,7 +7,7 @@ id = "4c61fca2-6f77-474d-a537-2d7fd9ec75e0"
 license = "Elastic License v2"
 name = "Shell Execution of Non-Executable File"
 os_list = ["linux"]
-version = "1.0.8"
+version = "1.0.9"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.args_count == 2 and
@@ -20,7 +20,11 @@ process.args like ("*.pid", "*.txt", "*.json", "*.bin", "*.log", "*.dat") and
 not (
  process.args in ("/opt/config/example.txt", "/var/lib/git/beinformed.git/subgit/authors.txt") or
  process.parent.args == "/sbin/init"  or
-  process.parent.executable in ("/usr/bin/emscli", "./runc")
+  process.parent.executable in ("/usr/bin/emscli", "./runc") or
+  process.command_line in (
+    /* Manage Engine UEMS Agent */
+    "/bin/bash /opt/DesktopCentral/UEMS_LinuxAgent.bin", "/bin/bash ./UEMS_LinuxAgent.bin"
+  )
 )
 '''

@@ -7,7 +7,7 @@ id = "4daceba6-54be-4dfc-95ab-a4a9c19c77af"
 license = "Elastic License v2"
 name = "System Binary Copied or Moved"
 os_list = ["linux"]
-version = "1.0.12"
+version = "1.0.13"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.name in ("cp", "mv") and 
@@ -54,7 +54,7 @@ process.args in (
    "/usr/local/bin/sigostclsh8.6", "/usr/lib/usrmerge/convert-usrmerge", "/usr/sbin/rear", "/usr/bin/byobu-status", "/sbin/rear",
    "/usr/bin/find", "/tmp/newroot/nix/store/*/activate", "/nix/store/*/activate", "/var/lib/containers/storage/overlay/nix/store/*/activate",
    "/var/lib/dpkg/tmp.ci/preinst", "/usr/sbin/nv-update-initrd", "/sbin/dracut", "/opt/SIGOS/*", "/tmp/newroot/usr/lib/dracut/dracut-install",
-    "/usr/libexec/flatpak-session-helper", "/usr/sbin/mkinitramfs", "/var/tmp/portage/*/libtool"
+    "/usr/libexec/flatpak-session-helper", "/usr/sbin/mkinitramfs", "/var/tmp/portage/*/libtool", "/tmp/newroot/usr/bin/make"
  ) or
  process.working_directory like (
    "/etc/localtime/var/lib/rancher", "/run/k3s/containerd/*", "/var/lib/docker/*", "/var/lib/rancher", "/var/tmp/portage/*"
@@ -62,7 +62,7 @@ process.args in (
  process.args like ("/var/tmp/dracut.*/initramfs/*", "/var/tmp/mkinitramfs_*", "/opt/jail/driver-jail/*") or
  process.parent.args like (
    "/var/tmp/rpm-tmp*", "/usr/sbin/rear", "/usr/lib/usrmerge/convert-usrmerge", "/usr/share/initramfs-tools/hooks/zz-busybox",
-    "./libtool", "/var/lib/dpkg/info/dash.postinst"
+    "./libtool", "/var/lib/dpkg/info/dash.postinst", "*./libtool*"
  ) or
  process.command_line in (
    "mv kubectl /usr/bin/kubectl", "mv ./kubectl /usr/bin/kubectl", "cp kubectl /usr/local/bin/kubectl",
@@ -7,7 +7,7 @@ id = "2dc02903-9487-4152-87ac-f1c6c7f3a7d3"
 license = "Elastic License v2"
 name = "Background Task Execution via a Hidden Process"
 os_list = ["linux"]
-version = "1.0.6"
+version = "1.0.7"

 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -18,7 +18,8 @@ not (
  process.parent.executable like (
    ".", "/usr/bin/podman", "./.runc-wrapped", "/nix/store/*", "/dev/.buildkit_qemu_emulator"
  ) or
-  process.parent.args in ("/usr/bin/crun", "lxc-attach")
+  process.parent.args in ("/usr/bin/crun", "lxc-attach") or
+  process.args == "lxc-attach"
 )
 '''

@@ -0,0 +1,70 @@
+[rule]
+description = """
+Detects when a hidden process spawns an interactive shell. This behavior may indicate a malicious actor attempting to
+execute post-exploitation commands.
+"""
+id = "52deef30-e633-49e1-9dd2-da1ad6cb5e43"
+license = "Elastic License v2"
+name = "Interactive Shell Spawned via Hidden Process"
+os_list = ["linux"]
+version = "1.0.7"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.parent.name like ".*" and
+process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args in ("-i", "-li", "-il") and
+not (
+  process.parent.executable like ("/nix/store/*", "/tmp/newroot/nix/store/*") or
+  process.parent.args == "/usr/bin/crun" or
+  process.parent.command_line == "runc init"
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1564"
+name = "Hide Artifacts"
+reference = "https://attack.mitre.org/techniques/T1564/"
+[[threat.technique.subtechnique]]
+id = "T1564.001"
+name = "Hidden Files and Directories"
+reference = "https://attack.mitre.org/techniques/T1564/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Linux Hidden Folder or File Execution via Python"
 os_list = ["linux"]
 reference = ["https://github.com/rapid7/metasploit-framework"]
-version = "1.0.14"
+version = "1.0.15"

 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -24,7 +24,7 @@ not (
   process.parent.executable like "/home/*/node_modules/@openai/codex/bin/codex-x86_64-unknown-linux-musl" and
   process.command_line like "python3 /tmp/.tmp*"
 ) or
- (process.args == "/usr/bin/ukify" and process.args == "build")
+ (process.args in ("/usr/bin/ukify", "/bin/ukify") and process.args == "build")
 )
 '''

@@ -7,7 +7,7 @@ id = "e9731cea-c3fc-4183-a76c-9a798ae0a2b0"
 license = "Elastic License v2"
 name = "Linux Powershell Suspicious Child Process"
 os_list = ["linux"]
-version = "1.0.9"
+version = "1.0.10"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.name == "pwsh" and
@@ -21,7 +21,8 @@ not (
    "/opt/ansible*/Evaluate-STIG/powershell/pwsh", "/evaluate/Evaluate-STIG/powershell/pwsh",
    "/opt/Evaluate-STIG/powershell/pwsh"
  ) or
-  process.working_directory like "/opt/azurevstsagent/agent*"
+  process.working_directory like "/opt/azurevstsagent/agent*" or
+  process.args like "/home/*/.local/bin/az"
 )
 '''

@@ -0,0 +1,87 @@
+[rule]
+description = """
+Detects when a process is executed via an interactive shell. C2 platforms will commonly spawn an interactive shell
+providing the threat actor with a remote shell on the system as if they were physically at the terminal allowing them to
+send and execute commands manually.
+"""
+id = "aa02591f-c9e6-4317-841e-0b075b9515ff"
+license = "Elastic License v2"
+name = "Linux Suspicious Child Process Execution via Interactive Shell"
+os_list = ["linux"]
+version = "1.0.19"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.args in ("-i", "-il", "-li") and process.args_count <= 2 and
+process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.parent.args_count > 1 and
+process.parent.name like (
+  "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "php*", "socat",
+  "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "node"
+) and not (
+  process.parent.args like (
+    "echo*| sudo -S su; sudo su;*SHELL -i", "/usr/share/kali-menu/exec-in-shell", "/usr/bin/kali-treecd", "pipenv",
+    "/usr/scratch/xar/23e8559c/bin/python"
+  ) or
+  process.parent.command_line in (
+    "/bin/sh -c bash -i </dev/tty >/dev/tty 2>/dev/tty", "/bin/bash --login --posix", "bash -c sudo su - oracle; $SHELL -i"
+  ) or
+  process.parent.command_line like (
+    "/usr/scratch/*poetry shell", "*/u01/app/oracle.ahf/tfa/internal/tmp/*.sh*", "*/opt/oracle/oracle.ahf/tfa/internal/*.sh*",
+    "bash -c ls -al; $SHELL -i", "bash -c cd ~/GIT/salt/pillars; $SHELL -i", "bash -c cd ~/GIT/ansible-infra; $SHELL -i",
+    "bash -c cd ~/GIT/salt/states; $SHELL -i", "bash -c cd ~/GIT/puppet/hieradata; $SHELL -i",
+    "bash -c cd ~/GIT/puppet/ind_legacy; $SHELL -i"
+  ) or
+  process.command_line == "/opt/cursor.appimage -i" or
+  process.parent.executable like (
+    "/mnt/*/.vscode-server/bin/*/node", "/vscode/vscode-server/bin/*/node", "/home/*/.vscode-server/bin/*/node",
+    "/usr/scratch/*/.vscode-server/bin/*/node", "/home/*/.vscode-server/*/server/node", "/scratch/user/*/.vscode-server/cli/servers/*/server/node",
+    "/home/*/.vscode/cli/servers/*/server/node", "/root/.vscode-server/cli/servers/*/server/node", "/mnt/*/.vscode-server/cli/servers/*/server/node",
+    "/home/*/.antigravity-server/bin/*/node", "/user/*/.trae-server/bin/*/node"
+  ) or
+  (process.parent.command_line like ("*pipenv*", "*poetry*") and process.parent.args:"shell")
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -8,12 +8,12 @@ id = "332a8018-6615-4d2d-aeff-61e85e5ae77b"
 license = "Elastic License v2"
 name = "Netcat Reverse Shell via Busybox"
 os_list = ["linux"]
-version = "1.0.7"
+version = "1.0.8"

 query = '''
 sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and process.name == "busybox" and
-   process.command_line like ("* nc *", "* netcat *", "* ncat *") and not process.args like "-*z*"]
+   process.command_line like ("* nc *", "* netcat *", "* ncat *") and not process.command_line like "*-*z*"]
  [network where event.type == "start" and event.action == "connection_attempted" and process.name == "busybox" and 
   not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
@@ -0,0 +1,65 @@
+[rule]
+description = """
+This rule detects the creation of a reverse shell through the use of named pipes. Attackers may leverage named pipes to
+evade detection and establish persistence onto a target system.
+"""
+id = "40bec6eb-e93b-4d09-8265-66bba186e332"
+license = "Elastic License v2"
+name = "Potential Reverse Shell via Named Pipe"
+os_list = ["linux"]
+version = "1.0.15"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and
+process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
+  (process.name == "mknod" and process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") and process.args_count <= 5) or
+  (
+    process.name == "mkfifo" and
+    process.parent.args == "-c" and
+    process.parent.command_line like "*rm*" and
+    process.parent.command_line like "*|*" and
+    process.parent.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
+  )
+) and
+not (process.name == "mknod" and process.args like ("/var/tmp/dracut*", "/tmp/dracut.*", "/var/tmp/portage/*", "/tmp/dib_build*"))
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -9,7 +9,7 @@ id = "d67ef864-5567-4675-b2eb-7dfd4443e8af"
 license = "Elastic License v2"
 name = "Recently Downloaded File Made Executable and Run"
 os_list = ["linux"]
-version = "1.0.6"
+version = "1.0.7"

 query = '''
 sequence by process.parent.entity_id with maxspan=10s
@@ -37,7 +37,7 @@ sequence by process.parent.entity_id with maxspan=10s
     process.parent.executable == "/usr/local/bin/check_idle.sh" or
     process.executable like (
       "/var/lib/docker/*", "/tmp/tmp.*/rustup-init", "/tmp/cis-diagnose-rc-amd64", "/tmp/tmp.*/juliainstaller",
-       "/etc/actions-runner-*", "/builds/*/snyk"
+       "/etc/actions-runner-*", "/builds/*/snyk", "/tmp/mpm", "/tmp/coder.*/coder", "/tmp/helm"
     ) or
     (process.executable like "/tmp/teleport-*/install.sh" and process.args == "/usr/bin/env" and process.working_directory like "/tmp/teleport-*") or
     (process.executable == "/tmp/garage" and process.parent.args == "/garage-init") or
@@ -7,7 +7,7 @@ id = "9e879677-2317-4c1d-bddb-8fa4629be810"
 license = "Elastic License v2"
 name = "Sleep Execution from Suspicious Process Path"
 os_list = ["linux"]
-version = "1.0.12"
+version = "1.0.13"

 query = '''
 sequence by process.parent.entity_id with maxspan=5s
@@ -21,8 +21,9 @@ sequence by process.parent.entity_id with maxspan=5s
      "/tmp/*/.venv/bin/python", "/tmp/text_templater_*", "/var/tmp/container*/usr/bin/dpkg", "/tmp/container*/usr/bin/dpkg",
      "/run/systemd/mount-rootfs/nix/store/*", "/tmp/xfs-*/yarn", "/tmp/root/spack*", "/tmp/nix-shell-*/node",
      "/tmp/nix-shell-*/yarn", "/var/tmp/portage/*", "/tmp/.*.ansible/ansible-tmp-*", "/tmp/nsjail.1000.root/usr/bin/sleep",
-      "/tmp/usr/bin/*"
+      "/tmp/usr/bin/*", "/tmp/build/.heroku/node/bin/npm", "/tmp/petalinux/*", "/tmp/tailsampling-*"
    ) or
+    process.command_line == "runc init" or
    process.name in ("gcc", "xgcc", "nvim") or
    process.parent.name == "ansible" or
    process.working_directory like (
@@ -33,6 +34,7 @@ sequence by process.parent.entity_id with maxspan=5s
      "/tmp/go-build*", "/tmp/newroot/tmp/.mount*", "/var/lib/containers/*", "/tmp/newroot/usr/bin/ansible-playbook",
      "/usr/bin/ansible-playbook"
    ) or
+    process.parent.args like "source /home/*/.claude/shell-snapshots/snapshot-bash*" or
    process.parent.command_line like "*github.com/community-scripts/ProxmoxVE/*" or
    process.parent.command_line == "bash -c while true; do sleep 1;head -v -n 8 /proc/meminfo; head -v -n 2 /proc/stat /proc/version /proc/uptime /proc/loadavg /proc/sys/fs/file-nr /proc/sys/kernel/hostname; tail -v -n 32 /proc/net/dev;echo '==> /proc/df <==';df -l;echo '==> /proc/who <==';who;echo '==> /proc/end <==';echo '##Moba##'; done"
  )]
@@ -7,7 +7,7 @@ id = "613da93c-226e-4150-9125-3b476103c0b9"
 license = "Elastic License v2"
 name = "Socat Reverse Shell or Listener Activity"
 os_list = ["linux"]
-version = "1.0.12"
+version = "1.0.13"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.name == "socat" and
@@ -15,12 +15,13 @@ process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
 process.command_line like~ ("*tcp*", "*udp*", "*openssl*") and
 not (
  process.command_line like~ ("*127.0.0.1*", "*localhost*", "*/dev/tty*") or
-  process.parent.executable in ("/usr/bin/wsrep_sst_xtrabackup-v2", "/usr/bin/dumb-init", "/usr/bin/make", "/usr/bin/sudo") or
+  process.parent.executable in ("/usr/bin/wsrep_sst_xtrabackup-v2", "/usr/bin/dumb-init", "/usr/bin/make", "/usr/bin/sudo", "/usr/bin/wsrep_sst_mariabackup") or
  process.parent.executable like "/var/lib/docker/*" or
  process.parent.command_line == "runc init" or
  process.parent.name in ("kube-apiserver", "apiserver_entrypoint.sh", "start-proxy") or
  (process.working_directory == "/usr/share/epoptes-client" and process.parent.command_line == "epoptes-client") or
-  process.parent.args == "/usr/bin/wsrep_sst_xtrabackup-v2"
+  process.parent.args == "/usr/bin/wsrep_sst_xtrabackup-v2" or
+  process.args like ("UNIX-CONNECT:/tmp/claude-*.sock", "TCP:*.devops.maintenance.abovecloud.io:443")
 )
 '''

@@ -8,7 +8,7 @@ id = "d00bd50b-577e-47a7-9234-b4bfaa599791"
 license = "Elastic License v2"
 name = "Suspicious PHP Command Execution"
 os_list = ["linux"]
-version = "1.0.6"
+version = "1.0.7"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -23,10 +23,15 @@ process.args == "-r" and process.command_line like~ (
  "*move_uploaded_file(*"
 ) and not (
  // Exclude web server processes as these are covered by other rules
-  process.working_directory like ("/var/www/*", "/builds/*", "/home/*/jenkins/*", "/home/*/public_html*") or
+  process.working_directory like (
+    "/var/www/*", "/builds/*", "/home/*/jenkins/*", "/home/*/public_html*", "/var/lib/ldap-account-manager/config"
+  ) or
  process.parent.args like ("/var/www/html/*", "source /home/*/.claude/shell*") or
  process.args like "/usr/local/cpanel/*" or
-  process.command_line like "*https://composer.github.io/installer.sig*" or
+  process.command_line like (
+    "*https://composer.github.io/installer.sig*",
+    "*json_decode(file_get_contents('php://stdin')*"
+  ) or
  process.parent.command_line == "runc init"
 )
 '''
@@ -0,0 +1,115 @@
+[rule]
+description = """
+This rule monitors for suspicious Python command executions by detecting the start of a Python process with a command
+line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
+include operations to execute code, create subprocesses, and encode or decode data.
+"""
+id = "028d01ae-bfbf-438e-a0d0-23aee55ea5c9"
+license = "Elastic License v2"
+name = "Suspicious Python Command Execution"
+os_list = ["linux"]
+version = "1.0.16"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and process.name like "python*" and
+process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
+process.args == "-c" and (
+  (
+    process.command_line like~ ("*import *os;*", "*import *os,*", "*import *pty;*",  "*import *pty,*") and
+    process.command_line like~ ("*os.system*", "*os.setuid*", "*os.dup2*", "*pty*", "*os.popen(*")
+  ) or
+  (
+    process.command_line like~ ("*import *socket;*", "*import *socket,*") and
+    process.command_line like~ ("*.connect(*", "*os.getenv*", "*os.dup2*", "*socket.socket(*", "*.bind(*") and
+    process.command_line like~ "*/bin/*sh*"
+  ) or
+  (
+    process.command_line like~ ("*import *subprocess*;", "*import *subprocess,*") and
+    process.command_line like~ "*subprocess.call*"
+  ) or
+  (
+    process.command_line like~ ("*base64*", "*binascii*", "*zlib*", "*gzip*", "*bz2*", "*lzma*", "*marshal.loads(*", "*pickle.loads(*") and
+    process.command_line like~ ("*exec(*", "*eval(*")
+  )
+) and process.working_directory like (
+  "/var/www/*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*"
+) and not (
+  process.parent.args in ("pip", "install", "--pgo", "/tmp/portage/bin/pid-ns-init") or
+  process.parent.args like "/home/*/bin/join-zoom.sh" or
+  process.parent.name in ("pip", "pytest", "pip3", "sudo", "sshd", "teleport") or
+  process.executable like~ ("/var/lib/docker/*", "/tmp/plz_sandbox/*") or
+  process.command_line like (
+    "/usr/local/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
+    "/usr/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
+    "python -c import socket s = socket.socket(socket.AF_INET) s.bind(('127.0.0.1', 0)) _, listen_port = s.getsockname() s.close() print(listen_port)",
+    "*sqlite*", "*postgres*", "python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks",
+    """/usr/bin/python3 -c from tkinter import Tcl; print(Tcl().eval("info*"))""",
+    "python3*os.system*echo test*", "python3 -c import pymysql*",
+    "python3 -c import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()",
+    "python3 -c import socket; s=socket.socket(); s.bind(('0', 0)); print(s.getsockname()[1]); s.close()",
+    "python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
+    "python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
+    "import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
+    "*Thomas Nagy*"
+  ) or
+  process.parent.executable like~ (
+    "/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
+    "/pro/bin/sys/dbutils/dbaValidateOsUserCredentials.sh", "/usr/sbin/lxc", "/sbin/lxc", "/data/flash/Linux_for_Tegra/flash.sh",
+    "/usr/bin/ansible-playbook", "/usr/local/bin/teleport", "/usr/local/bin/odoo-helper", "/home/*/bin/join-zoom.sh",
+    "/usr/lib/openssh/sshd-session", "/usr/sbin/lxd", "/usr/sbin/tailscaled"
+  ) or
+  process.args like~ """import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""" or
+  process.working_directory like~ (
+    "/data/jenkins/.local/share/containers/storage/overlay/*", "/var/run/cloudera-scm-agent/*", "/tmp/pip-req-build*",
+    "/tmp/pip-resolve-*", "/build/source", "/tmp/pip-install-*", "/opt/airflow", "/tmp/pip-wheel-*", "/tmp/pip-download-*",
+    "/tmp/plz_sandbox", "/builds/*", "/scratch/*", "/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild*",
+    "/tmp/baum/easybuild/*", "/tmp/zenix-flashing/*", "/opt/ansible*", "/pro/bin/sys/monitor", "/home/jenkins/workspace/*",
+    "/var/tmp/portage/*", "/tmp/build/*/ansible", "/root/thg-intelligence", "/home/*/*/*/*", "/root/airflow"
+  ) or
+  process.parent.command_line like~ (
+    "/nix/store/*pytest*", "*/home/*/.claude/shell-snapshots/*", "*vault/core/test_hub/resources/events_checksum_monitor/bucket/verifier_test.go*"
+  ) or
+  process.parent.command_line in ("/bin/bash /docker-entrypoint.sh worker", "/bin/bash /docker-entrypoint.sh") or
+  (process.parent.args == "/usr/sbin/lxc" and process.parent.args in ("list", "info", "version")) or
+  (process.working_directory like "/tmp/tmp.*" and process.command_line == "python3 -c import socket; s = socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()") or
+  (
+    process.executable in ("/bin/python2", "/usr/bin/python2") and
+    process.command_line like (
+      "*causixenqueuer/firefoot/config.json*", "*s3loguploader.yml*", "*MUM1_AWS_ACCESS_KEY_ID*", "*/etc/init/ahn.conf*", "*AWS_SECRET_ACCESS_KEY_SGP1*"
+    )
+  )
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.006"
+name = "Python"
+reference = "https://attack.mitre.org/techniques/T1059/006/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -8,7 +8,7 @@ id = "5f6dbe52-6643-486f-9130-256f58ba9a0c"
 license = "Elastic License v2"
 name = "Suspicious Shell Command Execution via Node.js Parent"
 os_list = ["linux"]
-version = "1.0.7"
+version = "1.0.8"

 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -32,13 +32,16 @@ process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
 ) and 
 not (
  process.executable like "/tmp/newroot/*" or
-  process.command_line like ("*169.254.169.254*", "*localhost*", "*127.0.0.1*", "*SNAPSHOT_FILE=*", "*/tmp/claude-shell-snapshot*") or
+  process.command_line like (
+    "*169.254.169.254*", "*localhost*", "*127.0.0.1*", "*SNAPSHOT_FILE=*", "*/tmp/claude-shell-snapshot*",
+    "/home/*/.openclaw/*", "/api.notion.com/*", "/shubble.git/*"
+  ) or
  process.args like ("-l SNAPSHOT_FILE*", "-l source*", "NODE_TLS_REJECT_UNAUTHORIZED=0*", "*.claude/*", "ssh-keyscan*", "supergateway --sse*") or
  (
    process.command_line like "/bin/sh -c rm -rf /dev/shm/streams/*" and
    process.parent.args == "/usr/local/lib/node_modules/pm2/lib/ProcessContainerFork.js"
  ) or
-  process.parent.args like ("/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "openclaw-gateway") or
+  process.parent.args like ("/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js", "openclaw-gateway", "/opt/cursor-agent/node") or
  process.command_line in (
    """/bin/sh -c echo BROWSER=none > .env && echo DEMO=true >> .env && echo PORT=3000 >> .env && printf "PUBLIC_URL=http://$(hostname -I | awk '{print $1}'):3000/\n" >> .env && echo WDS_SOCKET_PORT=3000 >> .env && printf "WDS_SOCKET_HOST=$(hostname -I | awk '{print $1}')\n" >> .env && echo JSX_IMPORT_SOURCE=@ac/library-utils/dist/web-components/wc-jsx >> .env""",
    "/bin/sh -c chmod +x /etc/init.d/pm2-docker-deployer", """/bin/sh -c grep "^#[ ]*Port[ ]*[0-9]*" /etc/ssh/sshd_config 2>/dev/null"""
@@ -12,7 +12,7 @@ reference = [
    "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
    "https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/",
 ]
-version = "1.0.8"
+version = "1.0.9"

 query = '''
 sequence with maxspan=1m 
@@ -38,10 +38,10 @@ sequence with maxspan=1m
   ) and
   not (
     process.args like (
-       "for f in*", "id*", "[*", "/usr/bin/mpstat*", "(cp*jenkins-result.txt*", "cat /application/*nohup_*.out*"
+       "for f in*", "id*", "[*", "/usr/bin/mpstat*", "(cp*jenkins-result.txt*", "cat /application/*nohup_*.out*", "test*", "export*"
     ) or
     process.command_line in (
-       "/bin/bash -c echo ping",
+       "/bin/bash -c echo ping", "bash -c echo $$",
       "/bin/sh -c export LC_ALL=en_US.UTF-8;if [ -e /tmp ]; then /usr/bin/echo /tmp ; fi ; ",
       "sh -c stty -echo < /dev/tty",
       "/bin/sh -c which perl",
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "Potential Mining Pool Command Detection"
 os_list = ["linux"]
 reference = ["https://falco.org/blog/falco-detect-cryptomining/"]
-version = "1.0.7"
+version = "1.0.8"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
@@ -43,12 +43,14 @@ process.command_line like (
  "*webhop.net*", "*ethpool.org*", "*slushpool.com*", "*antpool.com*", "*nicehash.com*", "*nicehash.net*",
  "*zergpool.com*", "*mining-dutch.nl*", "*blockmasters.co*", "*bsod.pw*", "*fairpool.xyz*", "*miningrigrentals.com*",
  "*hashing24.com*", "*ethermine.org*", "*flexpool.io*", "*hiveon.net*", "*sparkpool.com*", "*2miners.org*",
-  "*poolin.com*", "*viabtc.com*", "*btc.com*", "*f2pool.org*", "*coinhive.com*", "*cryptoloot.pro*", "*webmine.cz*",
+  "*poolin.com*", "*viabtc.com*", "*f2pool.org*", "*coinhive.com*", "*cryptoloot.pro*", "*webmine.cz*",
  "*minero.cc*", "*monerohash.org*", "*monerohash.net*", "*moneropool.ru*", "*moneroocean.stream*", "*rx.unmineable.com*"
 ) and not (
  process.parent.name in ("sendmail", "postfix-local", "check-quota", "zmcontrol", "find", "timeout", "php") or
  process.name in ("timeout", "host", "ptxas") or
-  process.command_line like "*zpool.cache*"
+  process.command_line like "*zpool.cache*" or
+  process.parent.args == "/scripts/run_certbot.sh" or
+  process.parent.command_line == "runc init"
 )
 '''

@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies potential exploitation of a Telnet remote authentication bypass vulnerability (CVE-2026-24061) in GNU
+Inetutils telnetd. The vulnerability allows unauthenticated access by supplying a crafted "-f <username>" value via the
+"USER" environment variable, resulting in a login process spawned with elevated privileges.
+"""
+id = "afb48a5f-f1d5-402c-91f8-53a8c279e1ed"
+license = "Elastic License v2"
+name = "Potential Telnet Authentication Bypass (CVE-2026-24061)"
+os_list = ["linux"]
+reference = [
+    "https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/",
+    "https://security-tracker.debian.org/tracker/CVE-2026-24061",
+    "https://man7.org/linux/man-pages/man1/login.1.html",
+]
+version = "1.0.1"
+
+query = '''
+process where event.type == "start" and event.action == "exec" and (
+  (process.name == "login" and process.args like~ "-*f*" and process.parent.name == "telnetd") or 
+  descendant of [
+    process where event.type == "start" and event.action == "exec" and
+    process.name == "login" and process.args like~ "-*f*" and process.parent.name == "telnetd"
+  ]
+)
+'''
+
+min_endpoint_version = "7.15.0"
+optional_actions = []
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1210"
+name = "Exploitation of Remote Services"
+reference = "https://attack.mitre.org/techniques/T1210/"
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.15.0"
@@ -7,14 +7,14 @@ id = "d20cd4ba-ff65-4e1c-8012-4241d449b16b"
 license = "Elastic License v2"
 name = "Egress Network Connection from RPM Package"
 os_list = ["linux"]
-version = "1.0.10"
+version = "1.0.11"

 query = '''
 sequence with maxspan=3s
  [process where event.type == "start" and event.action == "exec" and
   process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.parent.args : "/var/tmp/rpm-tmp.*" and not (
-     (process.name == "curl" and process.command_line like "*.microsoft.com/api/report*") or
+     (process.name == "curl" and process.command_line like ("*.microsoft.com/api/report*", "*check.percona.com*")) or
     process.executable in ("/sbin/runuser", "/usr/sbin/runuser") or
     process.working_directory like~ ("/builds/packages/naudit-repos", "/disco_flowlytics/docker/overlay2/*") or
     process.args : ("/usr/local/cpanel/3rdparty/wp-toolkit/*", "/usr/bin/rpmkeys") or
@@ -13,7 +13,7 @@ reference = [
    "https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
 ]
-version = "1.0.21"
+version = "1.0.22"

 query = '''
 process where event.type == "start" and event.action == "exec" and (
@@ -55,7 +55,8 @@ process where event.type == "start" and event.action == "exec" and (
    "/tmp/newroot/home/*/.local/share/JetBrains/*", "/home/*/.local/share/caa/caa",
    "/home/*/.local/bin/gitsign-credential-cache",
    "/home/*/.local/share/JetBrains/Toolbox/apps/intellij-idea-ultimate/bin/idea",
-    "/home/*/.local/share/JetBrains/*", "/home/*/.local/opt/activitywatch/*"
+    "/home/*/.local/share/JetBrains/*", "/home/*/.local/opt/activitywatch/*",
+    "/home/*/.local/bin/claude-oauth-proxy"
  ) or
  process.name in ("riptide-agent", "zellij", "gitsign-credential-cache", "jetbrains-toolbox", "goland") or
  process.working_directory == "/var/lib/rabbitmq"
@@ -12,7 +12,7 @@ reference = [
    "https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
 ]
-version = "1.0.14"
+version = "1.0.15"

 query = '''
 process where event.type == "start" and event.action == "exec" and (
@@ -37,7 +37,9 @@ process where event.type == "start" and event.action == "exec" and (
    "/bin/bash -c /etc/init.d/DL-Sync   >/dev/null 2>&1",
    "/bin/bash -c /etc/init.d/warn-users",
    "/bin/sh -c /etc/init.d/rpmconfigcheck > /dev/null 2>&1",
-    "/bin/sh -c /etc/init.d/dwopen check >/dev/null 2>&1"
+    "/bin/sh -c /etc/init.d/dwopen check >/dev/null 2>&1",
+    "/bin/sh -c /etc/init.d/SapphireIMSAgent keep_alive>/dev/null 2>&1",
+    "/bin/sh -c /etc/init.d/clean-docker.sh"
  ) or
  process.command_line like~ ("*/etc/init.d/*start*", "*/etc/init.d/*reload*", "*/etc/init.d/*stop*", "*/etc/cron.daily/*") or
  process.args like~ "/run/jaws-ansible-processors/pcaps/pcap_processor.sh*" or
@@ -9,7 +9,7 @@ id = "a13c8f01-36a5-4ad7-a282-8d297cf62860"
 license = "Elastic License v2"
 name = "Suspicious Echo Execution"
 os_list = ["linux"]
-version = "1.0.26"
+version = "1.0.27"

 query = '''
 process where event.type == "start" and event.action == "exec" and
@@ -66,7 +66,9 @@ not (
    "/tmp/go-build*", "/opt/windsurf/windsurf", "/var/lib/docker/overlay2/*/usr/local/bin/node",
    "/usr/lib/x86_64-linux-gnu/lxc/rootfs/usr/lib/openssh/sshd-session", "/cav/gtm/mumps", "/usr/bin/kiro-cli-chat",
    "/bin/rphcp", "/u1/grid/*/perl/bin/perl", "/home/*/.vscode-oss/extensions/openai.chatgp*universal/bin/linux-x86_64/codex",
-    "/opt/teleport/system/bin/teleport", "/opt/claude-code/bin/claude", "/usr/cachesys/bin/cache"
+    "/opt/teleport/system/bin/teleport", "/opt/claude-code/bin/claude", "/usr/cachesys/bin/cache", "/usr/bin/sway", "/usr/bin/runc",
+    "/usr/bin/sw-engine", "/opt/nvidia/sdkmanager/sdkmanager-gui", "/usr/bin/claude-bin", "/home/*/.vscode-server/*/codex",
+    "/usr/bin/mawk", "/mnt/ssd/wda/tools/nuctl/nuctl-*-linux-amd64"
  ) or
  process.parent.command_line in (
    "runc init", "buildkit-runc init", "/usr/local/bin/runc init", "python ./ssh.py --update-fingerprints bi_team",
@@ -82,7 +84,7 @@ not (
    "*/opt/oracle/instantclient", "*message*log*rotate*", "*CONTROL_BATTERY_LEVEL_POLLING*",
    "sh -c echo /opt/oracle/instantclient* > /etc/ld.so.conf.d/oracle-instantclient.conf",
    "sh -c *clsecho*", "/bin/bash -c /usr/local/nagios/libexec/mkls*", "/usr/bin/crun*", "*/usr/bin/ssh-keygen*",
-    "bash -c source /etc/profile.local; echo $REGISTRY_AUTH_FILE",
+    "bash -c source /etc/profile.local; echo $REGISTRY_AUTH_FILE", "*ProxmoxVE*", "*/etc/init.d/acfssihamount*",
    """/bin/sh -c echo -e "\n Hi, before stop today is $(date) \n" >> /tmp/daily_stop_start_tomcat-apnbdwef.log; /etc/init.d/tomcat-apnbdwef stop >> /tmp/daily_stop_start_tomcat-apnbdwef.log; echo -e "\n Hi, before start today is $(date) \n" >> /tmp/daily_stop_start_tomcat-apnbdwef.log; /etc/init.d/tomcat-apnbdwef start >> /tmp/daily_stop_start_tomcat-apnbdwef.log"""
  ) or
  process.command_line == """/usr/bin/sh -c echo date=$(date +"%Y%m%d") > /dev/shm/mag/sptwweb.env""" or
@@ -1,14 +1,14 @@
 [rule]
 description = """
 This rule detects the execution of a process from an unusual location, immediately after an SSH process is started. This
-could indicate an attacker attempting to execute a malicious process in the context of an SSH session, or a succesfully
+could indicate an attacker attempting to execute a malicious process in the context of an SSH session, or a successfully
 planted backdoor within a user shell configuration.
 """
 id = "94f548c8-cad2-4bc5-bf61-c0e42558ef65"
 license = "Elastic License v2"
 name = "Unusual SSH Parent/Child Execution"
 os_list = ["linux"]
-version = "1.0.15"
+version = "1.0.16"

 query = '''
 sequence with maxspan=3s
@@ -10,7 +10,7 @@ license = "Elastic License v2"
 name = "Potential Privilege Escalation via SUID Binary"
 os_list = ["linux"]
 reference = ["https://gtfobins.github.io/#+suid"]
-version = "1.0.9"
+version = "1.0.10"

 query = '''
 process where event.type == "start" and event.action == "exec" and (
@@ -30,7 +30,7 @@ process where event.type == "start" and event.action == "exec" and (
    "ld.so", "less", "links", "logsave", "look", "lua", "make",
    "mosquitto", "msgattrib", "msgcat", "msgconv", "msgfilter", "msgmerge", "msguniq", "multitime",
    "nasm", "ncftp", "nft", "nl", "nm", "nmap", "nohup", "ntpdate",
-    "od", "openssl", "openvpn", "pandoc", "paste", "perf", "perl", "pexec", "pg", "php", "pidstat",
+    "od", "openssl", "openvpn", "pandoc", "paste", "perf", "pexec", "pg", "pidstat",
    "pr", "ptx", "python", "rc", "readelf", "restic", "rlwrap", "rsync", "rtorrent",
    "rview", "sash", "scanmem", "setarch", "setlock",
    "soelim", "softlimit", "sqlite3", "ss", "ssh-agent", "ssh-keygen", "ssh-keyscan",
@@ -7,11 +7,12 @@ id = "0701ab8c-9abc-41e1-8af7-2d937778e73f"
 license = "Elastic License v2"
 name = "Suspicious Image Creation via ScreenCapture"
 os_list = ["macos"]
-version = "1.0.4"
+version = "1.0.5"

 query = '''
 sequence by process.entity_id with maxspan=10s
 [process where event.type == "start" and event.action == "exec" and process.name == "screencapture" and
+  not process.command_line == "screencapture --help" and
  not process.parent.executable like ("/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer",
                                      "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow") and
  not process.Ext.effective_parent.executable like ("/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer",
@@ -14,7 +14,7 @@ reference = [
    "https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/",
    "https://www.uptycs.com/blog/macos-bashed-apples-of-shlayer-and-bundlore",
 ]
-version = "1.0.4"
+version = "1.0.5"

 query = '''
 sequence by process.entity_id with maxspan=30s
@@ -10,7 +10,7 @@ license = "Elastic License v2"
 name = "Curl from Volume Mount"
 os_list = ["macos"]
 reference = ["https://objective-see.org/blog/blog_0x71.html"]
-version = "1.0.25"
+version = "1.0.26"

 query = '''
 sequence by process.entity_id with maxspan=5s
@@ -19,7 +19,8 @@ sequence by process.entity_id with maxspan=5s
  process.Ext.effective_parent.executable like "/Volumes/*" and
  process.args_count >= 3 and
  process.args in ("-o", "--output", "-O", "--remote-name", "--download", "-dl", "-dir", "--directory", "-L", "--location") and
-  not process.args : ("--version", "-V", "*elastic.cloud*")]
+  not process.args : ("--version", "-V", "*elastic.cloud*") and
+  not process.parent.command_line in ("/bin/bash -p /opt/homebrew/Library/Homebrew/brew.sh update --auto-update", "/bin/bash -p /usr/local/Homebrew/Library/Homebrew/brew.sh update --auto-update")]
 [network where event.type == "start" and
 not destination.domain like "localhost" and not
 cidrmatch(
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Suspicious Curl to OAST Domain"
 os_list = ["macos"]
 reference = ["https://socket.dev/blog/weaponizing-oast-how-malicious-packages-exploit-npm-pypi-and-rubygems"]
-version = "1.0.3"
+version = "1.0.4"

 query = '''
 process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and 
@@ -1,18 +1,19 @@
 [rule]
 description = """
-Detects when a code editor (VScode and Intellij Idea for now) spawn a shell to execute a self-signed and untrusted
-binary. This actvity is indicative of a malicious 3rd party plugin or extension.
+Detects when a code editor (VSCode, Cursor, or IntelliJ IDEA) spawns a shell to execute a self-signed and untrusted
+binary. This activity is indicative of a malicious 3rd party plugin or extension.
 """
 id = "9b9776bb-6bf3-4c06-94ff-64159b52a2f3"
 license = "Elastic License v2"
 name = "Code Editor Untrusted or Unsigned Child Process Execution"
 os_list = ["macos"]
-version = "1.0.18"
+version = "1.0.19"

 query = '''
 process where event.type == "start" and event.action == "exec" and
 process.Ext.effective_parent.executable in ("/Applications/IntelliJ IDEA.app/Contents/MacOS/idea",
-                                            "/Applications/Visual Studio Code.app/Contents/MacOS/Electron") and 
+                                             "/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
+                                             "/Applications/Cursor.app/Contents/MacOS/Cursor") and 
 process.parent.name in ("bash", "sh", "zsh") and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
@@ -25,7 +26,7 @@ process where event.type == "start" and event.action == "exec" and
                           "/usr/local/Cellar/*",
                           "/opt/nordic/ncs/toolchains/*/Cellar/*",
                           "/Users/*/homebrew/Cellar/*") and 
- not process.command_line == "bento completion zsh --silent" and
+ not process.command_line like~ ("bento completion zsh --silent", "*http://localhost*") and
 not process.code_signature.signing_id like~ ("python3-*", 
                                              "ruby-*", 
                                              "python-*", 
@@ -8,11 +8,15 @@ license = "Elastic License v2"
 name = "Decoy Document Creation via Curl"
 os_list = ["macos"]
 reference = ["https://www.kandji.io/blog/todoswift-disguises-malware-download-behind-bitcoin-pdf"]
-version = "1.0.8"
+version = "1.0.9"

 query = '''
 file where event.action == "modification" and file.path like ("/tmp/*", "/private/tmp/*", "/Users/Shared/*", "/Users/*/Library/*") and
- file.extension in ("pdf", "doc") and process.name in ("curl", "nscurl")
+ file.extension in ("pdf", "doc") and process.name in ("curl", "nscurl") and
+ not Effective_process.executable like~ (
+  "/Applications/Cursor.app/Contents/MacOS/Cursor",
+  "/Applications/Visual Studio Code.app/Contents/MacOS/Electron"
+)
 '''

 min_endpoint_version = "8.11.0"
@@ -9,13 +9,19 @@ license = "Elastic License v2"
 name = "Payload Piped to Script Interpreter"
 os_list = ["macos"]
 reference = ["https://github.com/nnsee/fileless-elf-exec"]
-version = "1.0.13"
+version = "1.0.14"

 query = '''
 sequence by process.parent.entity_id with maxspan=10s
 [process where event.type == "start" and event.action == "exec" and
  process.name like~ ("zsh", "sh", "bash", "python*", "terminal") and
-  process.args == "-c"]
+  process.args == "-c" and
+  (
+    process.command_line : ("*curl*|*", "*nscurl*|*", "*wget*|*", "*osascript*|*",
+                            "*/dev/tcp/*", "*base64*|*", "*openssl*|*", "*nc *|*") or
+    process.command_line : ("*curl*>*", "*wget*>*") or
+    process.command_line : "*http*|*"
+  )]
 [process where event.type == "start" and event.action == "exec" and 
  process.name like~ ("python*", "perl*", "ruby*", "osascript") and
  process.parent.name in ("sh", "bash", "zsh", "osascript") and 
@@ -2,14 +2,14 @@
 description = """
 Detects when a .pl file gets created or modified by a non-perl binary. Perl is a scripting language that comes
 pre-installed on macOS and is a trusted binary offering an extensive set of capabilities and advantages to an adversary.
-Its use on a macOS system is not common and therefor specific behaviors exhibited can be classified as malicious or
+Its use on a macOS system is not common and therefore specific behaviors exhibited can be classified as malicious or
 suspicious at least.
 """
 id = "f2fa4350-6700-46d1-b79c-fedd385f6984"
 license = "Elastic License v2"
 name = "Perl Script File Creation or Modification"
 os_list = ["macos"]
-version = "1.0.7"
+version = "1.0.8"

 query = '''
 sequence by process.entity_id with maxspan=15s
@@ -2,13 +2,13 @@
 description = """
 Detects process events where the process is Powershell (pwsh) or a shell interpreter (sh, bash, zsh) with the encoded
 command flag set in the process arguments. Powershell usage on macOS is extremely rare but usage of Powershell with the
-encoded command flag, used for executing base64 encoded command strings, is almost always inherently malicous.
+encoded command flag, used for executing base64 encoded command strings, is almost always inherently malicious.
 """
 id = "4abb4f46-2066-4769-b073-dca491067e1b"
 license = "Elastic License v2"
 name = "Powershell Encoded Command"
 os_list = ["macos"]
-version = "1.0.20"
+version = "1.0.21"

 query = '''
 process where event.type == "start" and process.args in~ ("-EncodedCommand", "-enc") and
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Suspicious Electron Command Execution"
 os_list = ["macos"]
 reference = ["https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf"]
-version = "1.0.10"
+version = "1.0.11"

 query = '''
 sequence with maxspan=15s
@@ -9,11 +9,12 @@ license = "Elastic License v2"
 name = "Suspicious Remote Javascript Evaluation via Nodejs"
 os_list = ["macos"]
 reference = ["https://kl4r10n.tech/blog/dprk-new-malware"]
-version = "1.0.3"
+version = "1.0.4"

 query = '''
 sequence with maxspan=20s
-[network where event.action == "connection_attempted" and process.name == "node"] by process.entity_id
+[network where event.action == "connection_attempted" and process.name == "node" and
+  not destination.domain in ("registry.npmjs.org", "classic.yarnpkg.com")] by process.entity_id
 [process where event.type == "start" and event.action == "exec" and process.name == "node" and
 process.args == "-e" and process.args_count == 3 and
 not process.command_line : ("*try*require*postinstall*catch*", "*import*postinstall*catch*")] by process.parent.entity_id
@@ -11,7 +11,7 @@ license = "Elastic License v2"
 name = "Suspicious Terminal Child Process Execution"
 os_list = ["macos"]
 reference = ["https://cedowens.medium.com/give-me-some-macos-context-c13aecbd4c5b"]
-version = "1.0.20"
+version = "1.0.21"

 query = '''
 process where event.type == "start" and event.action == "exec" and 
@@ -9,7 +9,7 @@ id = "6e53dbb1-55c6-419c-ab8e-75a5d53aac49"
 license = "Elastic License v2"
 name = "Initial Access Staging via Installer Package"
 os_list = ["macos"]
-version = "1.0.10"
+version = "1.0.11"

 query = '''
 sequence by process.entity_id with maxspan=15s
@@ -12,7 +12,7 @@ reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
 ]
-version = "1.0.8"
+version = "1.0.9"

 query = '''
 api where process.executable != null and
@@ -29,7 +29,7 @@ api where process.executable != null and

  not (process.code_signature.subject_name == "NV Access Limited" and process.code_signature.trusted == true) and
  not process.executable : ("C:\\Program Files\\Python39\\pythonw.exe", "C:\\Program Files\\WSL\\msrdc.exe") and
-  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a", "0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364")
+  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a", "0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364", "f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081")
 '''

 min_endpoint_version = "8.12.0"
@@ -11,7 +11,7 @@ reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
 ]
-version = "1.0.21"
+version = "1.0.22"

 query = '''
 api where
@@ -58,10 +58,14 @@ api where
                    "C:\\Program Files\\Dell\\Dell Display and Peripheral Manager\\Plugins\\DDPM.Subagent.User\\DDPM.Subagent.User.exe") and
  not (process.code_signature.trusted == true and
       process.code_signature.subject_name in ("Grammarly, Inc.", "HP Inc.", "Proofpoint, Inc.", "ETH Zürich", "Learnpulse",
-        "Qisda Corporation", "ONELAUNCH TECHNOLOGIES INC.", "Laserfiche", "ARTICULATE GLOBAL, LLC", "ARTICULATE GLOBAL, LLC",
+        "Qisda Corporation", "ONELAUNCH TECHNOLOGIES INC.", "Laserfiche", "ARTICULATE GLOBAL, LLC",
        "Connectwise, LLC", "Carl Zeiss Microscopy GmbH", "Articulate Global, Inc.", "JItbit LP", "Dell Inc.",
        "Roblox Corporation", "Colony Labs, Inc.", "Devolutions Inc", "Wispr AI, Inc.", "Adobe Inc.", "Activision Publishing Inc")) and
-  process.thread.Ext.call_stack_final_user_module.hash.sha256 != "120446e2c7729a7ae15e08bcc5cdb95c35151aa0f7e803e53dc7e92a1579783d"
+  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("120446e2c7729a7ae15e08bcc5cdb95c35151aa0f7e803e53dc7e92a1579783d",
+                                                                      "46327ac3d7979cfc254ba0e76cd17b3a72128034f3618e8247bdcc9f6d84aea2",
+                                                                      "557ae751c11dfb2a9a976c3312f469a4f0b776c1088aeeefdee99b5327aa2fed",
+                                                                      "a57b437a7fe4eb285830564839f37a6704fa1f9dfe4a9a631cd28db43a83320c",
+                                                                      "604d2cddc32d62da41c9553f35eb9aac442574db219cb63caae25205bbff88f8")
 '''

 min_endpoint_version = "8.12.0"
@@ -7,12 +7,12 @@ id = "336ada1c-69f8-46e8-bdd2-790c85429696"
 license = "Elastic License v2"
 name = "Ingress Tool Transfer via CURL"
 os_list = ["windows"]
-version = "1.0.31"
+version = "1.0.32"

 query = '''
 process where event.action == "start" and

- /* renamed curl or curl running from normal users writable fodlers are very noisy */
+ /* renamed curl or curl running from normal users writable folders are very noisy */
 process.executable : ("?:\\Windows\\System32\\curl.exe", "?:\\Windows\\SysWOW64\\curl.exe") and

 (
@@ -42,7 +42,10 @@ process where event.action == "start" and
                      "https://blackhole.blob.core.windows.net/*") and

  /* avoid breaking privileged install */
-  not user.id : "S-1-5-18"
+  not user.id : "S-1-5-18" and
+  not (process.parent.name : "cmd.exe" and process.parent.command_line like~ "*oi-vscode-server*run.app*") and
+  not (process.parent.name : "cmd.exe" and process.parent.command_line like~ "*nexuspayables.com*showImage.php*") and
+  not (process.parent.command_line like~ "*VoicemodInstaller*" and process.parent.name like~ "VoicemodInstaller*")
 '''

 min_endpoint_version = "7.15.0"
@@ -7,7 +7,7 @@ id = "720e0265-03bc-4cb7-9116-7fad5ea9cdfc"
 license = "Elastic License v2"
 name = "Network Connect API from Unbacked Memory"
 os_list = ["windows"]
-version = "1.0.15"
+version = "1.0.16"

 query = '''
 api where process.Ext.api.name == "connect" and process.Ext.api.summary: "*ipv4*" and
@@ -83,7 +83,11 @@ api where process.Ext.api.name == "connect" and process.Ext.api.summary: "*ipv4*
                                   "3eb37ba3fc39f5749bbb3f17382d0966adf2e061f4f0d1757ebd75fed1302dd6",
                                   "0b29ecbb5277629a1be89193941ec9d58867118ab7ef6a9d0235f7c5388904d7",
                                   "0f4828417f3c8f8c6a5d74c39cb1dc746b241901e8bdd53bb09808858b7b0a08",
-                                   "cd08541db31221a2e26238cd6a2bcd6a9ebb9a4c4205c09b1b2050fde409f284") and
+                                   "cd08541db31221a2e26238cd6a2bcd6a9ebb9a4c4205c09b1b2050fde409f284",
+                                   "f834e4447d0b4c421ac2a0a9b10304a47688f358a6db9c1281bffe44957bcc4e",
+                                   "d0615bcbcaf0c64b2613c224924fce9e891a62287acc243a9b142ee0d021b207",
+                                   "7c71327ab87990b1ac0446813f2f1e69c33cc634afab5857cfa9fca17d0cc37e",
+                                   "ecbd9f72fe48043302f547643b26e2da9c12c4d8030d28e53f1651fb0e06a2ca") and

 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
                  $entry.callsite_trailing_bytes :
@@ -105,7 +109,6 @@ api where process.Ext.api.name == "connect" and process.Ext.api.summary: "*ipv4*
                           "C:\\Program Files\\Solari di Udine\\Inout Integration Service\\INOUT.Integration.Service.exe",
                           "C:\\Program Files\\Intel\\SUR\\QUEENCREEK\\SurSvc.exe",
                           "C:\\Program Files (x86)\\AdRem\\NetCrunch\\Console\\*\\NCConsole.exe",
-                           "C:\\Program Files\\Solari di Udine\\Inout Integration Service\\INOUT.Integration.Service.exe",
                           "C:\\Program Files\\Epic Games\\MarvelRivalsjKtnW\\MarvelGame\\Marvel\\Binaries\\Win64\\Marvel-Win64-Shipping.exe",
                           "C:\\Program Files\\winacme\\wacs.exe") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance == "inprocessclient64.dll"
@@ -7,7 +7,7 @@ id = "b5c91c3e-9d2d-4df6-afb7-c9d236b5ebe2"
 license = "Elastic License v2"
 name = "Unusual Kerberos Client Process"
 os_list = ["windows"]
-version = "1.0.30"
+version = "1.0.31"

 query = '''
 sequence by process.entity_id with maxspan=1m
@@ -22,7 +22,8 @@ sequence by process.entity_id with maxspan=1m
  not process.executable : 
         ("?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe",
          "?:\\Program Files\\Microsoft Azure Active Directory Connect\\AzureADConnect.exe",
-          "?:\\Program Files (x86)\\GalacticAgent\\bin\\GalacticScan.exe")]
+          "?:\\Program Files (x86)\\GalacticAgent\\bin\\GalacticScan.exe",
+          "?:\\Xelis Dental Trainer\\Bin-x64\\XelisDental.exe")]
 '''

 min_endpoint_version = "7.16.0"
@@ -7,7 +7,7 @@ os_list = ["windows"]
 reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
 ]
-version = "1.0.19"
+version = "1.0.20"

 query = '''
 sequence by process.entity_id with maxspan=1m
@@ -12,7 +12,7 @@ reference = [
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
 ]
-version = "1.0.58"
+version = "1.0.59"

 query = '''
 sequence by process.entity_id
@@ -150,7 +150,10 @@ sequence by process.entity_id

  not process.executable :
                  ("C:\\Program Files (x86)\\MultiExtractor\\MultiExtractor.exe",
-                   "C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe")
+                   "C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe") and
+
+  not (process.executable : "?:\\APP\\d3\\nats\\NatsCtl.exe" and process.parent.executable : "?:\\APP\\d3\\procmgr\\dserver.exe" and
+       process.code_signature.trusted == true and process.code_signature.subject_name : "d.velop AG")
  ]
 [library where
  dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
@@ -11,7 +11,7 @@ reference = [
    "https://blog.didierstevens.com/2017/03/20/",
    "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
 ]
-version = "1.0.53"
+version = "1.0.54"

 query = '''
 sequence with maxspan=5m
@@ -72,7 +72,8 @@ sequence with maxspan=5m
  not (process.pe.original_file_name in~ ("notification_helper.exe", "cpptools.exe") and process.code_signature.subject_name == "Microsoft Corporation" and
       process.code_signature.trusted == true) and

-  not (process.pe.original_file_name : "pmlauncher.exe" and process.code_signature.subject_name in ("BeyondTrust Software, Inc", "BeyondTrust Software Inc") and
+  not ((process.pe.original_file_name : "pmlauncher.exe" or process.executable : "C:\\Windows\\System32\\pmlauncher.exe") and 
+      process.code_signature.subject_name : ("BeyondTrust Software, Inc", "BeyondTrust Software Inc") and
       process.code_signature.trusted == true) and

  not (process.executable : "*\\Windows\\SystemApps\\Microsoft*.exe" and
@@ -9,7 +9,7 @@ license = "Elastic License v2"
 name = "Potential Hardware Breakpoints Evasion"
 os_list = ["windows"]
 reference = ["https://github.com/rad9800/hwbp4mw"]
-version = "1.0.2"
+version = "1.0.3"

 query = '''
 registry where event.action == "modification" and process.executable != null and registry.value == "CachePrefix" and
@@ -17,7 +17,11 @@ registry where event.action == "modification" and process.executable != null and
 not (process.code_signature.trusted == true and
      process.code_signature.subject_name in ("Roblox Corporation", "Kofax, Inc.", "PACE Anti-Piracy, Inc.", "CUMMINS INC.", "Nuance Communications, Inc.")) and
 not (process.executable : "C:\\Program Files (x86)\\Java\\jre*\\bin\\jp2launcher.exe" and
-      process.code_signature.subject_name == "Oracle America, Inc." and process.code_signature.trusted == true)
+      process.code_signature.subject_name == "Oracle America, Inc." and process.code_signature.trusted == true) and 
+ not (process.executable : "C:\\Program Files (x86)\\iLok License Manager\\iLok License Manager.exe" and 
+      process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|wininet.dll|ntdll.dll|kernelbase.dll|wininet.dll|ieframe.dll|windows.storage.dll|ieframe.dll|mshtml.dll|user32.dll|winsparkle.dll|kernel32.dll|ntdll.dll") and 
+ not (process.executable : ("C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSACCESS.EXE", "C:\\Program Files (x86)\\Microsoft Office\\Office16\\OUTLOOK.EXE") and 
+      process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|wininet.dll|ntdll.dll|kernelbase.dll|wininet.dll|adal.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll")
 '''

 min_endpoint_version = "8.11.0"
@@ -7,7 +7,7 @@ id = "19523b07-b1ce-4b4e-882c-18e9492e9591"
 license = "Elastic License v2"
 name = "Potential LogonUser API Hooking"
 os_list = ["windows"]
-version = "1.0.7"
+version = "1.0.8"

 query = '''
 api where process.Ext.api.name in ("WriteProcessMemory", "VirtualProtect") and
@@ -16,7 +16,8 @@ api where process.Ext.api.name in ("WriteProcessMemory", "VirtualProtect") and
 not process.thread.Ext.call_stack_final_user_module.path in ("c:\\windows\\syswow64\\werfault.exe", "c:\\windows\\system32\\werfault.exe") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true or $entry.status like "errorCode_endpoint*") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "fdfc853b183d682c912e6487a64dbaea98f8d09207a55d0a512e550c988d6273" and
- not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!LdrLoadDll*")
+ not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!LdrLoadDll*") and
+ not process.thread.Ext.call_stack_final_user_module.path : ("?:\\program files\\avg\\antivirus\\aswhook.dll", "?:\\program files\\avg\\antivirus\\x86\\aswhook.dll")
 '''

 min_endpoint_version = "8.10.0"
@@ -11,10 +11,11 @@ reference = [
    "https://attack.mitre.org/techniques/T1564/003/",
    "https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware",
 ]
-version = "1.0.3"
+version = "1.0.4"

 query = '''
-process where event.type == "start" and process.Ext.desktop_name like "WinSta0\\*"
+process where event.type == "start" and process.Ext.desktop_name like "WinSta0\\*" and
+not process.Ext.desktop_name : ("WinSta0\\Winlogon", "WinSta0\\Screen-saver", "WinSta0\\ScreenConnectDesktop", "WinSta0\\InstallerDesktop")
 '''

 min_endpoint_version = "9.1.0"
@@ -12,7 +12,7 @@ reference = [
    "https://www.rapid7.com/blog/post/2023/05/05/appdomain-manager-injection-new-techniques-for-red-teams/",
    "https://github.com/netbiosX/GhostLoader/tree/master",
 ]
-version = "1.0.12"
+version = "1.0.13"

 query = '''
 sequence with maxspan=5m
@@ -43,7 +43,7 @@ sequence with maxspan=5m
            ("?:\\Windows\\System32\\rundll32.exe",
 			 "?:\\Windows\\SysWOW64\\rundll32.exe",
 			 "?:\\Windows\\System32\\regsvr32.exe",
-			 "?:\\Windows\\System32\\regsvr32.exe") and
+			 "?:\\ProgramData\\Thermo\\Proteome Discoverer*\\Scratch\\*\\ISE.exe") and
  not dll.hash.sha256 : ("4810a7b50ffb5e044ac64432b7fcfe4795cc4c6494e1d7f25f9f9cfe388d2ea6",
                         "9a5294182e611ccdae9962d2e26a84c3287cd18409b4985d468055b690d9134c",
                         "506e3d9184a6c08ae75c1bb7f3d72901ff6eeade3f6ed06237de878276f9fed7",
@@ -12,7 +12,7 @@ reference = [
    "https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware",
    "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
 ]
-version = "1.0.42"
+version = "1.0.43"

 query = '''
 process where event.action == "start" and
@@ -85,9 +85,9 @@ process where event.action == "start" and
   not (process.parent.name : "lsass.exe" and process.code_signature.subject_name == "Secure Endpoints Inc." and process.code_signature.trusted == true) and
   not (process.name : "consent.exe" and process.parent.name : "rundll32.exe" and
        process.parent.args == "shell32.dll,SHCreateLocalServerRunDll" and process.parent.args == "{9BA05972-F6A8-11CF-A442-00A0C90A8F39}") and
-   not (process.executable : ("C:\\Windows\\System32\\spoolsv.exe", "C:\\Windows\\System32\\RuntimeBroker.exe") and
-        process.parent.executable : ("C:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Starter.exe",
-                                     "C:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Container Helper.exe")) and
+   not (process.executable : ("?:\\Windows\\System32\\spoolsv.exe", "?:\\Windows\\System32\\RuntimeBroker.exe") and
+        process.parent.executable : ("?:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Starter.exe",
+                                     "?:\\Program Files (x86)\\Workplace\\Components\\WorkplaceContainerComponent\\Current\\Workplace Container Helper.exe")) and
   not (process.executable : "C:\\Windows\\Sys?????\\wbem\\WmiPrvSE.exe" and process.args : "/RegServer" and process.parent.name : ("powershell.exe", "cmd.exe")) and 
   not (process.parent.name == "lsass.exe" and process.args : "C:\\Program` Files\\PasswordRBL\\passwdfw.ps1")
 '''
@@ -7,7 +7,7 @@ id = "391f1e23-9ee0-4fa4-82b7-a54bebfa077d"
 license = "Elastic License v2"
 name = "Suspicious Suspended Process Creation"
 os_list = ["windows"]
-version = "1.0.6"
+version = "1.0.7"

 query = '''
 process where event.action == "start" and
@@ -23,7 +23,7 @@ process where event.action == "start" and
  /* process starts a signed MS binary in suspended state */
  process.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") or

-  /* process starts a suspended instacne of itself */
+  /* process starts a suspended instance of itself */
  (startswith~(process.executable, process.parent.executable) and
   (
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or
@@ -37,7 +37,8 @@ process where event.action == "start" and
  not process.parent.executable :
              ("?:\\Program Files\\rs2\\rs2Client\\rs2ClientService.exe",
               "?:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
-               "?:\\Program Files (x86)\\MEDITECH\\EIH.Universe\\EIH.LIVEF.Ring\\System\\Magic.exe") and
+               "?:\\Program Files (x86)\\MEDITECH\\EIH.Universe\\EIH.LIVEF.Ring\\System\\Magic.exe",
+               "?:\\SWATCUP-Premium\\SwatCup.exe") and
  not (process.command_line : "rundll32.exe \"C:\\Program Files\\Rapid7\\Insight Agent\\components\\armor\\common\\Armor\\mvarmor32.dll\",#1" and
    process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|mvarmor64dynamic.dll|kernel32.dll|Unbacked") and
  not process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe",
@@ -7,7 +7,7 @@ id = "8dd7588d-fc28-40c0-adfb-14789c763984"
 license = "Elastic License v2"
 name = "Suspicious Windows Command Shell Execution"
 os_list = ["windows"]
-version = "1.0.55"
+version = "1.0.56"

 query = '''
 process where event.action == "start" and
@@ -90,6 +90,7 @@ process where event.action == "start" and
                 "?:\\Program Files (x86)\\jumpcloud-agent-app\\jumpcloud-agent-app.exe",
                 "?:\\Program Files\\PostgreSQL\\*\\bin\\pg_dumpall.exe",
                 "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
+                 "?:\\Program Files\\Microsoft SQL Server\\*\\DTS\\Binn\\ISServerExec.exe",
                 "?:\\Program Files\\Microsoft SQL Server\\MSSQL*\\MSSQL\\Binn\\sqlservr.exe",
                 "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\IDE\\devenv.exe",
                 "C:\\Program Files\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe",
@@ -97,7 +98,8 @@ process where event.action == "start" and
                 "C:\\Program Files\\NetBeans-28\\bin\\netbeans64.exe",
                 "C:\\Program Files\\Microsoft Visual Studio\\*\\DtsDebugHost.exe",
                 "C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\DtsDebugHost.exe",
-                 "C:\\Program Files (x86)\\Quest Software\\*\\Toad.exe") and
+                 "C:\\Program Files (x86)\\Quest Software\\*\\Toad.exe",
+                 "?:\\Program Files\\Microsoft SQL Server\\*\\DTS\\Binn\\ISServerExec.exe") and
  not (process.args : "console|findstr" and process.parent.name : "cmd.exe") and
  not process.working_directory : "?:\\Program Files (x86)\\Spiceworks\\" and
  not (process.parent.name : "wscript.exe" and
@@ -1,6 +1,6 @@
 [rule]
 description = """
-Identifies the execution of commonly abused utilities to run DLLs or scripts via a seperate Windows Explorer trampoline.
+Identifies the execution of commonly abused utilities to run DLLs or scripts via a separate Windows Explorer trampoline.
 Explorer can be abused to launch malicious scripts or executables from a trusted parent process.
 """
 id = "5e8498bb-8cc0-412f-9017-793d94ab76a5"
@@ -8,7 +8,7 @@ license = "Elastic License v2"
 name = "Execution of Commonly Abused Utilities via Explorer Trampoline"
 os_list = ["windows"]
 reference = ["https://lolbas-project.github.io/lolbas/Binaries/Explorer/"]
-version = "1.0.35"
+version = "1.0.36"

 query = '''
 process where event.action == "start" and
@@ -12,7 +12,7 @@ reference = [
    "https://www.elastic.co/security-labs/dipping-into-danger",
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
 ]
-version = "1.0.42"
+version = "1.0.43"

 query = '''
 sequence with maxspan=5m
@@ -53,6 +53,7 @@ sequence with maxspan=5m
    not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not (process.code_signature.trusted == true and process.executable : ("?:\\Users\\*\\AppData\\Roaming\\*", "?:\\ProgramData\\*")) and
    not (process.name : "rundll32.exe" and process.args : "tsworkspace,TaskUpdateWorkspaces") and
+    not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.command_line : "*pcrpf.dll,NotifyFirmwareUpdateStaged*") and
    not (process.executable : "\\Device\\Mup\\*\\OneDriveSetup.exe" and process.args : "/ALLUSERS") and
    not (process.name : "rundll32.exe" and
         process.command_line : ("*PWMTR32V.dll,InitializeSettingsDuringInstallation*", "*RunDll_EnableBits*")) and