From 7acb75486247cde5e1568a8c2458e29abab404b8 Mon Sep 17 00:00:00 2001
From: protectionsmachine
 <72879786+protectionsmachine@users.noreply.github.com>
Date: Tue, 28 Nov 2023 20:41:18 +0000
Subject: [PATCH 1/2] Update latest docs

---
 ...ess-of-stored-browser-credentials.asciidoc |  86 +++++++++
 ...-keychain-credentials-directories.asciidoc |  92 ++++++++++
 ...ured-with-never-expiring-password.asciidoc | 105 +++++++++++
 ...on-followed-by-network-connection.asciidoc |  82 +++++++++
 ...ion-with-administrator-privileges.asciidoc |  71 ++++++++
 ...0-7-attempt-to-disable-gatekeeper.asciidoc |  63 +++++++
 ...ttempt-to-enable-the-root-account.asciidoc |  66 +++++++
 ...tempt-to-install-root-certificate.asciidoc |  68 +++++++
 ...-mount-smb-share-via-command-line.asciidoc |  73 ++++++++
 ...-remove-file-quarantine-attribute.asciidoc |  72 ++++++++
 ...ndpoint-security-kernel-extension.asciidoc |  76 ++++++++
 ...authorization-plugin-modification.asciidoc |  69 +++++++
 ...on-of-a-hidden-local-user-account.asciidoc | 109 +++++++++++
 ...-of-hidden-launch-agent-or-daemon.asciidoc |  86 +++++++++
 ...idden-login-item-via-apple-script.asciidoc |  81 +++++++++
 ...ount-hashes-via-built-in-commands.asciidoc |  63 +++++++
 ...hain-content-via-security-command.asciidoc |  65 +++++++
 ...nd-rules-creation-or-modification.asciidoc |  67 +++++++
 ...s-or-groups-via-built-in-commands.asciidoc |  89 +++++++++
 ...tron-child-process-node-js-module.asciidoc |  72 ++++++++
 ...xplicit-credentials-via-scripting.asciidoc |  81 +++++++++
 ...ync-plugin-registered-and-enabled.asciidoc |  75 ++++++++
 ...ta-user-session-started-via-proxy.asciidoc |  97 ++++++++++
 ...seen-newcredentials-logon-process.asciidoc |  66 +++++++
 ...rberos-cached-credentials-dumping.asciidoc |  72 ++++++++
 ...ssword-retrieval-via-command-line.asciidoc |  79 ++++++++
 ...odification-and-immediate-loading.asciidoc |  69 +++++++
 ...odification-and-immediate-loading.asciidoc |  63 +++++++
 ...ller-package-spawns-network-event.asciidoc |  82 +++++++++
 ...nvironment-variable-via-launchctl.asciidoc |  78 ++++++++
 ...ari-settings-via-defaults-command.asciidoc |  75 ++++++++
 ...dresses-for-a-single-user-session.asciidoc |  77 ++++++++
 ...ssions-detected-for-a-single-user.asciidoc |  76 ++++++++
 ...s-with-the-same-device-token-hash.asciidoc |  75 ++++++++
 ...-authentication-behavior-detected.asciidoc |  92 ++++++++++
 ...ntity-provider-idp-added-by-admin.asciidoc | 102 +++++++++++
 ...-okta-fastpass-phishing-detection.asciidoc |  72 ++++++++
 ...ign-in-events-via-third-party-idp.asciidoc | 116 ++++++++++++
 ...arted-from-different-geolocations.asciidoc |  77 ++++++++
 ...ectoryservice-plugin-modification.asciidoc |  62 +++++++
 ...-via-docker-shortcut-modification.asciidoc |  63 +++++++
 ...sistence-via-folder-action-script.asciidoc |  74 ++++++++
 ...sistence-via-login-or-logout-hook.asciidoc |  70 ++++++++
 ...tial-admin-group-account-addition.asciidoc |  66 +++++++
 ...idden-local-user-account-creation.asciidoc |  66 +++++++
 ...ntial-kerberos-attack-via-bifrost.asciidoc |  79 ++++++++
 ...al-macos-ssh-brute-force-detected.asciidoc |  61 +++++++
 ...-microsoft-office-sandbox-evasion.asciidoc |  63 +++++++
 ...fa-bombing-via-push-notifications.asciidoc | 112 ++++++++++++
 ...via-atom-init-script-modification.asciidoc |  63 +++++++
 ...ential-persistence-via-login-hook.asciidoc |  82 +++++++++
 ...al-persistence-via-periodic-tasks.asciidoc |  68 +++++++
 ...-bypass-via-localhost-secure-copy.asciidoc |  74 ++++++++
 ...rol-bypass-via-tccdb-modification.asciidoc |  69 +++++++
 ...fa-bombing-via-push-notifications.asciidoc | 111 ++++++++++++
 ...ia-root-crontab-file-modification.asciidoc |  67 +++++++
 ...pt-for-credentials-with-osascript.asciidoc |  67 +++++++
 ...-remote-execution-via-file-shares.asciidoc | 125 +++++++++++++
 ...7-remote-file-copy-via-teamviewer.asciidoc | 138 ++++++++++++++
 ...n-enabled-via-systemsetup-command.asciidoc |  70 ++++++++
 ...le-modified-by-unexpected-process.asciidoc | 105 +++++++++++
 ...ell-execution-via-apple-scripting.asciidoc |  64 +++++++
 ...reupdate-preferences-modification.asciidoc |  67 +++++++
 ...r-application-script-modification.asciidoc |  74 ++++++++
 ...ous-automator-workflows-execution.asciidoc |  63 +++++++
 ...-suspicious-browser-child-process.asciidoc |  89 +++++++++
 ...icious-calendar-file-modification.asciidoc |  75 ++++++++
 ...obe-acrobat-reader-update-service.asciidoc |  73 ++++++++
 ...-crontab-creation-or-modification.asciidoc |  67 +++++++
 ...-7-suspicious-emond-child-process.asciidoc |  89 +++++++++
 ...s-hidden-child-process-of-launchd.asciidoc |  81 +++++++++
 ...ous-macos-ms-office-child-process.asciidoc |  99 ++++++++++
 ...ious-managed-code-hosting-process.asciidoc |  74 ++++++++
 ...suspicious-werfault-child-process.asciidoc | 101 +++++++++++
 ...systemkey-access-via-command-line.asciidoc |  66 +++++++
 ...-via-mounted-apfs-snapshot-access.asciidoc |  63 +++++++
 ...ocess-of-macos-screensaver-engine.asciidoc |  81 +++++++++
 ...rivate-network-connection-attempt.asciidoc |  68 +++++++
 ...-7-webproxy-settings-modification.asciidoc |  66 +++++++
 .../prebuilt-rules-8-10-7-appendix.asciidoc   |  85 +++++++++
 .../prebuilt-rules-8-10-7-summary.asciidoc    | 170 ++++++++++++++++++
 ...ebuilt-rules-downloadable-updates.asciidoc |   5 +
 .../prebuilt-rules-reference.asciidoc         | 148 ++++++++-------
 .../prebuilt-rules/rule-desc-index.asciidoc   |  13 +-
 ...ess-of-stored-browser-credentials.asciidoc |   3 +-
 ...-keychain-credentials-directories.asciidoc |   3 +-
 ...ured-with-never-expiring-password.asciidoc |   3 +-
 ...-hidden-file-attribute-via-attrib.asciidoc |   2 +-
 .../adobe-hijack-persistence.asciidoc         |   2 +-
 ...-process-for-a-windows-population.asciidoc |   2 +-
 ...nomalous-windows-process-creation.asciidoc |   2 +-
 ...on-followed-by-network-connection.asciidoc |   3 +-
 ...ion-with-administrator-privileges.asciidoc |   3 +-
 .../attempt-to-disable-gatekeeper.asciidoc    |   3 +-
 ...ttempt-to-enable-the-root-account.asciidoc |   3 +-
 ...tempt-to-install-root-certificate.asciidoc |   3 +-
 ...-mount-smb-share-via-command-line.asciidoc |   3 +-
 ...-remove-file-quarantine-attribute.asciidoc |   3 +-
 ...ndpoint-security-kernel-extension.asciidoc |   3 +-
 ...authorization-plugin-modification.asciidoc |   3 +-
 .../bypass-uac-via-event-viewer.asciidoc      |   2 +-
 ...dification-through-built-in-tools.asciidoc |   2 +-
 ...icy-modification-through-registry.asciidoc |   2 +-
 ...command-prompt-network-connection.asciidoc |   2 +-
 ...n-to-commonly-abused-web-services.asciidoc |   2 +-
 ...on-of-a-hidden-local-user-account.asciidoc |   1 +
 ...-of-hidden-launch-agent-or-daemon.asciidoc |   3 +-
 ...idden-login-item-via-apple-script.asciidoc |   3 +-
 .../direct-outbound-smb-connection.asciidoc   |   2 +-
 ...ount-hashes-via-built-in-commands.asciidoc |   3 +-
 ...hain-content-via-security-command.asciidoc |   3 +-
 ...nd-rules-creation-or-modification.asciidoc |   3 +-
 ...rivileged-local-groups-membership.asciidoc |   2 +-
 ...s-or-groups-via-built-in-commands.asciidoc |   3 +-
 ...om-unusual-directory-command-line.asciidoc |   2 +-
 ...tron-child-process-node-js-module.asciidoc |   3 +-
 ...xplicit-credentials-via-scripting.asciidoc |   3 +-
 ...ync-plugin-registered-and-enabled.asciidoc |   3 +-
 ...ta-user-session-started-via-proxy.asciidoc |  97 ++++++++++
 ...value-accessed-in-secrets-manager.asciidoc |   2 +-
 .../first-time-seen-driver-loaded.asciidoc    |   2 +-
 ...seen-newcredentials-logon-process.asciidoc |  66 +++++++
 ...rberos-cached-credentials-dumping.asciidoc |   3 +-
 ...eros-traffic-from-unusual-process.asciidoc |   2 +-
 ...ssword-retrieval-via-command-line.asciidoc |   3 +-
 ...odification-and-immediate-loading.asciidoc |   3 +-
 ...odification-and-immediate-loading.asciidoc |   3 +-
 .../linux-group-creation.asciidoc             |   4 +-
 .../linux-user-account-creation.asciidoc      |   4 +-
 ...ux-user-added-to-privileged-group.asciidoc |   4 +-
 .../lsass-memory-dump-creation.asciidoc       |   2 +-
 .../lsass-memory-dump-handle-access.asciidoc  |   2 +-
 ...ller-package-spawns-network-event.asciidoc |   2 +-
 ...ld-engine-using-an-alternate-name.asciidoc |   2 +-
 ...nvironment-variable-via-launchctl.asciidoc |   3 +-
 ...ari-settings-via-defaults-command.asciidoc |   3 +-
 ...sbuild-making-network-connections.asciidoc |   2 +-
 ...failure-followed-by-logon-success.asciidoc |   2 +-
 ...lure-from-the-same-source-address.asciidoc |   2 +-
 ...dresses-for-a-single-user-session.asciidoc |  77 ++++++++
 ...ssions-detected-for-a-single-user.asciidoc |  76 ++++++++
 ...s-with-the-same-device-token-hash.asciidoc |  75 ++++++++
 .../network-connection-via-certutil.asciidoc  |   2 +-
 ...connection-via-compiled-html-file.asciidoc |   2 +-
 ...nnection-via-registration-utility.asciidoc |   2 +-
 ...work-connection-via-signed-binary.asciidoc |   2 +-
 ...-authentication-behavior-detected.asciidoc |  92 ++++++++++
 ...ntity-provider-idp-added-by-admin.asciidoc | 102 +++++++++++
 .../new-systemd-timer-created.asciidoc        |   4 +-
 .../okta-fastpass-phishing-detection.asciidoc |  72 ++++++++
 ...ign-in-events-via-third-party-idp.asciidoc | 116 ++++++++++++
 ...arted-from-different-geolocations.asciidoc |  77 ++++++++
 ...ectoryservice-plugin-modification.asciidoc |   3 +-
 ...-via-docker-shortcut-modification.asciidoc |   3 +-
 ...sistence-via-folder-action-script.asciidoc |   3 +-
 ...sistence-via-login-or-logout-hook.asciidoc |   3 +-
 ...pdate-orchestrator-service-hijack.asciidoc |   2 +-
 ...-scripts-in-the-startup-directory.asciidoc |   2 +-
 ...tial-admin-group-account-addition.asciidoc |   3 +-
 ...n-interface-bypass-via-powershell.asciidoc |   2 +-
 ...ess-via-trusted-developer-utility.asciidoc |   2 +-
 ...ential-evasion-via-filter-manager.asciidoc |   2 +-
 ...idden-local-user-account-creation.asciidoc |   3 +-
 ...ntial-kerberos-attack-via-bifrost.asciidoc |   3 +-
 ...ux-backdoor-user-account-creation.asciidoc |   4 +-
 ...al-macos-ssh-brute-force-detected.asciidoc |   3 +-
 ...-microsoft-office-sandbox-evasion.asciidoc |   3 +-
 ...ication-of-accessibility-binaries.asciidoc |   2 +-
 ...fa-bombing-via-push-notifications.asciidoc | 112 ++++++++++++
 ...rsistence-through-init-d-detected.asciidoc |   4 +-
 ...rough-motd-file-creation-detected.asciidoc |   4 +-
 ...ence-through-run-control-detected.asciidoc |   4 +-
 ...via-atom-init-script-modification.asciidoc |   3 +-
 ...ential-persistence-via-login-hook.asciidoc |   3 +-
 ...al-persistence-via-periodic-tasks.asciidoc |   3 +-
 ...-bypass-via-localhost-secure-copy.asciidoc |   3 +-
 ...rol-bypass-via-tccdb-modification.asciidoc |   3 +-
 ...alation-via-installerfiletakeover.asciidoc |   2 +-
 ...ote-code-execution-via-web-server.asciidoc |   4 +-
 ...indows-error-manager-masquerading.asciidoc |   2 +-
 ...fa-bombing-via-push-notifications.asciidoc | 111 ++++++++++++
 .../powershell-psreflect-script.asciidoc      |   2 +-
 ...us-payload-encoded-and-compressed.asciidoc |   2 +-
 ...tion-via-named-pipe-impersonation.asciidoc |   2 +-
 ...ia-root-crontab-file-modification.asciidoc |   3 +-
 .../privileged-account-brute-force.asciidoc   |   2 +-
 ...s-activity-via-compiled-html-file.asciidoc |   2 +-
 ...-termination-followed-by-deletion.asciidoc |   2 +-
 ...pt-for-credentials-with-osascript.asciidoc |   3 +-
 ...istry-persistence-via-appinit-dll.asciidoc |   2 +-
 .../remote-execution-via-file-shares.asciidoc |   5 +-
 .../remote-file-copy-via-teamviewer.asciidoc  |   4 +-
 ...oad-via-desktopimgdownldr-utility.asciidoc |   2 +-
 ...remote-file-download-via-mpcmdrun.asciidoc |   2 +-
 ...mote-file-download-via-powershell.asciidoc |   2 +-
 ...e-download-via-script-interpreter.asciidoc |   2 +-
 ...n-enabled-via-systemsetup-command.asciidoc |   3 +-
 ...remotely-started-services-via-rpc.asciidoc |   2 +-
 ...enamed-autoit-scripts-interpreter.asciidoc |   2 +-
 ...-executed-with-short-program-name.asciidoc |   2 +-
 ...le-modified-by-unexpected-process.asciidoc |   3 +-
 ...ol-spawned-via-script-interpreter.asciidoc |   2 +-
 ...ell-execution-via-apple-scripting.asciidoc |   3 +-
 ...reupdate-preferences-modification.asciidoc |   3 +-
 ...-persistence-via-unsigned-process.asciidoc |   2 +-
 ...-or-run-key-registry-modification.asciidoc |   2 +-
 ...rsistence-by-a-suspicious-process.asciidoc |   2 +-
 ...r-application-script-modification.asciidoc |   3 +-
 ...urst-command-and-control-activity.asciidoc |   2 +-
 ...us-antimalware-scan-interface-dll.asciidoc |   2 +-
 ...ous-automator-workflows-execution.asciidoc |   3 +-
 .../suspicious-browser-child-process.asciidoc |   2 +-
 ...icious-calendar-file-modification.asciidoc |   3 +-
 .../suspicious-certutil-commands.asciidoc     |   2 +-
 ...obe-acrobat-reader-update-service.asciidoc |   3 +-
 ...-crontab-creation-or-modification.asciidoc |   2 +-
 .../suspicious-emond-child-process.asciidoc   |   2 +-
 ...s-hidden-child-process-of-launchd.asciidoc |   3 +-
 ...ous-macos-ms-office-child-process.asciidoc |   2 +-
 ...ious-managed-code-hosting-process.asciidoc |   2 +-
 ...ous-net-reflection-via-powershell.asciidoc |   2 +-
 ...able-encoded-in-powershell-script.asciidoc |   2 +-
 ...us-print-spooler-spl-file-created.asciidoc |   2 +-
 ...ess-access-via-direct-system-call.asciidoc |   2 +-
 ...rocess-spawned-from-motd-detected.asciidoc |   4 +-
 ...rvice-was-installed-in-the-system.asciidoc |   2 +-
 ...startup-shell-folder-modification.asciidoc |   2 +-
 ...suspicious-werfault-child-process.asciidoc |   2 +-
 .../suspicious-zoom-child-process.asciidoc    |   2 +-
 .../svchost-spawning-cmd.asciidoc             |   2 +-
 .../system-shells-via-services.asciidoc       |   2 +-
 ...systemkey-access-via-command-line.asciidoc |   3 +-
 ...-via-mounted-apfs-snapshot-access.asciidoc |   3 +-
 ...threat-intel-hash-indicator-match.asciidoc |   2 +-
 ...-intel-ip-address-indicator-match.asciidoc |   2 +-
 .../threat-intel-url-indicator-match.asciidoc |   2 +-
 ...-windows-registry-indicator-match.asciidoc |   2 +-
 ...ia-windows-directory-masquerading.asciidoc |   2 +-
 ...a-windows-firewall-snap-in-hijack.asciidoc |   2 +-
 ...ocess-of-macos-screensaver-engine.asciidoc |   3 +-
 .../untrusted-driver-loaded.asciidoc          |   2 +-
 ...tion-by-a-system-critical-process.asciidoc |   2 +-
 ...le-creation-alternate-data-stream.asciidoc |   2 +-
 ...vity-from-a-windows-system-binary.asciidoc |   2 +-
 ...unusual-parent-child-relationship.asciidoc |   2 +-
 ...nusual-process-for-a-windows-host.asciidoc |   2 +-
 ...rivate-network-connection-attempt.asciidoc |   3 +-
 .../webproxy-settings-modification.asciidoc   |   3 +-
 ...ntial-dumping-using-netsh-command.asciidoc |   2 +-
 docs/index.asciidoc                           |   2 +
 250 files changed, 7791 insertions(+), 286 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-of-stored-browser-credentials.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-to-keychain-credentials-directories.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-account-configured-with-never-expiring-password.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-enable-the-root-account.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-install-root-certificate.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-authorization-plugin-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-emond-rules-creation-or-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-fastpass-phishing-detection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-folder-action-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-admin-group-account-addition.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-login-hook.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-shell-execution-via-apple-scripting.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-softwareupdate-preferences-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-automator-workflows-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-browser-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-calendar-file-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-emond-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-werfault-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-systemkey-access-via-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-virtual-private-network-connection-attempt.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-webproxy-settings-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-appendix.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-summary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/multiple-okta-users-with-the-same-device-token-hash.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-of-stored-browser-credentials.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-of-stored-browser-credentials.asciidoc
new file mode 100644
index 0000000000..8a2f8eabbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-of-stored-browser-credentials.asciidoc
@@ -0,0 +1,86 @@
+[[prebuilt-rule-8-10-7-access-of-stored-browser-credentials]]
+=== Access of Stored Browser Credentials
+
+Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://securelist.com/calisto-trojan-for-macos/86543/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.args :
+    (
+      "/Users/*/Library/Application Support/Google/Chrome/Default/Login Data",
+      "/Users/*/Library/Application Support/Google/Chrome/Default/Cookies",
+      "/Users/*/Library/Application Support/Google/Chrome/Profile*/Cookies",
+      "/Users/*/Library/Cookies*",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/cookies.sqlite",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/key*.db",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/logins.json",
+      "Login Data",
+      "Cookies.binarycookies",
+      "key4.db",
+      "key3.db",
+      "logins.json",
+      "cookies.sqlite"
+    ) and 
+  not (process.name : "wordexp-helper" and process.parent.name : ("elastic-agent", "elastic-endpoint"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Web Session Cookie
+** ID: T1539
+** Reference URL: https://attack.mitre.org/techniques/T1539/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Credentials from Web Browsers
+** ID: T1555.003
+** Reference URL: https://attack.mitre.org/techniques/T1555/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-to-keychain-credentials-directories.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-to-keychain-credentials-directories.asciidoc
new file mode 100644
index 0000000000..03b11e0958
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-access-to-keychain-credentials-directories.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-10-7-access-to-keychain-credentials-directories]]
+=== Access to Keychain Credentials Directories
+
+Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://objective-see.com/blog/blog_0x25.html
+* https://securelist.com/calisto-trojan-for-macos/86543/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.args :
+    (
+      "/Users/*/Library/Keychains/*",
+      "/Library/Keychains/*",
+      "/Network/Library/Keychains/*",
+      "System.keychain",
+      "login.keychain-db",
+      "login.keychain"
+    ) and
+    not process.args : ("find-certificate",
+                      "add-trusted-cert",
+                      "set-keychain-settings",
+                      "delete-certificate",
+                      "/Users/*/Library/Keychains/openvpn.keychain-db",
+                      "show-keychain-info",
+                      "lock-keychain",
+                      "set-key-partition-list",
+                      "import",
+                      "find-identity") and
+    not process.parent.executable :
+      (
+        "/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect",
+        "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise",
+        "/opt/jc/bin/jumpcloud-agent"
+      ) and
+    not process.executable : "/opt/jc/bin/jumpcloud-agent"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-account-configured-with-never-expiring-password.asciidoc
new file mode 100644
index 0000000000..4dd6b64407
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-account-configured-with-never-expiring-password.asciidoc
@@ -0,0 +1,105 @@
+[[prebuilt-rule-8-10-7-account-configured-with-never-expiring-password]]
+=== Account Configured with Never-Expiring Password
+
+Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire
+* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Account Configured with Never-Expiring Password
+
+Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
+
+The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/source host during the past 48 hours.
+- Inspect the account for suspicious or abnormal behaviors in the alert timeframe.
+
+### False positive analysis
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Reset the password of the account and update its password settings.
+- Search for other occurrences on the domain.
+    - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
+        - `get-aduser -filter { passwordNeverExpires -eq $true  -and enabled -eq $true } | ft`
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.action:"modified-user-account" and winlog.api:"wineventlog" and event.code:"4738" and
+  message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection.asciidoc
new file mode 100644
index 0000000000..17ba1f646a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection]]
+=== Apple Script Execution followed by Network Connection
+
+Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=30s
+ [process where host.os.type == "macos" and event.type == "start" and process.name == "osascript"]
+ [network where host.os.type == "macos" and event.type != "end" and process.name == "osascript" and destination.ip != "::1" and
+  not cidrmatch(destination.ip,
+    "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
+    "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
+    "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
+    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: AppleScript
+** ID: T1059.002
+** Reference URL: https://attack.mitre.org/techniques/T1059/002/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges.asciidoc
new file mode 100644
index 0000000000..7caf23f8c1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges.asciidoc
@@ -0,0 +1,71 @@
+[[prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges]]
+=== Apple Scripting Execution with Administrator Privileges
+
+Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://discussions.apple.com/thread/2266150
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
+  process.command_line : "osascript*with administrator privileges"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper.asciidoc
new file mode 100644
index 0000000000..5197304b13
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper]]
+=== Attempt to Disable Gatekeeper
+
+Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://support.apple.com/en-us/HT202491
+* https://community.carbonblack.com/t5/Threat-Advisories-Documents/TAU-TIN-Shlayer-OSX/ta-p/68397
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.args:(spctl and "--master-disable")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-enable-the-root-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-enable-the-root-account.asciidoc
new file mode 100644
index 0000000000..eb1f23d519
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-enable-the-root-account.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-10-7-attempt-to-enable-the-root-account]]
+=== Attempt to Enable the Root Account
+
+Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://ss64.com/osx/dsenableroot.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:dsenableroot and not process.args:"-d"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-install-root-certificate.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-install-root-certificate.asciidoc
new file mode 100644
index 0000000000..518f199d4a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-install-root-certificate.asciidoc
@@ -0,0 +1,68 @@
+[[prebuilt-rule-8-10-7-attempt-to-install-root-certificate]]
+=== Attempt to Install Root Certificate
+
+Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://ss64.com/osx/security-cert.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.name:security and process.args:"add-trusted-cert" and
+  not process.parent.executable:("/Library/Bitdefender/AVP/product/bin/BDCoreIssues" or "/Applications/Bitdefender/SecurityNetworkInstallerApp.app/Contents/MacOS/SecurityNetworkInstallerApp"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Install Root Certificate
+** ID: T1553.004
+** Reference URL: https://attack.mitre.org/techniques/T1553/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line.asciidoc
new file mode 100644
index 0000000000..5d89b3d330
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line.asciidoc
@@ -0,0 +1,73 @@
+[[prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line]]
+=== Attempt to Mount SMB Share via Command Line
+
+Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.freebsd.org/cgi/man.cgi?mount_smbfs
+* https://ss64.com/osx/mount.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  (
+    process.name : "mount_smbfs" or
+    (process.name : "open" and process.args : "smb://*") or
+    (process.name : "mount" and process.args : "smbfs") or
+    (process.name : "osascript" and process.command_line : "osascript*mount volume*smb://*")
+  ) and
+  not process.parent.executable : "/Applications/Google Drive.app/Contents/MacOS/Google Drive"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute.asciidoc
new file mode 100644
index 0000000000..c10e18ba5b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute.asciidoc
@@ -0,0 +1,72 @@
+[[prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute]]
+=== Attempt to Remove File Quarantine Attribute
+
+Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
+* https://ss64.com/osx/xattr.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.name : "xattr" and
+  (
+    (process.args : "com.apple.quarantine" and process.args : ("-d", "-w")) or
+    (process.args : "-c") or
+    (process.command_line : ("/bin/bash -c xattr -c *", "/bin/zsh -c xattr -c *", "/bin/sh -c xattr -c *"))
+  ) and not process.args_count > 12
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
new file mode 100644
index 0000000000..62590176d9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
@@ -0,0 +1,76 @@
+[[prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension]]
+=== Attempt to Unload Elastic Endpoint Security Kernel Extension
+
+Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:kextunload and process.args:("/System/Library/Extensions/EndpointSecurity.kext" or "EndpointSecurity.kext")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-authorization-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-authorization-plugin-modification.asciidoc
new file mode 100644
index 0000000000..a9198f39bf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-authorization-plugin-modification.asciidoc
@@ -0,0 +1,69 @@
+[[prebuilt-rule-8-10-7-authorization-plugin-modification]]
+=== Authorization Plugin Modification
+
+Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.apple.com/documentation/security/authorization_plug-ins
+* https://www.xorrior.com/persistent-credential-theft/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and not event.type:deletion and
+  file.path:(/Library/Security/SecurityAgentPlugins/* and
+  not /Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle/*) and
+  not process.name:shove and process.code_signature.trusted:true
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Authentication Package
+** ID: T1547.002
+** Reference URL: https://attack.mitre.org/techniques/T1547/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account.asciidoc
new file mode 100644
index 0000000000..4eef8467fb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account.asciidoc
@@ -0,0 +1,109 @@
+[[prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account]]
+=== Creation of a Hidden Local User Account
+
+Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html
+* https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Creation of a Hidden Local User Account
+
+Attackers can create accounts ending with a `$` symbol to make the account hidden to user enumeration utilities and bypass detections that identify computer accounts by this pattern to apply filters.
+
+This rule uses registry events to identify the creation of local hidden accounts.
+
+#### Possible investigation steps
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positive (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Delete the hidden account.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\",
+    "\\REGISTRY\\MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon.asciidoc
new file mode 100644
index 0000000000..53c762ff12
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon.asciidoc
@@ -0,0 +1,86 @@
+[[prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon]]
+=== Creation of Hidden Launch Agent or Daemon
+
+Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and
+  file.path :
+  (
+    "/System/Library/LaunchAgents/.*.plist",
+    "/Library/LaunchAgents/.*.plist",
+    "/Users/*/Library/LaunchAgents/.*.plist",
+    "/System/Library/LaunchDaemons/.*.plist",
+    "/Library/LaunchDaemons/.*.plist"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Launch Agent
+** ID: T1543.001
+** Reference URL: https://attack.mitre.org/techniques/T1543/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script.asciidoc
new file mode 100644
index 0000000000..3bc1d0c7a6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script]]
+=== Creation of Hidden Login Item via Apple Script
+
+Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
+ process.command_line : "osascript*login item*hidden:true*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: AppleScript
+** ID: T1059.002
+** Reference URL: https://attack.mitre.org/techniques/T1059/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Plist File Modification
+** ID: T1647
+** Reference URL: https://attack.mitre.org/techniques/T1647/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands.asciidoc
new file mode 100644
index 0000000000..c800242ead
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands]]
+=== Dumping Account Hashes via Built-In Commands
+
+Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored
+* https://www.unix.com/man-page/osx/8/mkpassdb/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+ process.name:(defaults or mkpassdb) and process.args:(ShadowHashData or "-dump")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command.asciidoc
new file mode 100644
index 0000000000..30fd48035b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command.asciidoc
@@ -0,0 +1,65 @@
+[[prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command]]
+=== Dumping of Keychain Content via Security Command
+
+Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://ss64.com/osx/security.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.args : "dump-keychain" and process.args : "-d"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-emond-rules-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-emond-rules-creation-or-modification.asciidoc
new file mode 100644
index 0000000000..65e29dd548
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-emond-rules-creation-or-modification.asciidoc
@@ -0,0 +1,67 @@
+[[prebuilt-rule-8-10-7-emond-rules-creation-or-modification]]
+=== Emond Rules Creation or Modification
+
+Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.xorrior.com/emond-persistence/
+* https://www.sentinelone.com/blog/how-malware-persists-on-macos/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and
+ file.path : ("/private/etc/emond.d/rules/*.plist", "/etc/emon.d/rules/*.plist", "/private/var/db/emondClients/*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Emond
+** ID: T1546.014
+** Reference URL: https://attack.mitre.org/techniques/T1546/014/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands.asciidoc
new file mode 100644
index 0000000000..6508802296
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands.asciidoc
@@ -0,0 +1,89 @@
+[[prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands]]
+=== Enumeration of Users or Groups via Built-in Commands
+
+Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  (
+    process.name : ("ldapsearch", "dsmemberutil") or
+    (process.name : "dscl" and
+      process.args : ("read", "-read", "list", "-list", "ls", "search", "-search") and
+      process.args : ("/Active Directory/*", "/Users*", "/Groups*"))
+	) and
+  not process.parent.executable : ("/Applications/NoMAD.app/Contents/MacOS/NoMAD",
+     "/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence",
+     "/Applications/Sourcetree.app/Contents/MacOS/Sourcetree",
+     "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
+     "/Applications/Jamf Connect.app/Contents/MacOS/Jamf Connect",
+     "/usr/local/jamf/bin/jamf",
+     "/Library/Application Support/AirWatch/hubd",
+     "/opt/jc/bin/jumpcloud-agent",
+     "/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon",
+     "/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon",
+     "/Library/PrivilegedHelperTools/com.fortinet.forticlient.uninstall_helper"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module.asciidoc
new file mode 100644
index 0000000000..e46b585100
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module.asciidoc
@@ -0,0 +1,72 @@
+[[prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module]]
+=== Execution via Electron Child Process Node.js Module
+
+Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.matthewslipper.com/2019/09/22/everything-you-wanted-electron-child-process.html
+* https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks/
+* https://nodejs.org/api/child_process.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and process.args:("-e" and const*require*child_process*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting.asciidoc
new file mode 100644
index 0000000000..e9c46f244b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting]]
+=== Execution with Explicit Credentials via Scripting
+
+Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf
+* https://www.manpagez.com/man/8/security_authtrampoline/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:"security_authtrampoline" and
+ process.parent.name:(osascript or com.apple.automator.runner or sh or bash or dash or zsh or python* or Python or perl* or php* or ruby or pwsh)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Elevated Execution with Prompt
+** ID: T1548.004
+** Reference URL: https://attack.mitre.org/techniques/T1548/004/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled.asciidoc
new file mode 100644
index 0000000000..561df0732b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled.asciidoc
@@ -0,0 +1,75 @@
+[[prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled]]
+=== Finder Sync Plugin Registered and Enabled
+
+Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "pluginkit" and
+  process.args : "-e" and process.args : "use" and process.args : "-i" and
+  not process.args :
+  (
+    "com.google.GoogleDrive.FinderSyncAPIExtension",
+    "com.google.drivefs.findersync",
+    "com.boxcryptor.osx.Rednif",
+    "com.adobe.accmac.ACCFinderSync",
+    "com.microsoft.OneDrive.FinderSync",
+    "com.insynchq.Insync.Insync-Finder-Integration",
+    "com.box.desktop.findersyncext"
+  ) and
+  not process.parent.executable : (
+    "/Library/Application Support/IDriveforMac/IDriveHelperTools/FinderPluginApp.app/Contents/MacOS/FinderPluginApp"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
new file mode 100644
index 0000000000..ef984ce280
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
@@ -0,0 +1,97 @@
+[[prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy]]
+=== First Occurrence of Okta User Session Started via Proxy
+
+Identifies the first occurrence of an Okta user session started via a proxy.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://developer.okta.com/docs/reference/api/system-log/#issuer-object
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating First Occurrence of Okta User Session Started via Proxy
+
+This rule detects the first occurrence of an Okta user session started via a proxy. This rule is designed to help identify suspicious authentication behavior that may be indicative of an attacker attempting to gain access to an Okta account while remaining anonymous. This rule leverages the New Terms rule type feature where the `okta.actor.id` value is checked against the previous 7 days of data to determine if the value has been seen before for this activity.
+
+#### Possible investigation steps:
+- Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- Examine the `okta.debug_context.debug_data.flattened` field for more information about the proxy used.
+- Review the `okta.request.ip_chain` field for more information about the geographic location of the proxy.
+- Review the past activities of the actor involved in this action by checking their previous actions.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- A user may have legitimately started a session via a proxy for security or privacy reasons.
+
+### Response and remediation:
+- Review the profile of the user involved in this action to determine if proxy usage may be expected.
+- If the user is legitimate and the authentication behavior is not suspicious, no action is required.
+- If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
+    - If MFA is already enabled, consider resetting MFA for the user.
+- If the user is not legitimate, consider deactivating the user's account.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+
+## Setup
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.event_type: (user.session.start or user.authentication.verify) and okta.security_context.is_proxy:true and not okta.actor.id: okta*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: External Remote Services
+** ID: T1133
+** Reference URL: https://attack.mitre.org/techniques/T1133/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process.asciidoc
new file mode 100644
index 0000000000..670ff95634
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process]]
+=== First Time Seen NewCredentials Logon Process
+
+Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/pt/blog/how-attackers-abuse-access-token-manipulation
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"authentication" and host.os.type:"windows" and winlog.logon.type:"NewCredentials" and winlog.event_data.LogonProcessName:(Advapi* or "Advapi  ")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping.asciidoc
new file mode 100644
index 0000000000..cebf5f5250
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping.asciidoc
@@ -0,0 +1,72 @@
+[[prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping]]
+=== Kerberos Cached Credentials Dumping
+
+Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py
+* https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.name:kcc and
+  process.args:copy_cred_cache
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line.asciidoc
new file mode 100644
index 0000000000..f9b3826691
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line.asciidoc
@@ -0,0 +1,79 @@
+[[prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line]]
+=== Keychain Password Retrieval via Command Line
+
+Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.netmeister.org/blog/keychain-passwords.html
+* https://github.com/priyankchheda/chrome_password_grabber/blob/master/chrome.py
+* https://ss64.com/osx/security.html
+* https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type == "start" and
+ process.name : "security" and process.args : "-wa" and process.args : ("find-generic-password", "find-internet-password") and
+ process.args : ("Chrome*", "Chromium", "Opera", "Safari*", "Brave", "Microsoft Edge", "Edge", "Firefox*") and
+ not process.parent.executable : "/Applications/Keeper Password Manager.app/Contents/Frameworks/Keeper Password Manager Helper*/Contents/MacOS/Keeper Password Manager Helper*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Credentials from Web Browsers
+** ID: T1555.003
+** Reference URL: https://attack.mitre.org/techniques/T1555/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading.asciidoc
new file mode 100644
index 0000000000..92dc80c410
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading.asciidoc
@@ -0,0 +1,69 @@
+[[prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading]]
+=== Launch Agent Creation or Modification and Immediate Loading
+
+An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=1m
+ [file where host.os.type == "macos" and event.type != "deletion" and
+  file.path : ("/System/Library/LaunchAgents/*", "/Library/LaunchAgents/*", "/Users/*/Library/LaunchAgents/*")
+ ]
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "launchctl" and process.args == "load"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Launch Agent
+** ID: T1543.001
+** Reference URL: https://attack.mitre.org/techniques/T1543/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
new file mode 100644
index 0000000000..65539bd277
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading]]
+=== LaunchDaemon Creation or Modification and Immediate Loading
+
+Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=1m
+ [file where host.os.type == "macos" and event.type != "deletion" and file.path : ("/System/Library/LaunchDaemons/*", "/Library/LaunchDaemons/*")]
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "launchctl" and process.args == "load"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event.asciidoc
new file mode 100644
index 0000000000..e3d54fecd5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event]]
+=== MacOS Installer Package Spawns Network Event
+
+Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://redcanary.com/blog/clipping-silver-sparrows-wings
+* https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520
+* https://github.com/D00MFist/Mystikal
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, user.id with maxspan=30s
+[process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and process.parent.name : ("installer", "package_script_service") and process.name : ("bash", "sh", "zsh", "python", "osascript", "tclsh*")]
+[network where host.os.type == "macos" and event.type == "start" and process.name : ("curl", "osascript", "wget", "python")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: JavaScript
+** ID: T1059.007
+** Reference URL: https://attack.mitre.org/techniques/T1059/007/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl.asciidoc
new file mode 100644
index 0000000000..4c8e15ef29
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl.asciidoc
@@ -0,0 +1,78 @@
+[[prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl]]
+=== Modification of Environment Variable via Launchctl
+
+Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/rapid7/metasploit-framework/blob/master//modules/post/osx/escalate/tccbypass.rb
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:start and 
+  process.name:launchctl and 
+  process.args:(setenv and not (ANT_HOME or 
+                                DBUS_LAUNCHD_SESSION_BUS_SOCKET or 
+                                EDEN_ENV or 
+                                LG_WEBOS_TV_SDK_HOME or 
+                                RUNTIME_JAVA_HOME or 
+                                WEBOS_CLI_TV or 
+                                JAVA*_HOME) and 
+                not *.vmoptions) and 
+  not process.parent.executable:("/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper" or 
+                                  /Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin or 
+                                  /Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin or 
+                                  /usr/local/bin/kr)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Path Interception by PATH Environment Variable
+** ID: T1574.007
+** Reference URL: https://attack.mitre.org/techniques/T1574/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command.asciidoc
new file mode 100644
index 0000000000..9143f5a738
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command.asciidoc
@@ -0,0 +1,75 @@
+[[prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command]]
+=== Modification of Safari Settings via Defaults Command
+
+Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+  process.name:defaults and process.args:
+    (com.apple.Safari and write and not
+      (
+      UniversalSearchEnabled or
+      SuppressSearchSuggestions or
+      WebKitTabToLinksPreferenceKey or
+      ShowFullURLInSmartSearchField or
+      com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks
+      )
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session.asciidoc
new file mode 100644
index 0000000000..65386dac1f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session.asciidoc
@@ -0,0 +1,77 @@
+[[prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session]]
+=== Multiple Okta Client Addresses for a Single User Session
+
+Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user's Okta account and is using it to access the organization's resources.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 60m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system
+    and okta.authentication_context.external_session_id:* and okta.debug_context.debug_data.dt_hash:*
+    and not (okta.actor.id: okta* or okta.actor.display_name: okta*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user.asciidoc
new file mode 100644
index 0000000000..56bf507c3b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user.asciidoc
@@ -0,0 +1,76 @@
+[[prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user]]
+=== Multiple Okta Sessions Detected for a Single User
+
+Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 60m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.event_type:user.session.start and okta.authentication_context.external_session_id:*
+    and not (okta.actor.id: okta* or okta.actor.display_name: okta*) 
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Web Session Cookie
+** ID: T1550.004
+** Reference URL: https://attack.mitre.org/techniques/T1550/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash.asciidoc
new file mode 100644
index 0000000000..9f54d14aba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash.asciidoc
@@ -0,0 +1,75 @@
+[[prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash]]
+=== Multiple Okta Users with the Same Device Token Hash
+
+Detects when Okta user or system events are reported for multiple users with the same device token hash.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and not okta.actor.id:okta* and okta.debug_context.debug_data.dt_hash:* and okta.event_type:(system* or user*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected.asciidoc
new file mode 100644
index 0000000000..fd2d1b6662
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected]]
+=== New Okta Authentication Behavior Detected
+
+Detects events where Okta behavior detection has identified a new authentication behavior.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+* https://help.okta.com/oie/en-us/content/topics/security/behavior-detection/about-behavior-detection.htm
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating New Okta Authentication Behavior Detected
+
+This rule detects events where Okta behavior detection has identified a new authentication behavior such as a new device or location.
+
+#### Possible investigation steps:
+- Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the authentication anomaly by examining the `okta.debug_context.debug_data.risk_behaviors` and `okta.debug_context.debug_data.flattened` fields.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- A user may be using a new device or location to sign in.
+- The Okta behavior detection may be incorrectly identifying a new authentication behavior and need adjusted.
+
+### Response and remediation:
+- If the user is legitimate and the authentication behavior is not suspicious, no action is required.
+- If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
+    - If MFA is already enabled, consider resetting MFA for the user.
+- If the user is not legitimate, consider deactivating the user's account.
+- If this is a false positive, consider adjusting the Okta behavior detection settings.
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.debug_context.debug_data.risk_behaviors:*
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin.asciidoc
new file mode 100644
index 0000000000..bd2c082ee7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin.asciidoc
@@ -0,0 +1,102 @@
+[[prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin]]
+=== New Okta Identity Provider (IdP) Added by Admin
+
+Detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating New Okta Identity Provider (IdP) Added by Admin
+
+This rule detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta.
+
+#### Possible investigation steps:
+- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Identify the IdP added by reviewing the `okta.target` field and determing if this IdP is authorized.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- It might be a false positive if the action was part of a planned activity or performed by an authorized person.
+- Several unsuccessful attempts prior to this success, may indicate an adversary attempting to add an unauthorized IdP multiple times.
+
+### Response and remediation:
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
+- If the actor is unauthorized, deactivate their account via the Okta console.
+- If the actor is authorized, ensure that the actor's account is not compromised.
+- Reset the user's password and enforce MFA re-enrollment, if applicable.
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "okta.system" and event.action: "system.idp.lifecycle.create" and okta.outcome.result: "SUCCESS"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Sub-technique:
+** Name: Hybrid Identity
+** ID: T1556.007
+** Reference URL: https://attack.mitre.org/techniques/T1556/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-fastpass-phishing-detection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-fastpass-phishing-detection.asciidoc
new file mode 100644
index 0000000000..60bd1cd753
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-fastpass-phishing-detection.asciidoc
@@ -0,0 +1,72 @@
+[[prebuilt-rule-8-10-7-okta-fastpass-phishing-detection]]
+=== Okta FastPass Phishing Detection
+
+Detects when Okta FastPass prevents a user from authenticating to a phishing website.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://sec.okta.com/fastpassphishingdetection
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and event.category:authentication and 
+  okta.event_type:user.authentication.auth_via_mfa and event.outcome:failure and okta.outcome.reason:"FastPass declined phishing attempt"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp.asciidoc
new file mode 100644
index 0000000000..b50750abbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp]]
+=== Okta Sign-In Events via Third-Party IdP
+
+Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Okta Sign-In Events via Third-Party IdP
+
+This rule detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
+
+Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain access to the tenant. Following this action, adversaries may attempt to sign in to the tenant using the unauthorized IdP. This rule detects both the addition of an unauthorized IdP and the subsequent sign-in attempt.
+
+#### Possible investigation steps:
+- Identify the third-party IdP by examining the `okta.authentication_context.issuer.id` field.
+- Once the third-party IdP is identified, determine if this IdP is authorized to be used by the tenant.
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields in historical data.
+    - The `New Okta Identity Provider (IdP) Added by Admin` rule may be helpful in identifying the actor and the IdP creation event.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- It might be a false positive if this IdP is authorized to be used by the tenant.
+- This may be a false positive if an authorized third-party IdP is used to sign in to the tenant but failures occurred due to an incorrect configuration.
+
+### Response and remediation:
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- Reset the effected user's password and enforce MFA re-enrollment, if applicable.
+- Mobile device forensics may be required to determine if the user's device is compromised.
+- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
+- If the actor is unauthorized, deactivate their account via the Okta console.
+- If the actor is authorized, ensure that the actor's account is not compromised.
+
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.debug_context.debug_data.request_uri:/oauth2/v1/authorize/callback and
+    (not okta.authentication_context.issuer.id:Okta and event.action:(user.authentication.auth_via_IDP
+        or user.authentication.auth_via_inbound_SAML
+        or user.authentication.auth_via_mfa
+        or user.authentication.auth_via_social)
+        or event.action:user.session.start) or
+    (event.action:user.authentication.auth_via_IDP and okta.outcome.result:FAILURE
+        and okta.outcome.reason:("A SAML assert with the same ID has already been processed by Okta for a previous request"
+            or "Unable to match transformed username"
+            or "Unable to resolve IdP endpoint"
+            or "Unable to validate SAML Response"
+            or "Unable to validate incoming SAML Assertion"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Trusted Relationship
+** ID: T1199
+** Reference URL: https://attack.mitre.org/techniques/T1199/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations.asciidoc
new file mode 100644
index 0000000000..49faa76dff
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations.asciidoc
@@ -0,0 +1,77 @@
+[[prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations]]
+=== Okta User Sessions Started from Different Geolocations
+
+Detects when a specific Okta actor has multiple sessions started from different geolocations.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.event_type:user.session.start and not okta.security_context.is_proxy:true
+    and okta.actor.id:* and client.geo.country_name:*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification.asciidoc
new file mode 100644
index 0000000000..2353c57df5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification.asciidoc
@@ -0,0 +1,62 @@
+[[prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification]]
+=== Persistence via DirectoryService Plugin Modification
+
+Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.chichou.me/2019/11/21/two-macos-persistence-tricks-abusing-plugins/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and not event.type:deletion and
+  file.path:/Library/DirectoryServices/PlugIns/*.dsplug
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification.asciidoc
new file mode 100644
index 0000000000..105fffc981
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification]]
+=== Persistence via Docker Shortcut Modification
+
+An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and event.action:modification and
+ file.path:/Users/*/Library/Preferences/com.apple.dock.plist and
+ not process.name:(xpcproxy or cfprefsd or plutil or jamf or PlistBuddy or InstallerRemotePluginService)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-folder-action-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-folder-action-script.asciidoc
new file mode 100644
index 0000000000..cec8dcfcd6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-folder-action-script.asciidoc
@@ -0,0 +1,74 @@
+[[prebuilt-rule-8-10-7-persistence-via-folder-action-script]]
+=== Persistence via Folder Action Script
+
+Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=5s
+ [process where host.os.type == "macos" and event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh") and
+  not process.args : "/Users/*/Library/Application Support/iTerm2/Scripts/AutoLaunch/*.scpt"
+ ] by process.parent.pid
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook.asciidoc
new file mode 100644
index 0000000000..2f50a78ef0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook.asciidoc
@@ -0,0 +1,70 @@
+[[prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook]]
+=== Persistence via Login or Logout Hook
+
+Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.virusbulletin.com/uploads/pdf/conference_slides/2014/Wardle-VB2014.pdf
+* https://www.manpagez.com/man/1/defaults/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type == "start" and
+ process.name == "defaults" and process.args == "write" and process.args : ("LoginHook", "LogoutHook") and
+ not process.args :
+       (
+         "Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
+         "Support/JAMF/ManagementFrameworkScripts/loginhook.sh",
+         "/Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
+         "/Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh"
+       )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-admin-group-account-addition.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-admin-group-account-addition.asciidoc
new file mode 100644
index 0000000000..f64005d3af
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-admin-group-account-addition.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-10-7-potential-admin-group-account-addition]]
+=== Potential Admin Group Account Addition
+
+Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-command-line-3-0/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:(dscl or dseditgroup) and process.args:(("/Groups/admin" or admin) and ("-a" or "-append"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation.asciidoc
new file mode 100644
index 0000000000..15b2255b88
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation]]
+=== Potential Hidden Local User Account Creation
+
+Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://support.apple.com/en-us/HT203998
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:dscl and process.args:(IsHidden and create and (true or 1 or yes))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost.asciidoc
new file mode 100644
index 0000000000..3a60efc32a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost.asciidoc
@@ -0,0 +1,79 @@
+[[prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost]]
+=== Potential Kerberos Attack via Bifrost
+
+Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/its-a-feature/bifrost
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+ process.args:("-action" and ("-kerberoast" or askhash or asktgs or asktgt or s4u or ("-ticket" and ptt) or (dump and (tickets or keytab))))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Pass the Ticket
+** ID: T1550.003
+** Reference URL: https://attack.mitre.org/techniques/T1550/003/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected.asciidoc
new file mode 100644
index 0000000000..e93f83694f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected.asciidoc
@@ -0,0 +1,61 @@
+[[prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected]]
+=== Potential macOS SSH Brute Force Detected
+
+Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:start and process.name:"sshd-keygen-wrapper" and process.parent.name:launchd
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion.asciidoc
new file mode 100644
index 0000000000..24a1738a36
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion]]
+=== Potential Microsoft Office Sandbox Evasion
+
+Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://i.blackhat.com/USA-20/Wednesday/us-20-Wardle-Office-Drama-On-macOS.pdf
+* https://www.mdsec.co.uk/2018/08/escaping-the-sandbox-microsoft-office-on-macos/
+* https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:(macos and macos) and not event.type:deletion and file.name:~$*.zip
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Virtualization/Sandbox Evasion
+** ID: T1497
+** Reference URL: https://attack.mitre.org/techniques/T1497/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..5f469e56ab
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications]]
+=== Potential Okta MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Okta MFA Bombing via Push Notifications
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+#### Possible investigation steps:
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+### False positive analysis:
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+### Response and remediation:
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [authentication where event.dataset == "okta.system"
+    and okta.event_type == "user.mfa.okta_verify.deny_push"] with runs=5
+  until [authentication where event.dataset == "okta.system"
+    and (okta.event_type: (
+      "user.authentication.sso",
+      "user.authentication.auth_via_mfa",
+      "user.authentication.verify",
+      "user.session.start") and okta.outcome.result == "SUCCESS")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification.asciidoc
new file mode 100644
index 0000000000..4dea95f095
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification]]
+=== Potential Persistence via Atom Init Script Modification
+
+Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/D00MFist/PersistentJXA/blob/master/AtomPersist.js
+* https://flight-manual.atom.io/hacking-atom/sections/the-init-file/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and not event.type:"deletion" and
+ file.path:/Users/*/.atom/init.coffee and not process.name:(Atom or xpcproxy) and not user.name:root
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-login-hook.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-login-hook.asciidoc
new file mode 100644
index 0000000000..ff16deeaeb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-login-hook.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-10-7-potential-persistence-via-login-hook]]
+=== Potential Persistence via Login Hook
+
+Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/D00MFist/PersistentJXA/blob/master/LoginScript.js
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. This can be abused to establish or maintain persistence on a compromised system.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and not event.type:"deletion" and
+ file.name:"com.apple.loginwindow.plist" and
+ process.name:(* and not (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor or backupd or "iMazing Profile Editor"
+))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Plist File Modification
+** ID: T1647
+** Reference URL: https://attack.mitre.org/techniques/T1647/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks.asciidoc
new file mode 100644
index 0000000000..b386e40652
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks.asciidoc
@@ -0,0 +1,68 @@
+[[prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks]]
+=== Potential Persistence via Periodic Tasks
+
+Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://opensource.apple.com/source/crontabs/crontabs-13/private/etc/defaults/periodic.conf.auto.html
+* https://www.oreilly.com/library/view/mac-os-x/0596003706/re328.html
+* https://github.com/D00MFist/PersistentJXA/blob/master/PeriodicPersist.js
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and not event.type:"deletion" and
+ file.path:(/private/etc/periodic/* or /private/etc/defaults/periodic.conf or /private/etc/periodic.conf)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
new file mode 100644
index 0000000000..a0549a5583
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
@@ -0,0 +1,74 @@
+[[prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy]]
+=== Potential Privacy Control Bypass via Localhost Secure Copy
+
+Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+ process.name:"scp" and
+ process.args:"StrictHostKeyChecking=no" and
+ process.command_line:("scp *localhost:/*", "scp *127.0.0.1:/*") and
+ not process.args:"vagrant@*127.0.0.1*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification.asciidoc
new file mode 100644
index 0000000000..ba1bcee889
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification.asciidoc
@@ -0,0 +1,69 @@
+[[prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification]]
+=== Potential Privacy Control Bypass via TCCDB Modification
+
+Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/
+* https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh
+* https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "sqlite*" and
+ process.args : "/*/Application Support/com.apple.TCC/TCC.db" and
+ not process.parent.executable : "/Library/Bitdefender/AVP/product/bin/*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..6d67fe91a2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,111 @@
+[[prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications]]
+=== Potentially Successful MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+
+*Version*: 208
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Abuse of Repeated MFA Push Notifications
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+#### Possible investigation steps:
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+### False positive analysis:
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+### Response and remediation:
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [authentication where event.dataset == "okta.system" and event.module == "okta"
+    and event.action == "user.mfa.okta_verify.deny_push"] with runs=3
+  [authentication where event.dataset == "okta.system" and event.module == "okta"
+    and (event.action : (
+      "user.authentication.sso",
+      "user.authentication.auth_via_mfa",
+      "user.authentication.verify",
+      "user.session.start") and okta.outcome.result == "SUCCESS")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification.asciidoc
new file mode 100644
index 0000000000..ea524ec98a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification.asciidoc
@@ -0,0 +1,67 @@
+[[prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification]]
+=== Privilege Escalation via Root Crontab File Modification
+
+Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc
+* https://www.exploit-db.com/exploits/42146
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and not event.type:deletion and
+ file.path:/private/var/at/tabs/root and not process.executable:/usr/bin/crontab
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript.asciidoc
new file mode 100644
index 0000000000..24d6f165c7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript.asciidoc
@@ -0,0 +1,67 @@
+[[prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript]]
+=== Prompt for Credentials with OSASCRIPT
+
+Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py
+* https://ss64.com/osx/osascript.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
+ process.command_line : "osascript*display dialog*password*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Input Capture
+** ID: T1056
+** Reference URL: https://attack.mitre.org/techniques/T1056/
+* Sub-technique:
+** Name: GUI Input Capture
+** ID: T1056.002
+** Reference URL: https://attack.mitre.org/techniques/T1056/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc
new file mode 100644
index 0000000000..52296d9b6a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc
@@ -0,0 +1,125 @@
+[[prebuilt-rule-8-10-7-remote-execution-via-file-shares]]
+=== Remote Execution via File Shares
+
+Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Remote Execution via File Shares
+
+Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Review adjacent login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- This activity can happen legitimately. Consider adding exceptions if it is expected and noisy in your environment.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Review the privileges needed to write to the network share and restrict write access as needed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1m
+  [file where host.os.type == "windows" and event.type in ("creation", "change") and 
+   process.pid == 4 and (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc
new file mode 100644
index 0000000000..9804e8ca36
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer]]
+=== Remote File Copy via TeamViewer
+
+Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Remote File Copy via TeamViewer
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse legitimate utilities to drop these files.
+
+TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Contact the user to gather information about who and why was conducting the remote access.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check whether the company uses TeamViewer for the support activities and if there is a support ticket related to this access.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct remote access and the triage has not identified suspicious or malicious files.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and process.name : "TeamViewer.exe" and
+  file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta") and
+  not 
+  (
+    file.path : (
+      "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.js",
+      "?:\\Users\\*\\AppData\\Local\\Temp\\TeamViewer\\update.exe",
+      "?:\\Users\\*\\AppData\\Local\\Temp\\?\\TeamViewer\\update.exe"
+    ) and process.code_signature.trusted == true
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command.asciidoc
new file mode 100644
index 0000000000..87773a4344
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command.asciidoc
@@ -0,0 +1,70 @@
+[[prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command]]
+=== Remote SSH Login Enabled via systemsetup Command
+
+Detects use of the systemsetup command to enable remote SSH Login.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf
+* https://ss64.com/osx/systemsetup.html
+* https://support.apple.com/guide/remote-desktop/about-systemsetup-apd95406b8d/mac
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:systemsetup and
+ process.args:("-setremotelogin" and on) and
+ not process.parent.executable : /usr/local/jamf/bin/jamf
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process.asciidoc
new file mode 100644
index 0000000000..e4d02d540f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process.asciidoc
@@ -0,0 +1,105 @@
+[[prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process]]
+=== Screensaver Plist File Modified by Unexpected Process
+
+Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/saving-your-access-d562bf5bf90b
+* https://github.com/D00MFist/PersistentJXA
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+- Analyze the plist file modification event to identify whether the change was expected or not
+- Investigate the process that modified the plist file for malicious code or other suspicious behavior
+- Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host
+
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and
+  file.name: "com.apple.screensaver.*.plist" and
+   file.path : (
+      "/Users/*/Library/Preferences/ByHost/*",
+      "/Library/Managed Preferences/*",
+      "/System/Library/Preferences/*"
+      ) and
+  (
+    process.code_signature.trusted == false or
+    process.code_signature.exists == false or
+
+    /* common script interpreters and abused native macOS bins */
+    process.name : (
+      "curl",
+      "mktemp",
+      "tail",
+      "funzip",
+      "python*",
+      "osascript",
+      "perl"
+      )
+   ) and
+
+  /* Filter OS processes modifying screensaver plist files */
+  not process.executable : (
+    "/usr/sbin/cfprefsd",
+    "/usr/libexec/xpcproxy",
+    "/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor",
+    "/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-shell-execution-via-apple-scripting.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-shell-execution-via-apple-scripting.asciidoc
new file mode 100644
index 0000000000..983df01bbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-shell-execution-via-apple-scripting.asciidoc
@@ -0,0 +1,64 @@
+[[prebuilt-rule-8-10-7-shell-execution-via-apple-scripting]]
+=== Shell Execution via Apple Scripting
+
+Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.apple.com/library/archive/technotes/tn2065/_index.html
+* https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=5s
+ [process where host.os.type == "macos" and event.type in ("start", "process_started", "info") and process.name == "osascript"] by process.pid
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.parent.pid
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-softwareupdate-preferences-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-softwareupdate-preferences-modification.asciidoc
new file mode 100644
index 0000000000..e82a954747
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-softwareupdate-preferences-modification.asciidoc
@@ -0,0 +1,67 @@
+[[prebuilt-rule-8-10-7-softwareupdate-preferences-modification]]
+=== SoftwareUpdate Preferences Modification
+
+Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:defaults and
+ process.args:(write and "-bool" and (com.apple.SoftwareUpdate or /Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or true))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification.asciidoc
new file mode 100644
index 0000000000..290bd11954
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification.asciidoc
@@ -0,0 +1,74 @@
+[[prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification]]
+=== Sublime Plugin or Application Script Modification
+
+Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "macos" and event.type in ("change", "creation") and file.extension : "py" and
+  file.path :
+    (
+      "/Users/*/Library/Application Support/Sublime Text*/Packages/*.py",
+      "/Applications/Sublime Text.app/Contents/MacOS/sublime.py"
+    ) and
+  not process.executable :
+    (
+      "/Applications/Sublime Text*.app/Contents/*",
+      "/usr/local/Cellar/git/*/bin/git",
+      "/Library/Developer/CommandLineTools/usr/bin/git",
+      "/usr/libexec/xpcproxy",
+      "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Compromise Client Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-automator-workflows-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-automator-workflows-execution.asciidoc
new file mode 100644
index 0000000000..2987d6a0e1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-automator-workflows-execution.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-suspicious-automator-workflows-execution]]
+=== Suspicious Automator Workflows Execution
+
+Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=30s
+ [process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "automator"]
+ [network where host.os.type == "macos" and process.name:"com.apple.automator.runner"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-browser-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-browser-child-process.asciidoc
new file mode 100644
index 0000000000..a81ef34496
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-browser-child-process.asciidoc
@@ -0,0 +1,89 @@
+[[prebuilt-rule-8-10-7-suspicious-browser-child-process]]
+=== Suspicious Browser Child Process
+
+Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://objective-see.com/blog/blog_0x43.html
+* https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  process.parent.name : ("Google Chrome", "Google Chrome Helper*", "firefox", "Opera", "Safari", "com.apple.WebKit.WebContent", "Microsoft Edge") and
+  process.name : ("sh", "bash", "dash", "ksh", "tcsh", "zsh", "curl", "wget", "python*", "perl*", "php*", "osascript", "pwsh") and
+  process.command_line != null and
+  not process.command_line : "*/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate*" and
+  not process.args :
+    (
+      "hw.model",
+      "IOPlatformExpertDevice",
+      "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh",
+      "--defaults-torrc",
+      "*Chrome.app",
+      "Framework.framework/Versions/*/Resources/keystone_promote_preflight.sh",
+      "/Users/*/Library/Application Support/Google/Chrome/recovery/*/ChromeRecovery",
+      "$DISPLAY",
+      "*GIO_LAUNCHED_DESKTOP_FILE_PID=$$*",
+      "/opt/homebrew/*",
+      "/usr/local/*brew*"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Exploitation for Client Execution
+** ID: T1203
+** Reference URL: https://attack.mitre.org/techniques/T1203/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Drive-by Compromise
+** ID: T1189
+** Reference URL: https://attack.mitre.org/techniques/T1189/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-calendar-file-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-calendar-file-modification.asciidoc
new file mode 100644
index 0000000000..9aa288baf9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-calendar-file-modification.asciidoc
@@ -0,0 +1,75 @@
+[[prebuilt-rule-8-10-7-suspicious-calendar-file-modification]]
+=== Suspicious Calendar File Modification
+
+Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://labs.f-secure.com/blog/operationalising-calendar-alerts-persistence-on-macos
+* https://github.com/FSecureLABS/CalendarPersist
+* https://github.com/D00MFist/PersistentJXA/blob/master/CalendarPersist.js
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:macos and event.action:modification and
+  file.path:/Users/*/Library/Calendars/*.calendar/Events/*.ics and
+  process.executable:
+  (* and not
+    (
+      /System/Library/* or
+      /System/Applications/Calendar.app/Contents/MacOS/* or
+      /System/Applications/Mail.app/Contents/MacOS/Mail or
+      /usr/libexec/xpcproxy or
+      /sbin/launchd or
+      /Applications/*
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
new file mode 100644
index 0000000000..7e8d1ae118
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
@@ -0,0 +1,73 @@
+[[prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service]]
+=== Suspicious Child Process of Adobe Acrobat Reader Update Service
+
+Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://rekken.github.io/2020/05/14/Security-Flaws-in-Adobe-Acrobat-Reader-Allow-Malicious-Program-to-Gain-Root-on-macOS-Silently/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.parent.name:com.adobe.ARMDC.SMJobBlessHelper and
+  user.name:root and
+  not process.executable: (/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper or
+                           /usr/bin/codesign or
+                           /private/var/folders/zz/*/T/download/ARMDCHammer or
+                           /usr/sbin/pkgutil or
+                           /usr/bin/shasum or
+                           /usr/bin/perl* or
+                           /usr/sbin/spctl or
+                           /usr/sbin/installer or
+                           /usr/bin/csrutil)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification.asciidoc
new file mode 100644
index 0000000000..6a5b74b5b4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification.asciidoc
@@ -0,0 +1,67 @@
+[[prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification]]
+=== Suspicious CronTab Creation or Modification
+
+Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf
+* https://theevilbit.github.io/beyond/beyond_0004/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "macos" and event.type != "deletion" and process.name != null and
+  file.path : "/private/var/at/tabs/*" and not process.executable == "/usr/bin/crontab"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Cron
+** ID: T1053.003
+** Reference URL: https://attack.mitre.org/techniques/T1053/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-emond-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-emond-child-process.asciidoc
new file mode 100644
index 0000000000..6f7a5d8022
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-emond-child-process.asciidoc
@@ -0,0 +1,89 @@
+[[prebuilt-rule-8-10-7-suspicious-emond-child-process]]
+=== Suspicious Emond Child Process
+
+Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.xorrior.com/emond-persistence/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+ process.parent.name : "emond" and
+ process.name : (
+   "bash",
+   "dash",
+   "sh",
+   "tcsh",
+   "csh",
+   "zsh",
+   "ksh",
+   "fish",
+   "Python",
+   "python*",
+   "perl*",
+   "php*",
+   "osascript",
+   "pwsh",
+   "curl",
+   "wget",
+   "cp",
+   "mv",
+   "touch",
+   "echo",
+   "base64",
+   "launchctl")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Emond
+** ID: T1546.014
+** Reference URL: https://attack.mitre.org/techniques/T1546/014/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd.asciidoc
new file mode 100644
index 0000000000..2436700f13
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd]]
+=== Suspicious Hidden Child Process of Launchd
+
+Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://objective-see.com/blog/blog_0x61.html
+* https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
+* https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+ process.name:.* and process.parent.executable:/sbin/launchd
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Launch Agent
+** ID: T1543.001
+** Reference URL: https://attack.mitre.org/techniques/T1543/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process.asciidoc
new file mode 100644
index 0000000000..6958385ff4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process.asciidoc
@@ -0,0 +1,99 @@
+[[prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process]]
+=== Suspicious macOS MS Office Child Process
+
+Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.malwarebytes.com/cybercrime/2017/02/microsoft-office-macro-malware-targets-macs/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+ process.parent.name:("Microsoft Word", "Microsoft PowerPoint", "Microsoft Excel") and
+ process.name:
+ (
+   "bash",
+   "dash",
+   "sh",
+   "tcsh",
+   "csh",
+   "zsh",
+   "ksh",
+   "fish",
+   "python*",
+   "perl*",
+   "php*",
+   "osascript",
+   "pwsh",
+   "curl",
+   "wget",
+   "cp",
+   "mv",
+   "base64",
+   "launchctl"
+  ) and
+  /* noisy false positives related to product version discovery and office errors reporting */
+  not process.args:
+    (
+      "ProductVersion",
+      "hw.model",
+      "ioreg",
+      "ProductName",
+      "ProductUserVisibleVersion",
+      "ProductBuildVersion",
+      "/Library/Application Support/Microsoft/MERP*/Microsoft Error Reporting.app/Contents/MacOS/Microsoft Error Reporting"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process.asciidoc
new file mode 100644
index 0000000000..cec9ee6da7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process.asciidoc
@@ -0,0 +1,74 @@
+[[prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process]]
+=== Suspicious Managed Code Hosting Process
+
+Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=5m
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe", "dllhost.exe", "cmstp.exe")]
+ [file where host.os.type == "windows" and event.type != "deletion" and
+  file.name : ("wscript.exe.log",
+               "cscript.exe.log",
+               "mshta.exe.log",
+               "wmic.exe.log",
+               "svchost.exe.log",
+               "dllhost.exe.log",
+               "cmstp.exe.log",
+               "regsvr32.exe.log")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-werfault-child-process.asciidoc
new file mode 100644
index 0000000000..08ad416a2c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-suspicious-werfault-child-process.asciidoc
@@ -0,0 +1,101 @@
+[[prebuilt-rule-8-10-7-suspicious-werfault-child-process]]
+=== Suspicious WerFault Child Process
+
+A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/
+* https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/
+* https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx
+* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+
+  process.parent.name : "WerFault.exe" and 
+  
+  /* args -s and -t used to execute a process via SilentProcessExit mechanism */
+  (process.parent.args : "-s" and process.parent.args : "-t" and process.parent.args : "-c") and 
+  
+  not process.executable : ("?:\\Windows\\SysWOW64\\Initcrypt.exe", "?:\\Program Files (x86)\\Heimdal\\Heimdal.Guard.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Image File Execution Options Injection
+** ID: T1546.012
+** Reference URL: https://attack.mitre.org/techniques/T1546/012/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Image File Execution Options Injection
+** ID: T1546.012
+** Reference URL: https://attack.mitre.org/techniques/T1546/012/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-systemkey-access-via-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-systemkey-access-via-command-line.asciidoc
new file mode 100644
index 0000000000..071d9b14b0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-systemkey-access-via-command-line.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-10-7-systemkey-access-via-command-line]]
+=== SystemKey Access via Command Line
+
+Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and
+  process.args:("/private/var/db/SystemKey" or "/var/db/SystemKey")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
new file mode 100644
index 0000000000..d3adf31e71
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access]]
+=== TCC Bypass via Mounted APFS Snapshot Access
+
+Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC).
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://theevilbit.github.io/posts/cve_2020_9771/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:(start or process_started) and process.name:mount_apfs and
+  process.args:(/System/Volumes/Data and noowners)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Direct Volume Access
+** ID: T1006
+** Reference URL: https://attack.mitre.org/techniques/T1006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine.asciidoc
new file mode 100644
index 0000000000..3e4603ff22
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine]]
+=== Unexpected Child Process of macOS Screensaver Engine
+
+Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/saving-your-access-d562bf5bf90b
+* https://github.com/D00MFist/PersistentJXA
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+- Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such
+as a download of a payload from a server.
+- Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to
+identify whether the file is malicious or not.
+
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type == "start" and process.parent.name == "ScreenSaverEngine"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Screensaver
+** ID: T1546.002
+** Reference URL: https://attack.mitre.org/techniques/T1546/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-virtual-private-network-connection-attempt.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-virtual-private-network-connection-attempt.asciidoc
new file mode 100644
index 0000000000..0e7d9fb3b2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-virtual-private-network-connection-attempt.asciidoc
@@ -0,0 +1,68 @@
+[[prebuilt-rule-8-10-7-virtual-private-network-connection-attempt]]
+=== Virtual Private Network Connection Attempt
+
+Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/manage/vpn.rb
+* https://www.unix.com/man-page/osx/8/networksetup/
+* https://superuser.com/questions/358513/start-configured-vpn-from-command-line-osx
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "macos" and event.type in ("start", "process_started") and
+  (
+    (process.name : "networksetup" and process.args : "-connectpppoeservice") or
+    (process.name : "scutil" and process.args : "--nc" and process.args : "start") or
+    (process.name : "osascript" and process.command_line : "osascript*set VPN to service*")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-webproxy-settings-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-webproxy-settings-modification.asciidoc
new file mode 100644
index 0000000000..3a6ee111e5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-webproxy-settings-modification.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-10-7-webproxy-settings-modification]]
+=== WebProxy Settings Modification
+
+Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
+* https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: macOS
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:macos and event.type:start and
+ process.name : networksetup and process.args : (("-setwebproxy" or "-setsecurewebproxy" or "-setautoproxyurl") and not (Bluetooth or off)) and
+ not process.parent.executable : ("/Library/PrivilegedHelperTools/com.80pct.FreedomHelper" or
+                                  "/Applications/Fiddler Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi" or
+                                  "/usr/libexec/xpcproxy")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Web Session Cookie
+** ID: T1539
+** Reference URL: https://attack.mitre.org/techniques/T1539/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-appendix.asciidoc
new file mode 100644
index 0000000000..b488f37711
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-appendix.asciidoc
@@ -0,0 +1,85 @@
+["appendix",role="exclude",id="prebuilt-rule-8-10-7-prebuilt-rules-8-10-7-appendix"]
+= Downloadable rule update v8.10.7
+
+This section lists all updates associated with version 8.10.7 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+include::prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications.asciidoc[]
+include::prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy.asciidoc[]
+include::prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash.asciidoc[]
+include::prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session.asciidoc[]
+include::prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected.asciidoc[]
+include::prebuilt-rule-8-10-7-okta-fastpass-phishing-detection.asciidoc[]
+include::prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations.asciidoc[]
+include::prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp.asciidoc[]
+include::prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user.asciidoc[]
+include::prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin.asciidoc[]
+include::prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process.asciidoc[]
+include::prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications.asciidoc[]
+include::prebuilt-rule-8-10-7-access-of-stored-browser-credentials.asciidoc[]
+include::prebuilt-rule-8-10-7-access-to-keychain-credentials-directories.asciidoc[]
+include::prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands.asciidoc[]
+include::prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command.asciidoc[]
+include::prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping.asciidoc[]
+include::prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line.asciidoc[]
+include::prebuilt-rule-8-10-7-webproxy-settings-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected.asciidoc[]
+include::prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript.asciidoc[]
+include::prebuilt-rule-8-10-7-systemkey-access-via-command-line.asciidoc[]
+include::prebuilt-rule-8-10-7-softwareupdate-preferences-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute.asciidoc[]
+include::prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper.asciidoc[]
+include::prebuilt-rule-8-10-7-attempt-to-install-root-certificate.asciidoc[]
+include::prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc[]
+include::prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion.asciidoc[]
+include::prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc[]
+include::prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc[]
+include::prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands.asciidoc[]
+include::prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-browser-child-process.asciidoc[]
+include::prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-automator-workflows-execution.asciidoc[]
+include::prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection.asciidoc[]
+include::prebuilt-rule-8-10-7-shell-execution-via-apple-scripting.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost.asciidoc[]
+include::prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line.asciidoc[]
+include::prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command.asciidoc[]
+include::prebuilt-rule-8-10-7-virtual-private-network-connection-attempt.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation.asciidoc[]
+include::prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading.asciidoc[]
+include::prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script.asciidoc[]
+include::prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading.asciidoc[]
+include::prebuilt-rule-8-10-7-authorization-plugin-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd.asciidoc[]
+include::prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-emond-rules-creation-or-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-emond-child-process.asciidoc[]
+include::prebuilt-rule-8-10-7-attempt-to-enable-the-root-account.asciidoc[]
+include::prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon.asciidoc[]
+include::prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled.asciidoc[]
+include::prebuilt-rule-8-10-7-persistence-via-folder-action-script.asciidoc[]
+include::prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-persistence-via-login-hook.asciidoc[]
+include::prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks.asciidoc[]
+include::prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine.asciidoc[]
+include::prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-calendar-file-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges.asciidoc[]
+include::prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc[]
+include::prebuilt-rule-8-10-7-potential-admin-group-account-addition.asciidoc[]
+include::prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification.asciidoc[]
+include::prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-werfault-child-process.asciidoc[]
+include::prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process.asciidoc[]
+include::prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc[]
+include::prebuilt-rule-8-10-7-account-configured-with-never-expiring-password.asciidoc[]
+include::prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-summary.asciidoc
new file mode 100644
index 0000000000..9f1e586677
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-summary.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-10-7-prebuilt-rules-8-10-7-summary]]
+[role="xpack"]
+== Update v8.10.7
+
+This section lists all updates associated with version 8.10.7 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+[width="100%",options="header"]
+|==============================================
+|Rule |Description |Status |Version
+
+|<<prebuilt-rule-8-10-7-potential-okta-mfa-bombing-via-push-notifications, Potential Okta MFA Bombing via Push Notifications>> | Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. | new | 1 
+
+|<<prebuilt-rule-8-10-7-first-occurrence-of-okta-user-session-started-via-proxy, First Occurrence of Okta User Session Started via Proxy>> | Identifies the first occurrence of an Okta user session started via a proxy. | new | 1 
+
+|<<prebuilt-rule-8-10-7-multiple-okta-users-with-the-same-device-token-hash, Multiple Okta Users with the Same Device Token Hash>> | Detects when Okta user or system events are reported for multiple users with the same device token hash. | new | 1 
+
+|<<prebuilt-rule-8-10-7-multiple-okta-client-addresses-for-a-single-user-session, Multiple Okta Client Addresses for a Single User Session>> | Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user's Okta account and is using it to access the organization's resources. | new | 1 
+
+|<<prebuilt-rule-8-10-7-new-okta-authentication-behavior-detected, New Okta Authentication Behavior Detected>> | Detects events where Okta behavior detection has identified a new authentication behavior. | new | 1 
+
+|<<prebuilt-rule-8-10-7-okta-fastpass-phishing-detection, Okta FastPass Phishing Detection>> | Detects when Okta FastPass prevents a user from authenticating to a phishing website. | new | 2 
+
+|<<prebuilt-rule-8-10-7-okta-user-sessions-started-from-different-geolocations, Okta User Sessions Started from Different Geolocations>> | Detects when a specific Okta actor has multiple sessions started from different geolocations. | new | 1 
+
+|<<prebuilt-rule-8-10-7-okta-sign-in-events-via-third-party-idp, Okta Sign-In Events via Third-Party IdP>> | Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP). | new | 1 
+
+|<<prebuilt-rule-8-10-7-multiple-okta-sessions-detected-for-a-single-user, Multiple Okta Sessions Detected for a Single User>> | Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location. | new | 1 
+
+|<<prebuilt-rule-8-10-7-new-okta-identity-provider-idp-added-by-admin, New Okta Identity Provider (IdP) Added by Admin>> | Detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta. | new | 1 
+
+|<<prebuilt-rule-8-10-7-first-time-seen-newcredentials-logon-process, First Time Seen NewCredentials Logon Process>> | Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions. | new | 1 
+
+|<<prebuilt-rule-8-10-7-potentially-successful-mfa-bombing-via-push-notifications, Potentially Successful MFA Bombing via Push Notifications>> | Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. | update | 208 
+
+|<<prebuilt-rule-8-10-7-access-of-stored-browser-credentials, Access of Stored Browser Credentials>> | Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser. | update | 106 
+
+|<<prebuilt-rule-8-10-7-access-to-keychain-credentials-directories, Access to Keychain Credentials Directories>> | Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates. | update | 106 
+
+|<<prebuilt-rule-8-10-7-dumping-account-hashes-via-built-in-commands, Dumping Account Hashes via Built-In Commands>> | Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement. | update | 105 
+
+|<<prebuilt-rule-8-10-7-dumping-of-keychain-content-via-security-command, Dumping of Keychain Content via Security Command>> | Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. | update | 106 
+
+|<<prebuilt-rule-8-10-7-kerberos-cached-credentials-dumping, Kerberos Cached Credentials Dumping>> | Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement. | update | 105 
+
+|<<prebuilt-rule-8-10-7-keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> | Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. | update | 106 
+
+|<<prebuilt-rule-8-10-7-webproxy-settings-modification, WebProxy Settings Modification>> | Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. | update | 105 
+
+|<<prebuilt-rule-8-10-7-potential-macos-ssh-brute-force-detected, Potential macOS SSH Brute Force Detected>> | Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. | update | 106 
+
+|<<prebuilt-rule-8-10-7-prompt-for-credentials-with-osascript, Prompt for Credentials with OSASCRIPT>> | Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. | update | 106 
+
+|<<prebuilt-rule-8-10-7-systemkey-access-via-command-line, SystemKey Access via Command Line>> | Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials. | update | 105 
+
+|<<prebuilt-rule-8-10-7-softwareupdate-preferences-modification, SoftwareUpdate Preferences Modification>> | Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. | update | 105 
+
+|<<prebuilt-rule-8-10-7-attempt-to-remove-file-quarantine-attribute, Attempt to Remove File Quarantine Attribute>> | Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses. | update | 106 
+
+|<<prebuilt-rule-8-10-7-attempt-to-disable-gatekeeper, Attempt to Disable Gatekeeper>> | Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. | update | 105 
+
+|<<prebuilt-rule-8-10-7-attempt-to-install-root-certificate, Attempt to Install Root Certificate>> | Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. | update | 105 
+
+|<<prebuilt-rule-8-10-7-modification-of-environment-variable-via-launchctl, Modification of Environment Variable via Launchctl>> | Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions. | update | 105 
+
+|<<prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-tccdb-modification, Potential Privacy Control Bypass via TCCDB Modification>> | Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. | update | 106 
+
+|<<prebuilt-rule-8-10-7-potential-privacy-control-bypass-via-localhost-secure-copy, Potential Privacy Control Bypass via Localhost Secure Copy>> | Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files. | update | 106 
+
+|<<prebuilt-rule-8-10-7-modification-of-safari-settings-via-defaults-command, Modification of Safari Settings via Defaults Command>> | Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser. | update | 105 
+
+|<<prebuilt-rule-8-10-7-potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> | Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. | update | 105 
+
+|<<prebuilt-rule-8-10-7-tcc-bypass-via-mounted-apfs-snapshot-access, TCC Bypass via Mounted APFS Snapshot Access>> | Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC). | update | 105 
+
+|<<prebuilt-rule-8-10-7-attempt-to-unload-elastic-endpoint-security-kernel-extension, Attempt to Unload Elastic Endpoint Security Kernel Extension>> | Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command. | update | 105 
+
+|<<prebuilt-rule-8-10-7-enumeration-of-users-or-groups-via-built-in-commands, Enumeration of Users or Groups via Built-in Commands>> | Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. | update | 106 
+
+|<<prebuilt-rule-8-10-7-execution-via-electron-child-process-node-js-module, Execution via Electron Child Process Node.js Module>> | Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes. | update | 105 
+
+|<<prebuilt-rule-8-10-7-suspicious-browser-child-process, Suspicious Browser Child Process>> | Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. | update | 105 
+
+|<<prebuilt-rule-8-10-7-macos-installer-package-spawns-network-event, MacOS Installer Package Spawns Network Event>> | Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package. | update | 105 
+
+|<<prebuilt-rule-8-10-7-suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> | Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. | update | 105 
+
+|<<prebuilt-rule-8-10-7-apple-script-execution-followed-by-network-connection, Apple Script Execution followed by Network Connection>> | Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. | update | 105 
+
+|<<prebuilt-rule-8-10-7-shell-execution-via-apple-scripting, Shell Execution via Apple Scripting>> | Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. | update | 105 
+
+|<<prebuilt-rule-8-10-7-suspicious-macos-ms-office-child-process, Suspicious macOS MS Office Child Process>> | Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros. | update | 105 
+
+|<<prebuilt-rule-8-10-7-potential-kerberos-attack-via-bifrost, Potential Kerberos Attack via Bifrost>> | Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. | update | 105 
+
+|<<prebuilt-rule-8-10-7-attempt-to-mount-smb-share-via-command-line, Attempt to Mount SMB Share via Command Line>> | Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB. | update | 106 
+
+|<<prebuilt-rule-8-10-7-remote-ssh-login-enabled-via-systemsetup-command, Remote SSH Login Enabled via systemsetup Command>> | Detects use of the systemsetup command to enable remote SSH Login. | update | 105 
+
+|<<prebuilt-rule-8-10-7-virtual-private-network-connection-attempt, Virtual Private Network Connection Attempt>> | Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network. | update | 106 
+
+|<<prebuilt-rule-8-10-7-potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> | Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. | update | 105 
+
+|<<prebuilt-rule-8-10-7-launch-agent-creation-or-modification-and-immediate-loading, Launch Agent Creation or Modification and Immediate Loading>> | An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories. | update | 105 
+
+|<<prebuilt-rule-8-10-7-creation-of-hidden-login-item-via-apple-script, Creation of Hidden Login Item via Apple Script>> | Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence. | update | 107 
+
+|<<prebuilt-rule-8-10-7-launchdaemon-creation-or-modification-and-immediate-loading, LaunchDaemon Creation or Modification and Immediate Loading>> | Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. | update | 105 
+
+|<<prebuilt-rule-8-10-7-authorization-plugin-modification, Authorization Plugin Modification>> | Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon. | update | 105 
+
+|<<prebuilt-rule-8-10-7-suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> | Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. | update | 105 
+
+|<<prebuilt-rule-8-10-7-suspicious-hidden-child-process-of-launchd, Suspicious Hidden Child Process of Launchd>> | Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login. | update | 105 
+
+|<<prebuilt-rule-8-10-7-persistence-via-directoryservice-plugin-modification, Persistence via DirectoryService Plugin Modification>> | Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence. | update | 105 
+
+|<<prebuilt-rule-8-10-7-persistence-via-docker-shortcut-modification, Persistence via Docker Shortcut Modification>> | An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. | update | 105 
+
+|<<prebuilt-rule-8-10-7-emond-rules-creation-or-modification, Emond Rules Creation or Modification>> | Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. | update | 106 
+
+|<<prebuilt-rule-8-10-7-suspicious-emond-child-process, Suspicious Emond Child Process>> | Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. | update | 105 
+
+|<<prebuilt-rule-8-10-7-attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> | Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. | update | 105 
+
+|<<prebuilt-rule-8-10-7-creation-of-hidden-launch-agent-or-daemon, Creation of Hidden Launch Agent or Daemon>> | Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. | update | 106 
+
+|<<prebuilt-rule-8-10-7-finder-sync-plugin-registered-and-enabled, Finder Sync Plugin Registered and Enabled>> | Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. | update | 105 
+
+|<<prebuilt-rule-8-10-7-persistence-via-folder-action-script, Persistence via Folder Action Script>> | Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. | update | 105 
+
+|<<prebuilt-rule-8-10-7-persistence-via-login-or-logout-hook, Persistence via Login or Logout Hook>> | Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout. | update | 106 
+
+|<<prebuilt-rule-8-10-7-potential-persistence-via-login-hook, Potential Persistence via Login Hook>> | Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence. | update | 106 
+
+|<<prebuilt-rule-8-10-7-sublime-plugin-or-application-script-modification, Sublime Plugin or Application Script Modification>> | Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started. | update | 106 
+
+|<<prebuilt-rule-8-10-7-potential-persistence-via-periodic-tasks, Potential Persistence via Periodic Tasks>> | Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence. | update | 105 
+
+|<<prebuilt-rule-8-10-7-unexpected-child-process-of-macos-screensaver-engine, Unexpected Child Process of macOS Screensaver Engine>> | Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. | update | 106 
+
+|<<prebuilt-rule-8-10-7-screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> | Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. | update | 106 
+
+|<<prebuilt-rule-8-10-7-suspicious-calendar-file-modification, Suspicious Calendar File Modification>> | Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence. | update | 105 
+
+|<<prebuilt-rule-8-10-7-potential-persistence-via-atom-init-script-modification, Potential Persistence via Atom Init Script Modification>> | Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening. | update | 105 
+
+|<<prebuilt-rule-8-10-7-apple-scripting-execution-with-administrator-privileges, Apple Scripting Execution with Administrator Privileges>> | Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges. | update | 106 
+
+|<<prebuilt-rule-8-10-7-execution-with-explicit-credentials-via-scripting, Execution with Explicit Credentials via Scripting>> | Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials. | update | 105 
+
+|<<prebuilt-rule-8-10-7-suspicious-child-process-of-adobe-acrobat-reader-update-service, Suspicious Child Process of Adobe Acrobat Reader Update Service>> | Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched. | update | 105 
+
+|<<prebuilt-rule-8-10-7-potential-admin-group-account-addition, Potential Admin Group Account Addition>> | Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity. | update | 105 
+
+|<<prebuilt-rule-8-10-7-privilege-escalation-via-root-crontab-file-modification, Privilege Escalation via Root Crontab File Modification>> | Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities. | update | 105 
+
+|<<prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> | Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. | update | 109 
+
+|<<prebuilt-rule-8-10-7-suspicious-werfault-child-process, Suspicious WerFault Child Process>> | A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes. | update | 110 
+
+|<<prebuilt-rule-8-10-7-suspicious-managed-code-hosting-process, Suspicious Managed Code Hosting Process>> | Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution. | update | 106 
+
+|<<prebuilt-rule-8-10-7-remote-execution-via-file-shares, Remote Execution via File Shares>> | Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. | update | 109 
+
+|<<prebuilt-rule-8-10-7-account-configured-with-never-expiring-password, Account Configured with Never-Expiring Password>> | Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property. | update | 108 
+
+|<<prebuilt-rule-8-10-7-creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> | Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. | update | 108 
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 17d802257c..01ead4e834 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -13,6 +13,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 |Update version |Date | New rules | Updated rules | Notes
 
 
+|<<prebuilt-rule-8-10-7-prebuilt-rules-8-10-7-summary, 8.10.7>> | 28 Nov 2023 | 11 | 68 | 
+Update Status Message
+
+
 |<<prebuilt-rule-8-10-6-prebuilt-rules-8-10-6-summary, 8.10.6>> | 14 Nov 2023 | 2 | 366 |
 This release includes new machine learning and Linux rules.
 New rules for Linux include detection for suspicious network connections via Kworker, kernel ring buffer manipulation and driver loading.
@@ -63,3 +67,4 @@ include::downloadable-packages/8-10-3/prebuilt-rules-8-10-3-summary.asciidoc[lev
 include::downloadable-packages/8-10-4/prebuilt-rules-8-10-4-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-10-5/prebuilt-rules-8-10-5-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-10-6/prebuilt-rules-8-10-6-summary.asciidoc[leveloffset=+1]
+include::downloadable-packages/8-10-7/prebuilt-rules-8-10-7-summary.asciidoc[leveloffset=+1]
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index 4920323b10..f11b789ec7 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -134,9 +134,9 @@ and their rule type is `machine_learning`.
 
 |<<accepted-default-telnet-port-connection, Accepted Default Telnet Port Connection>> |This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. |[Domain: Endpoint], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Lateral Movement], [Tactic: Initial Access] |8.3.0 |104
 
-|<<access-of-stored-browser-credentials, Access of Stored Browser Credentials>> |Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
+|<<access-of-stored-browser-credentials, Access of Stored Browser Credentials>> |Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<access-to-keychain-credentials-directories, Access to Keychain Credentials Directories>> |Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
+|<<access-to-keychain-credentials-directories, Access to Keychain Credentials Directories>> |Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<access-to-a-sensitive-ldap-attribute, Access to a Sensitive LDAP Attribute>> |Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |9
 
@@ -178,9 +178,9 @@ and their rule type is `machine_learning`.
 
 |<<anomalous-windows-process-creation, Anomalous Windows Process Creation>> |Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |105
 
-|<<apple-script-execution-followed-by-network-connection, Apple Script Execution followed by Network Connection>> |Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |104
+|<<apple-script-execution-followed-by-network-connection, Apple Script Execution followed by Network Connection>> |Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<apple-scripting-execution-with-administrator-privileges, Apple Scripting Execution with Administrator Privileges>> |Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |105
+|<<apple-scripting-execution-with-administrator-privileges, Apple Scripting Execution with Administrator Privileges>> |Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<application-added-to-google-workspace-domain, Application Added to Google Workspace Domain>> |Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Persistence], [Resources: Investigation Guide] |8.4.0 |205
 
@@ -212,17 +212,17 @@ and their rule type is `machine_learning`.
 
 |<<attempt-to-delete-an-okta-policy-rule, Attempt to Delete an Okta Policy Rule>> |Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Defense Evasion] |8.10.0 |206
 
-|<<attempt-to-disable-gatekeeper, Attempt to Disable Gatekeeper>> |Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<attempt-to-disable-gatekeeper, Attempt to Disable Gatekeeper>> |Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<attempt-to-disable-iptables-or-firewall, Attempt to Disable IPTables or Firewall>> |Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<attempt-to-disable-syslog-service, Attempt to Disable Syslog Service>> |Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> |Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> |Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<attempt-to-install-kali-linux-via-wsl, Attempt to Install Kali Linux via WSL>> |Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |5
 
-|<<attempt-to-install-root-certificate, Attempt to Install Root Certificate>> |Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<attempt-to-install-root-certificate, Attempt to Install Root Certificate>> |Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<attempt-to-modify-an-okta-application, Attempt to Modify an Okta Application>> |Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.10.0 |205
 
@@ -232,15 +232,15 @@ and their rule type is `machine_learning`.
 
 |<<attempt-to-modify-an-okta-policy-rule, Attempt to Modify an Okta Policy Rule>> |Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls. |[Use Case: Identity and Access Audit], [Tactic: Defense Evasion], [Data Source: Okta] |8.10.0 |207
 
-|<<attempt-to-mount-smb-share-via-command-line, Attempt to Mount SMB Share via Command Line>> |Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |105
+|<<attempt-to-mount-smb-share-via-command-line, Attempt to Mount SMB Share via Command Line>> |Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<attempt-to-remove-file-quarantine-attribute, Attempt to Remove File Quarantine Attribute>> |Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
+|<<attempt-to-remove-file-quarantine-attribute, Attempt to Remove File Quarantine Attribute>> |Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<attempt-to-reset-mfa-factors-for-an-okta-user-account, Attempt to Reset MFA Factors for an Okta User Account>> |Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment. |[Tactic: Persistence], [Use Case: Identity and Access Audit], [Data Source: Okta] |8.10.0 |206
 
 |<<attempt-to-revoke-okta-api-token, Attempt to Revoke Okta API Token>> |Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.10.0 |206
 
-|<<attempt-to-unload-elastic-endpoint-security-kernel-extension, Attempt to Unload Elastic Endpoint Security Kernel Extension>> |Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<attempt-to-unload-elastic-endpoint-security-kernel-extension, Attempt to Unload Elastic Endpoint Security Kernel Extension>> |Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<attempted-bypass-of-okta-mfa, Attempted Bypass of Okta MFA>> |Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application. |[Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.10.0 |207
 
@@ -250,7 +250,7 @@ and their rule type is `machine_learning`.
 
 |<<attempts-to-brute-force-an-okta-user-account, Attempts to Brute Force an Okta User Account>> |Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |207
 
-|<<authorization-plugin-modification, Authorization Plugin Modification>> |Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<authorization-plugin-modification, Authorization Plugin Modification>> |Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<azure-ad-global-administrator-role-assigned, Azure AD Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |102
 
@@ -376,9 +376,9 @@ and their rule type is `machine_learning`.
 
 |<<creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> |Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<creation-of-hidden-launch-agent-or-daemon, Creation of Hidden Launch Agent or Daemon>> |Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
+|<<creation-of-hidden-launch-agent-or-daemon, Creation of Hidden Launch Agent or Daemon>> |Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<creation-of-hidden-login-item-via-apple-script, Creation of Hidden Login Item via Apple Script>> |Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |106
+|<<creation-of-hidden-login-item-via-apple-script, Creation of Hidden Login Item via Apple Script>> |Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |107
 
 |<<creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> |Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -444,9 +444,9 @@ and their rule type is `machine_learning`.
 
 |<<downloaded-url-files, Downloaded URL Files>> |Identifies .url shortcut files downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<dumping-account-hashes-via-built-in-commands, Dumping Account Hashes via Built-In Commands>> |Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |104
+|<<dumping-account-hashes-via-built-in-commands, Dumping Account Hashes via Built-In Commands>> |Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<dumping-of-keychain-content-via-security-command, Dumping of Keychain Content via Security Command>> |Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
+|<<dumping-of-keychain-content-via-security-command, Dumping of Keychain Content via Security Command>> |Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<dynamic-linker-copy, Dynamic Linker Copy>> |Detects the copying of the Linux dynamic loader binary and subsequent file creation for the purpose of creating a backup copy. This technique was seen recently being utilized by Linux malware prior to patching the dynamic loader in order to inject and preload a malicious shared object file. This activity should never occur and if it does then it should be considered highly suspicious or malicious. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Orbit], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -460,7 +460,7 @@ and their rule type is `machine_learning`.
 
 |<<elastic-agent-service-terminated, Elastic Agent Service Terminated>> |Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a stable state. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<emond-rules-creation-or-modification, Emond Rules Creation or Modification>> |Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+|<<emond-rules-creation-or-modification, Emond Rules Creation or Modification>> |Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<enable-host-network-discovery-via-netsh, Enable Host Network Discovery via Netsh>> |Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -484,7 +484,7 @@ and their rule type is `machine_learning`.
 
 |<<enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> |Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.6.0 |209
 
-|<<enumeration-of-users-or-groups-via-built-in-commands, Enumeration of Users or Groups via Built-in Commands>> |Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |105
+|<<enumeration-of-users-or-groups-via-built-in-commands, Enumeration of Users or Groups via Built-in Commands>> |Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |6
 
@@ -506,7 +506,7 @@ and their rule type is `machine_learning`.
 
 |<<execution-of-an-unsigned-service, Execution of an Unsigned Service>> |This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |103
 
-|<<execution-via-electron-child-process-node-js-module, Execution via Electron Child Process Node.js Module>> |Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |104
+|<<execution-via-electron-child-process-node-js-module, Execution via Electron Child Process Node.js Module>> |Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<execution-via-ms-visualstudio-pre-post-build-events, Execution via MS VisualStudio Pre/Post Build Events>> |Identifies the execution of a command via Microsoft Visual Studio Pre or Post build events. Adversaries may backdoor a trusted visual studio project to execute a malicious command during the project build process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
@@ -520,7 +520,7 @@ and their rule type is `machine_learning`.
 
 |<<execution-via-local-sxs-shared-module, Execution via local SxS Shared Module>> |Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<execution-with-explicit-credentials-via-scripting, Execution with Explicit Credentials via Scripting>> |Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |104
+|<<execution-with-explicit-credentials-via-scripting, Execution with Explicit Credentials via Scripting>> |Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<expired-or-revoked-driver-loaded, Expired or Revoked Driver Loaded>> |Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |3
 
@@ -560,7 +560,9 @@ and their rule type is `machine_learning`.
 
 |<<file-with-suspicious-extension-downloaded, File with Suspicious Extension Downloaded>> |Identifies unusual files downloaded from outside the local network that have the potential to be abused for code execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<finder-sync-plugin-registered-and-enabled, Finder Sync Plugin Registered and Enabled>> |Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<finder-sync-plugin-registered-and-enabled, Finder Sync Plugin Registered and Enabled>> |Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+
+|<<first-occurrence-of-okta-user-session-started-via-proxy, First Occurrence of Okta User Session Started via Proxy>> |Identifies the first occurrence of an Okta user session started via a proxy. |[Tactic: Initial Access], [Use Case: Identity and Access Audit], [Data Source: Okta] |8.10.0 |1
 
 |<<first-time-seen-aws-secret-value-accessed-in-secrets-manager, First Time Seen AWS Secret Value Accessed in Secrets Manager>> |An adversary equipped with compromised credentials may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Credential Access], [Resources: Investigation Guide] |8.9.0 |308
 
@@ -570,6 +572,8 @@ and their rule type is `machine_learning`.
 
 |<<first-time-seen-google-workspace-oauth-login-from-third-party-application, First Time Seen Google Workspace OAuth Login from Third-Party Application>> |Detects the first time a third-party application logs in and authenticated with OAuth. OAuth is used to grant permissions to specific resources and services in Google Workspace. Compromised credentials or service accounts could allow an adversary to authenticate to Google Workspace as a valid user and inherit their privileges. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Defense Evasion], [Tactic: Initial Access] |8.4.0 |2
 
+|<<first-time-seen-newcredentials-logon-process, First Time Seen NewCredentials Logon Process>> |Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.4.0 |1
+
 |<<first-time-seen-removable-device, First Time Seen Removable Device>> |Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.4.0 |2
 
 |<<firsttime-seen-account-performing-dcsync, FirstTime Seen Account Performing DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Resources: Investigation Guide] |8.4.0 |8
@@ -730,7 +734,7 @@ and their rule type is `machine_learning`.
 
 |<<krbtgt-delegation-backdoor, KRBTGT Delegation Backdoor>> |Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT. Attackers can use this technique to maintain persistence to the domain by having the ability to request tickets for the KRBTGT service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |106
 
-|<<kerberos-cached-credentials-dumping, Kerberos Cached Credentials Dumping>> |Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |104
+|<<kerberos-cached-credentials-dumping, Kerberos Cached Credentials Dumping>> |Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<kerberos-pre-authentication-disabled-for-user, Kerberos Pre-authentication Disabled for User>> |Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |109
 
@@ -744,7 +748,7 @@ and their rule type is `machine_learning`.
 
 |<<kernel-module-removal, Kernel Module Removal>> |Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> |Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
+|<<keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> |Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<kirbi-file-creation, Kirbi File Creation>> |Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
@@ -780,9 +784,9 @@ and their rule type is `machine_learning`.
 
 |<<lateral-movement-via-startup-folder, Lateral Movement via Startup Folder>> |Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<launch-agent-creation-or-modification-and-immediate-loading, Launch Agent Creation or Modification and Immediate Loading>> |An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<launch-agent-creation-or-modification-and-immediate-loading, Launch Agent Creation or Modification and Immediate Loading>> |An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<launchdaemon-creation-or-modification-and-immediate-loading, LaunchDaemon Creation or Modification and Immediate Loading>> |Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<launchdaemon-creation-or-modification-and-immediate-loading, LaunchDaemon Creation or Modification and Immediate Loading>> |Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<linux-group-creation, Linux Group Creation>> |Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |3
 
@@ -806,7 +810,7 @@ and their rule type is `machine_learning`.
 
 |<<ms-office-macro-security-registry-modifications, MS Office Macro Security Registry Modifications>> |Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<macos-installer-package-spawns-network-event, MacOS Installer Package Spawns Network Event>> |Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |104
+|<<macos-installer-package-spawns-network-event, MacOS Installer Package Spawns Network Event>> |Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain, Machine Learning Detected DGA activity using a known SUNBURST DNS domain>> |A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm. |[Domain: Network], [Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.9.0 |1
 
@@ -904,11 +908,11 @@ and their rule type is `machine_learning`.
 
 |<<modification-of-dynamic-linker-preload-shared-object-inside-a-container, Modification of Dynamic Linker Preload Shared Object Inside A Container>> |This rule detects the creation or modification of the dynamic linker preload shared object (ld.so.preload) inside a container. The Linux dynamic linker is used to load libraries needed by a program at runtime. Adversaries may hijack the dynamic linker by modifying the /etc/ld.so.preload file to point to malicious libraries. This behavior can be used to grant unauthorized access to system resources and has been used to evade detection of malicious processes in container environments. |[Data Source: Elastic Defend for Containers], [Domain: Container], [Tactic: Defense Evasion] |8.8.0 |1
 
-|<<modification-of-environment-variable-via-launchctl, Modification of Environment Variable via Launchctl>> |Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<modification-of-environment-variable-via-launchctl, Modification of Environment Variable via Launchctl>> |Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<modification-of-openssh-binaries, Modification of OpenSSH Binaries>> |Adversaries may modify SSH related binaries for persistence or credential access by patching sensitive functions to enable unauthorized access or by logging SSH credentials for exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<modification-of-safari-settings-via-defaults-command, Modification of Safari Settings via Defaults Command>> |Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<modification-of-safari-settings-via-defaults-command, Modification of Safari Settings via Defaults Command>> |Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<modification-of-standard-authentication-module-or-configuration, Modification of Standard Authentication Module or Configuration>> |Adversaries may modify the standard authentication module for persistence via patching the normal authorization process or modifying the login configuration to allow unauthorized access or elevate privileges. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Data Source: Elastic Defend] |8.6.0 |204
 
@@ -940,6 +944,12 @@ and their rule type is `machine_learning`.
 
 |<<multiple-logon-failure-from-the-same-source-address, Multiple Logon Failure from the same Source Address>> |Identifies multiple consecutive logon failures from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |8
 
+|<<multiple-okta-client-addresses-for-a-single-user-session, Multiple Okta Client Addresses for a Single User Session>> |Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user's Okta account and is using it to access the organization's resources. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access] |8.10.0 |1
+
+|<<multiple-okta-sessions-detected-for-a-single-user, Multiple Okta Sessions Detected for a Single User>> |Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Lateral Movement] |8.10.0 |1
+
+|<<multiple-okta-users-with-the-same-device-token-hash, Multiple Okta Users with the Same Device Token Hash>> |Detects when Okta user or system events are reported for multiple users with the same device token hash. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access] |8.10.0 |1
+
 |<<multiple-vault-web-credentials-read, Multiple Vault Web Credentials Read>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |9
 
 |<<my-first-rule, My First Rule>> |This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity. |[Use Case: Guided Onboarding], [Data Source: APM], [OS: Windows], [Data Source: Elastic Endgame] |8.7.0 |2
@@ -982,6 +992,10 @@ and their rule type is `machine_learning`.
 
 |<<new-github-owner-added, New GitHub Owner Added>> |Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. |[Domain: Cloud], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Github] |8.3.0 |1
 
+|<<new-okta-authentication-behavior-detected, New Okta Authentication Behavior Detected>> |Detects events where Okta behavior detection has identified a new authentication behavior. |[Use Case: Identity and Access Audit], [Tactic: Initial Access], [Data Source: Okta] |8.10.0 |1
+
+|<<new-okta-identity-provider-idp-added-by-admin, New Okta Identity Provider (IdP) Added by Admin>> |Detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta. |[Use Case: Identity and Access Audit], [Tactic: Persistence], [Data Source: Okta] |8.10.0 |1
+
 |<<new-systemd-service-created-by-previously-unknown-process, New Systemd Service Created by Previously Unknown Process>> |Systemd service files are configuration files in Linux systems used to define and manage system services. Malicious actors can leverage systemd service files to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |6
 
 |<<new-systemd-timer-created, New Systemd Timer Created>> |Detects the creation of a systemd timer within any of the default systemd timer directories. Systemd timers can be used by an attacker to gain persistence, by scheduling the execution of a command or script. Similarly to cron/at, systemd timers can be set up to execute on boot time, or on a specific point in time, which allows attackers to regain access in case the connection to the infected asset was lost. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |7
@@ -1004,10 +1018,16 @@ and their rule type is `machine_learning`.
 
 |<<okta-brute-force-or-password-spraying-attack, Okta Brute Force or Password Spraying Attack>> |Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |207
 
+|<<okta-fastpass-phishing-detection, Okta FastPass Phishing Detection>> |Detects when Okta FastPass prevents a user from authenticating to a phishing website. |[Tactic: Initial Access], [Use Case: Identity and Access Audit], [Data Source: Okta] |8.3.0 |2
+
+|<<okta-sign-in-events-via-third-party-idp, Okta Sign-In Events via Third-Party IdP>> |Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP). |[Use Case: Identity and Access Audit], [Tactic: Initial Access], [Data Source: Okta] |8.10.0 |1
+
 |<<okta-threatinsight-threat-suspected-promotion, Okta ThreatInsight Threat Suspected Promotion>> |Okta ThreatInsight is a feature that provides valuable debug data regarding authentication and authorization processes, which is logged in the system. Within this data, there is a specific field called threat_suspected, which represents Okta's internal evaluation of the authentication or authorization workflow. When this field is set to True, it suggests the presence of potential credential access techniques, such as password-spraying, brute-forcing, replay attacks, and other similar threats. |[Use Case: Identity and Access Audit], [Data Source: Okta] |8.10.0 |205
 
 |<<okta-user-session-impersonation, Okta User Session Impersonation>> |A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |207
 
+|<<okta-user-sessions-started-from-different-geolocations, Okta User Sessions Started from Different Geolocations>> |Detects when a specific Okta actor has multiple sessions started from different geolocations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access] |8.10.0 |1
+
 |<<onedrive-malware-file-upload, OneDrive Malware File Upload>> |Identifies the occurence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.3.0 |102
 
 |<<outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> |Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
@@ -1022,17 +1042,17 @@ and their rule type is `machine_learning`.
 
 |<<persistence-via-bits-job-notify-cmdline, Persistence via BITS Job Notify Cmdline>> |An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<persistence-via-directoryservice-plugin-modification, Persistence via DirectoryService Plugin Modification>> |Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<persistence-via-directoryservice-plugin-modification, Persistence via DirectoryService Plugin Modification>> |Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<persistence-via-docker-shortcut-modification, Persistence via Docker Shortcut Modification>> |An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<persistence-via-docker-shortcut-modification, Persistence via Docker Shortcut Modification>> |An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<persistence-via-folder-action-script, Persistence via Folder Action Script>> |Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<persistence-via-folder-action-script, Persistence via Folder Action Script>> |Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<persistence-via-hidden-run-key-detected, Persistence via Hidden Run Key Detected>> |Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<persistence-via-kde-autostart-script-or-desktop-file-modification, Persistence via KDE AutoStart Script or Desktop File Modification>> |Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<persistence-via-login-or-logout-hook, Persistence via Login or Logout Hook>> |Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+|<<persistence-via-login-or-logout-hook, Persistence via Login or Logout Hook>> |Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<persistence-via-microsoft-office-addins, Persistence via Microsoft Office AddIns>> |Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -1060,9 +1080,7 @@ and their rule type is `machine_learning`.
 
 |<<possible-okta-dos-attack, Possible Okta DoS Attack>> |Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an organization's business operations by performing a DoS attack against its Okta service. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.10.0 |205
 
-|<<potential-abuse-of-repeated-mfa-push-notifications, Potential Abuse of Repeated MFA Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |207
-
-|<<potential-admin-group-account-addition, Potential Admin Group Account Addition>> |Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-admin-group-account-addition, Potential Admin Group Account Addition>> |Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<potential-antimalware-scan-interface-bypass-via-powershell, Potential Antimalware Scan Interface Bypass via PowerShell>> |Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |6
 
@@ -1122,7 +1140,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-file-transfer-via-certreq, Potential File Transfer via Certreq>> |Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |5
 
-|<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<potential-hidden-process-via-mount-hidepid, Potential Hidden Process via Mount Hidepid>> |Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
 
@@ -1132,7 +1150,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-java-jndi-exploitation-attempt, Potential JAVA/JNDI Exploitation Attempt>> |Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard ports followed by a suspicious JAVA child processes. This may indicate an attempt to exploit a JAVA/NDI (Java Naming and Directory Interface) injection vulnerability. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |104
 
-|<<potential-kerberos-attack-via-bifrost, Potential Kerberos Attack via Bifrost>> |Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-kerberos-attack-via-bifrost, Potential Kerberos Attack via Bifrost>> |Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<potential-lsa-authentication-package-abuse, Potential LSA Authentication Package Abuse>> |Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |104
 
@@ -1176,7 +1194,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-meterpreter-reverse-shell, Potential Meterpreter Reverse Shell>> |This detection rule identifies a sample of suspicious Linux system file reads used for system fingerprinting, leveraged by the Metasploit Meterpreter shell to gather information about the target that it is executing its shell on. Detecting this pattern is indicative of a successful meterpreter shell connection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.6.0 |3
 
-|<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -1192,6 +1210,8 @@ and their rule type is `machine_learning`.
 
 |<<potential-non-standard-port-ssh-connection, Potential Non-Standard Port SSH connection>> |Identifies potentially malicious processes communicating via a port paring typically not associated with SSH. For example, SSH over port 2200 or port 2222 as opposed to the traditional port 22. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [OS: macOS], [Data Source: Elastic Defend] |8.3.0 |5
 
+|<<potential-okta-mfa-bombing-via-push-notifications, Potential Okta MFA Bombing via Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |1
+
 |<<potential-openssh-backdoor-logging-activity, Potential OpenSSH Backdoor Logging Activity>> |Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
 |<<potential-outgoing-rdp-connection-by-unusual-process, Potential Outgoing RDP Connection by Unusual Process>> |Adversaries may attempt to connect to a remote system over Windows Remote Desktop Protocol (RDP) to achieve lateral movement. Adversaries may avoid using the Microsoft Terminal Services Client (mstsc.exe) binary to establish an RDP connection to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |1
@@ -1206,11 +1226,11 @@ and their rule type is `machine_learning`.
 
 |<<potential-persistence-through-init-d-detected, Potential Persistence Through init.d Detected>> |Files that are placed in the /etc/init.d/ directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the "systemd-sysv-generator" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the /etc/init.d/ directory to execute malicious code upon boot in order to gain persistence on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |7
 
-|<<potential-persistence-via-atom-init-script-modification, Potential Persistence via Atom Init Script Modification>> |Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-persistence-via-atom-init-script-modification, Potential Persistence via Atom Init Script Modification>> |Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<potential-persistence-via-login-hook, Potential Persistence via Login Hook>> |Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+|<<potential-persistence-via-login-hook, Potential Persistence via Login Hook>> |Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<potential-persistence-via-periodic-tasks, Potential Persistence via Periodic Tasks>> |Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-persistence-via-periodic-tasks, Potential Persistence via Periodic Tasks>> |Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<potential-persistence-via-time-provider-modification, Potential Persistence via Time Provider Modification>> |Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |105
 
@@ -1218,9 +1238,9 @@ and their rule type is `machine_learning`.
 
 |<<potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> |Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs] |8.3.0 |7
 
-|<<potential-privacy-control-bypass-via-localhost-secure-copy, Potential Privacy Control Bypass via Localhost Secure Copy>> |Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
+|<<potential-privacy-control-bypass-via-localhost-secure-copy, Potential Privacy Control Bypass via Localhost Secure Copy>> |Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<potential-privacy-control-bypass-via-tccdb-modification, Potential Privacy Control Bypass via TCCDB Modification>> |Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
+|<<potential-privacy-control-bypass-via-tccdb-modification, Potential Privacy Control Bypass via TCCDB Modification>> |Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<potential-privilege-escalation-through-writable-docker-socket, Potential Privilege Escalation through Writable Docker Socket>> |This rule monitors for the usage of Docker runtime sockets to escalate privileges on Linux systems. Docker sockets by default are only be writable by the root user and docker group. Attackers that have permissions to write to these sockets may be able to create and run a container that allows them to escalate privileges and gain further access onto the host file system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Domain: Container], [Data Source: Elastic Defend] |8.3.0 |4
 
@@ -1322,7 +1342,9 @@ and their rule type is `machine_learning`.
 
 |<<potential-curl-cve-2023-38545-exploitation, Potential curl CVE-2023-38545 Exploitation>> |Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerable command line arguments in conjunction with an unusual command line length. A flaw in curl version <= 8.3 makes curl vulnerable to a heap based buffer overflow during the SOCKS5 proxy handshake. Upgrade to curl version >= 8.4 to patch this vulnerability. This exploit can be executed with and without the use of environment variables. For increased visibility, enable the collection of http_proxy, HTTPS_PROXY and ALL_PROXY environment variables based on the instructions provided in the setup guide of this rule. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Use Case: Vulnerability], [Tactic: Execution], [Data Source: Elastic Defend] |8.6.0 |3
 
-|<<potential-macos-ssh-brute-force-detected, Potential macOS SSH Brute Force Detected>> |Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
+|<<potential-macos-ssh-brute-force-detected, Potential macOS SSH Brute Force Detected>> |Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
+
+|<<potentially-successful-mfa-bombing-via-push-notifications, Potentially Successful MFA Bombing via Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |208
 
 |<<potentially-suspicious-process-started-via-tmux-or-screen, Potentially Suspicious Process Started via tmux or screen>> |This rule monitors for the execution of suspicious commands via screen and tmux. When launching a command and detaching directly, the commands will be executed in the background via its parent process. Attackers may leverage screen or tmux to execute commands while attempting to evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
@@ -1374,7 +1396,7 @@ and their rule type is `machine_learning`.
 
 |<<privilege-escalation-via-rogue-named-pipe-impersonation, Privilege Escalation via Rogue Named Pipe Impersonation>> |Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Sysmon Only] |8.3.0 |105
 
-|<<privilege-escalation-via-root-crontab-file-modification, Privilege Escalation via Root Crontab File Modification>> |Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |104
+|<<privilege-escalation-via-root-crontab-file-modification, Privilege Escalation via Root Crontab File Modification>> |Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |104
 
@@ -1408,7 +1430,7 @@ and their rule type is `machine_learning`.
 
 |<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<prompt-for-credentials-with-osascript, Prompt for Credentials with OSASCRIPT>> |Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
+|<<prompt-for-credentials-with-osascript, Prompt for Credentials with OSASCRIPT>> |Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<proxychains-activity, ProxyChains Activity>> |This rule monitors for the execution of the ProxyChains utility. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
@@ -1460,7 +1482,7 @@ and their rule type is `machine_learning`.
 
 |<<remote-logon-followed-by-scheduled-task-creation, Remote Logon followed by Scheduled Task Creation>> |Identifies a remote logon followed by a scheduled task creation on the target host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.3.0 |6
 
-|<<remote-ssh-login-enabled-via-systemsetup-command, Remote SSH Login Enabled via systemsetup Command>> |Detects use of the systemsetup command to enable remote SSH Login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |104
+|<<remote-ssh-login-enabled-via-systemsetup-command, Remote SSH Login Enabled via systemsetup Command>> |Detects use of the systemsetup command to enable remote SSH Login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<remote-scheduled-task-creation, Remote Scheduled Task Creation>> |Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -1502,7 +1524,7 @@ and their rule type is `machine_learning`.
 
 |<<scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> |Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> |Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+|<<screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> |Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<sedebugprivilege-enabled-by-a-suspicious-process, SeDebugPrivilege Enabled by a Suspicious Process>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |5
 
@@ -1542,13 +1564,13 @@ and their rule type is `machine_learning`.
 
 |<<shared-object-created-or-changed-by-previously-unknown-process, Shared Object Created or Changed by Previously Unknown Process>> |This rule monitors the creation of shared object files by previously unknown processes. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime. While this process is typically used for legitimate purposes, malicious actors can leverage shared object files to execute unauthorized code, inject malicious functionality into legitimate processes, or bypass security controls. This allows malware to persist on the system, evade detection, and potentially compromise the integrity and confidentiality of the affected system and its data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |5
 
-|<<shell-execution-via-apple-scripting, Shell Execution via Apple Scripting>> |Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |104
+|<<shell-execution-via-apple-scripting, Shell Execution via Apple Scripting>> |Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<shortcut-file-written-or-modified-on-startup-folder, Shortcut File Written or Modified on Startup Folder>> |Identifies shortcut files written to or modified in the startup folder. Adversaries may use this technique to maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
 |<<signed-proxy-execution-via-ms-work-folders, Signed Proxy Execution via MS Work Folders>> |Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame] |8.3.0 |106
 
-|<<softwareupdate-preferences-modification, SoftwareUpdate Preferences Modification>> |Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<softwareupdate-preferences-modification, SoftwareUpdate Preferences Modification>> |Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<solarwinds-process-disabling-services-via-registry, SolarWinds Process Disabling Services via Registry>> |Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -1586,7 +1608,7 @@ and their rule type is `machine_learning`.
 
 |<<startup-logon-script-added-to-group-policy-object, Startup/Logon Script added to Group Policy Object>> |Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |108
 
-|<<sublime-plugin-or-application-script-modification, Sublime Plugin or Application Script Modification>> |Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+|<<sublime-plugin-or-application-script-modification, Sublime Plugin or Application Script Modification>> |Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<sudo-command-enumeration-detected, Sudo Command Enumeration Detected>> |This rule monitors for the usage of the sudo -l command, which is used to list the allowed and forbidden commands for the invoking user. Attackers may execute this command to enumerate commands allowed to be executed with sudo permissions, potentially allowing to escalate privileges to root. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |4
 
@@ -1602,15 +1624,15 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> |Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |6
 
-|<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<suspicious-browser-child-process, Suspicious Browser Child Process>> |Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-browser-child-process, Suspicious Browser Child Process>> |Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<suspicious-calendar-file-modification, Suspicious Calendar File Modification>> |Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-calendar-file-modification, Suspicious Calendar File Modification>> |Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<suspicious-certutil-commands, Suspicious CertUtil Commands>> |Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-child-process-of-adobe-acrobat-reader-update-service, Suspicious Child Process of Adobe Acrobat Reader Update Service>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-child-process-of-adobe-acrobat-reader-update-service, Suspicious Child Process of Adobe Acrobat Reader Update Service>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -1618,13 +1640,13 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-content-extracted-or-decompressed-via-funzip, Suspicious Content Extracted or Decompressed via Funzip>> |Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |4
 
-|<<suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> |Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> |Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<suspicious-data-encryption-via-openssl-utility, Suspicious Data Encryption via OpenSSL Utility>> |Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend] |8.3.0 |4
 
-|<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -1646,7 +1668,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-html-file-creation, Suspicious HTML File Creation>> |Identifies the execution of a browser process to open an HTML file with high entropy and size. Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<suspicious-hidden-child-process-of-launchd, Suspicious Hidden Child Process of Launchd>> |Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-hidden-child-process-of-launchd, Suspicious Hidden Child Process of Launchd>> |Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<suspicious-image-load-taskschd-dll-from-ms-office, Suspicious Image Load (taskschd.dll) from MS Office>> |Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -1752,7 +1774,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-zoom-child-process, Suspicious Zoom Child Process>> |A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<suspicious-macos-ms-office-child-process, Suspicious macOS MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend] |8.3.0 |104
+|<<suspicious-macos-ms-office-child-process, Suspicious macOS MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<suspicious-which-enumeration, Suspicious which Enumeration>> |This rule monitors for the usage of the which command with an unusual amount of process arguments. Attackers may leverage the which command to enumerate the system for useful installed utilities that may be used after compromising a system to escalate privileges or move latteraly across the network. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
@@ -1778,9 +1800,9 @@ and their rule type is `machine_learning`.
 
 |<<system-time-discovery, System Time Discovery>> |Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |5
 
-|<<systemkey-access-via-command-line, SystemKey Access via Command Line>> |Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |104
+|<<systemkey-access-via-command-line, SystemKey Access via Command Line>> |Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<tcc-bypass-via-mounted-apfs-snapshot-access, TCC Bypass via Mounted APFS Snapshot Access>> |Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC). |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |104
+|<<tcc-bypass-via-mounted-apfs-snapshot-access, TCC Bypass via Mounted APFS Snapshot Access>> |Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC). |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<tainted-kernel-module-load, Tainted Kernel Module Load>> |This rule monitors the syslog log file for messages related to instances of a tainted kernel module load. Rootkits often leverage kernel modules as their main defense evasion technique. Detecting tainted kernel module loads is crucial for ensuring system security and integrity, as malicious or unauthorized modules can compromise the kernel and lead to system vulnerabilities or unauthorized access. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Rule Type: BBR] |8.3.0 |2
 
@@ -1820,7 +1842,7 @@ and their rule type is `machine_learning`.
 
 |<<uncommon-registry-persistence-change, Uncommon Registry Persistence Change>> |Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<unexpected-child-process-of-macos-screensaver-engine, Unexpected Child Process of macOS Screensaver Engine>> |Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
+|<<unexpected-child-process-of-macos-screensaver-engine, Unexpected Child Process of macOS Screensaver Engine>> |Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<unix-socket-connection, Unix Socket Connection>> |This rule monitors for inter-process communication via Unix sockets. Adversaries may attempt to communicate with local Unix sockets to enumerate application details, find vulnerabilities/configuration mistakes and potentially escalate privileges or set up malicious communication channels via Unix sockets for inter-process communication to attempt to evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
@@ -1976,7 +1998,7 @@ and their rule type is `machine_learning`.
 
 |<<virtual-machine-fingerprinting-via-grep, Virtual Machine Fingerprinting via Grep>> |An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |104
 
-|<<virtual-private-network-connection-attempt, Virtual Private Network Connection Attempt>> |Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |105
+|<<virtual-private-network-connection-attempt, Virtual Private Network Connection Attempt>> |Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<volume-shadow-copy-deleted-or-resized-via-vssadmin, Volume Shadow Copy Deleted or Resized via VssAdmin>> |Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -2002,7 +2024,7 @@ and their rule type is `machine_learning`.
 
 |<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<webproxy-settings-modification, WebProxy Settings Modification>> |Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |104
+|<<webproxy-settings-modification, WebProxy Settings Modification>> |Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<webserver-access-logs-deleted, WebServer Access Logs Deleted>> |Identifies the deletion of WebServer access logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |104
 
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 700dfb013a..89cd736d93 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -272,10 +272,12 @@ include::rule-details/file-made-immutable-by-chattr.asciidoc[]
 include::rule-details/file-or-directory-deletion-command.asciidoc[]
 include::rule-details/file-with-suspicious-extension-downloaded.asciidoc[]
 include::rule-details/finder-sync-plugin-registered-and-enabled.asciidoc[]
+include::rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc[]
 include::rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc[]
 include::rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc[]
 include::rule-details/first-time-seen-driver-loaded.asciidoc[]
 include::rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc[]
+include::rule-details/first-time-seen-newcredentials-logon-process.asciidoc[]
 include::rule-details/first-time-seen-removable-device.asciidoc[]
 include::rule-details/firsttime-seen-account-performing-dcsync.asciidoc[]
 include::rule-details/forwarded-google-workspace-security-alert.asciidoc[]
@@ -461,6 +463,9 @@ include::rule-details/multiple-alerts-involving-a-user.asciidoc[]
 include::rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-host.asciidoc[]
 include::rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc[]
 include::rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc[]
+include::rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc[]
+include::rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc[]
+include::rule-details/multiple-okta-users-with-the-same-device-token-hash.asciidoc[]
 include::rule-details/multiple-vault-web-credentials-read.asciidoc[]
 include::rule-details/my-first-rule.asciidoc[]
 include::rule-details/ntds-or-sam-database-file-copied.asciidoc[]
@@ -482,6 +487,8 @@ include::rule-details/network-level-authentication-nla-disabled.asciidoc[]
 include::rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc[]
 include::rule-details/new-github-app-installed.asciidoc[]
 include::rule-details/new-github-owner-added.asciidoc[]
+include::rule-details/new-okta-authentication-behavior-detected.asciidoc[]
+include::rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc[]
 include::rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc[]
 include::rule-details/new-systemd-timer-created.asciidoc[]
 include::rule-details/new-or-modified-federation-domain.asciidoc[]
@@ -493,8 +500,11 @@ include::rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
 include::rule-details/o365-mailbox-audit-logging-bypass.asciidoc[]
 include::rule-details/office-test-registry-persistence.asciidoc[]
 include::rule-details/okta-brute-force-or-password-spraying-attack.asciidoc[]
+include::rule-details/okta-fastpass-phishing-detection.asciidoc[]
+include::rule-details/okta-sign-in-events-via-third-party-idp.asciidoc[]
 include::rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc[]
 include::rule-details/okta-user-session-impersonation.asciidoc[]
+include::rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc[]
 include::rule-details/onedrive-malware-file-upload.asciidoc[]
 include::rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc[]
 include::rule-details/parent-process-pid-spoofing.asciidoc[]
@@ -521,7 +531,6 @@ include::rule-details/port-forwarding-rule-addition.asciidoc[]
 include::rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc[]
 include::rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc[]
 include::rule-details/possible-okta-dos-attack.asciidoc[]
-include::rule-details/potential-abuse-of-repeated-mfa-push-notifications.asciidoc[]
 include::rule-details/potential-admin-group-account-addition.asciidoc[]
 include::rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc[]
 include::rule-details/potential-application-shimming-via-sdbinst.asciidoc[]
@@ -587,6 +596,7 @@ include::rule-details/potential-network-share-discovery.asciidoc[]
 include::rule-details/potential-network-sweep-detected.asciidoc[]
 include::rule-details/potential-non-standard-port-http-https-connection.asciidoc[]
 include::rule-details/potential-non-standard-port-ssh-connection.asciidoc[]
+include::rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc[]
 include::rule-details/potential-openssh-backdoor-logging-activity.asciidoc[]
 include::rule-details/potential-outgoing-rdp-connection-by-unusual-process.asciidoc[]
 include::rule-details/potential-pass-the-hash-pth-attempt.asciidoc[]
@@ -653,6 +663,7 @@ include::rule-details/potential-upgrade-of-non-interactive-shell.asciidoc[]
 include::rule-details/potential-windows-error-manager-masquerading.asciidoc[]
 include::rule-details/potential-curl-cve-2023-38545-exploitation.asciidoc[]
 include::rule-details/potential-macos-ssh-brute-force-detected.asciidoc[]
+include::rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc[]
 include::rule-details/potentially-suspicious-process-started-via-tmux-or-screen.asciidoc[]
 include::rule-details/powershell-invoke-ninjacopy-script.asciidoc[]
 include::rule-details/powershell-kerberos-ticket-dump.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
index 6a81b721ac..8161f12cc7 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of a process with arguments pointing to known browser f
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -32,7 +31,7 @@ Identifies the execution of a process with arguments pointing to known browser f
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
index bc44d8f605..30065393df 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
@@ -7,7 +7,6 @@ Adversaries may collect the keychain storage data from a system to acquire crede
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Adversaries may collect the keychain storage data from a system to acquire crede
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
index 64921dc8bc..aa3b93dc31 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
@@ -24,8 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw
 *References*: 
 
 * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire
-* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html
-
+* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html
 
 *Tags*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index f025155d26..05da3d6dc3 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -60,7 +60,7 @@ Attackers can use this attribute to conceal tooling and malware to prevent admin
 This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index e8b01c4848..15db086975 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -57,7 +57,7 @@ Detects writing executable files that will be automatically launched by Adobe on
 Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
index 5132d58f73..523c717875 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
index 95462ceaba..8c469ccbbf 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
index 5cfb282f63..91b5aa30b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
@@ -7,7 +7,6 @@ Detects execution via the Apple script interpreter (osascript) followed by a net
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -34,7 +33,7 @@ Detects execution via the Apple script interpreter (osascript) followed by a net
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc b/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
index 5bd2726eba..e4869515be 100644
--- a/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
@@ -7,7 +7,6 @@ Identifies execution of the Apple script interpreter (osascript) without a passw
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies execution of the Apple script interpreter (osascript) without a passw
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
index f7c3c0b4d9..42508a7d3a 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
@@ -7,7 +7,6 @@ Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security featur
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security featur
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
index b48ee88969..de448d3e76 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
@@ -7,7 +7,6 @@ Identifies attempts to enable the root account using the dsenableroot command. T
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies attempts to enable the root account using the dsenableroot command. T
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
index b9e5c4cf20..490808d4e6 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
@@ -7,7 +7,6 @@ Adversaries may install a root certificate on a compromised system to avoid warn
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Adversaries may install a root certificate on a compromised system to avoid warn
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
index 4eb85ef162..d6674fe476 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of macOS built-in commands to mount a Server Message Bl
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -33,7 +32,7 @@ Identifies the execution of macOS built-in commands to mount a Server Message Bl
 * Tactic: Lateral Movement
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
index 9dd0d4296c..a1702a0376 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
@@ -7,7 +7,6 @@ Identifies a potential Gatekeeper bypass. In macOS, when applications or program
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies a potential Gatekeeper bypass. In macOS, when applications or program
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
index 7fbaa19cb8..227025a5ac 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
@@ -7,7 +7,6 @@ Identifies attempts to unload the Elastic Endpoint Security kernel extension via
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -30,7 +29,7 @@ Identifies attempts to unload the Elastic Endpoint Security kernel extension via
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
index 0b364aac2d..39fbb16f25 100644
--- a/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
@@ -7,7 +7,6 @@ Authorization plugins are used to extend the authorization services API and impl
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Authorization plugins are used to extend the authorization services API and impl
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index f0e66d7a9c..16c8a1ff37 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -60,7 +60,7 @@ For more information about the UAC and how it works, check the [official Microso
 During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
index 42482b5b4b..43830021d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining the security of the system. However
 This rule identifies commands that can disable the Driver Signature Enforcement feature.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
index 65a4f14022..f994e8d1b2 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies registry modifications that can disable DSE.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
index 7346f6e552..6a5670a1ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
@@ -57,7 +57,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 This rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index 12c2615423..2e52c55f1a 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -53,7 +53,7 @@ Adversaries may use an existing, legitimate external Web service as a means for
 This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
index f31e093a30..45ad1fca43 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
@@ -24,6 +24,7 @@ Identifies the creation of a hidden local user account by appending the dollar s
 
 *References*: 
 
+* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html
 * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign
 
 *Tags*: 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
index db5e00897b..9667325f4d 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
@@ -7,7 +7,6 @@ Identifies the creation of a hidden launch agent or daemon. An adversary may est
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies the creation of a hidden launch agent or daemon. An adversary may est
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
index 9808e70ba3..dc052f78df 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of osascript to create a hidden login item. This may in
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -31,7 +30,7 @@ Identifies the execution of osascript to create a hidden login item. This may in
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
index c1474f52dc..aeccb46039 100644
--- a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
@@ -53,7 +53,7 @@ Identifies unexpected processes making network connections over port 445. Window
 This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
index deeab31943..6e7bf05d70 100644
--- a/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of macOS built-in commands used to dump user account ha
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies the execution of macOS built-in commands used to dump user account ha
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
index 32277158a5..a07e5e9cdd 100644
--- a/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
@@ -7,7 +7,6 @@ Adversaries may dump the content of the keychain storage data from a system to a
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -32,7 +31,7 @@ Adversaries may dump the content of the keychain storage data from a system to a
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
index 6e65fcf2de..89e8a444c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies the creation or modification of the Event Monitor Daemon (emond) rule
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies the creation or modification of the Event Monitor Daemon (emond) rule
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index d97006cf60..a8ded2d769 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -54,7 +54,7 @@ After successfully compromising an environment, attackers may try to gain situat
 This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
index 317befa9f8..4dbe25bc90 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of macOS built-in commands related to account or group
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -30,7 +29,7 @@ Identifies the execution of macOS built-in commands related to account or group
 * Tactic: Discovery
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index f9d31323fd..dd55e83547 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -56,7 +56,7 @@ Identifies process execution from suspicious default Windows directories. This m
 This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
index 10f32ade0b..267f6da361 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
@@ -7,7 +7,6 @@ Identifies attempts to execute a child process from within the context of an Ele
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -35,7 +34,7 @@ Identifies attempts to execute a child process from within the context of an Ele
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
index b444e23b58..cac7f21a4c 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
@@ -7,7 +7,6 @@ Identifies execution of the security_authtrampoline process via a scripting inte
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -34,7 +33,7 @@ Identifies execution of the security_authtrampoline process via a scripting inte
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
index 216049881b..7714029b55 100644
--- a/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
@@ -7,7 +7,6 @@ Finder Sync plugins enable users to extend Finder’s functionality by modifying
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Finder Sync plugins enable users to extend Finder’s functionality by modifying
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
new file mode 100644
index 0000000000..c42e1e4e1b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
@@ -0,0 +1,97 @@
+[[first-occurrence-of-okta-user-session-started-via-proxy]]
+=== First Occurrence of Okta User Session Started via Proxy
+
+Identifies the first occurrence of an Okta user session started via a proxy.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://developer.okta.com/docs/reference/api/system-log/#issuer-object
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating First Occurrence of Okta User Session Started via Proxy
+
+This rule detects the first occurrence of an Okta user session started via a proxy. This rule is designed to help identify suspicious authentication behavior that may be indicative of an attacker attempting to gain access to an Okta account while remaining anonymous. This rule leverages the New Terms rule type feature where the `okta.actor.id` value is checked against the previous 7 days of data to determine if the value has been seen before for this activity.
+
+#### Possible investigation steps:
+- Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- Examine the `okta.debug_context.debug_data.flattened` field for more information about the proxy used.
+- Review the `okta.request.ip_chain` field for more information about the geographic location of the proxy.
+- Review the past activities of the actor involved in this action by checking their previous actions.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- A user may have legitimately started a session via a proxy for security or privacy reasons.
+
+### Response and remediation:
+- Review the profile of the user involved in this action to determine if proxy usage may be expected.
+- If the user is legitimate and the authentication behavior is not suspicious, no action is required.
+- If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
+    - If MFA is already enabled, consider resetting MFA for the user.
+- If the user is not legitimate, consider deactivating the user's account.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+
+## Setup
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.event_type: (user.session.start or user.authentication.verify) and okta.security_context.is_proxy:true and not okta.actor.id: okta*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: External Remote Services
+** ID: T1133
+** Reference URL: https://attack.mitre.org/techniques/T1133/
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
index bf58ea2539..eb5736f7e8 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
@@ -54,7 +54,7 @@ An adversary equipped with compromised credentials may attempt to access the sec
 
 AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.
 
-This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a {security-guide}/security/master/rules-ui-create.html#create-new-terms-rule[New Terms] rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a [New Terms](https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
index 995a424d7f..eec6aec376 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -60,7 +60,7 @@ Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elast
 This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc
new file mode 100644
index 0000000000..af60619374
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc
@@ -0,0 +1,66 @@
+[[first-time-seen-newcredentials-logon-process]]
+=== First Time Seen NewCredentials Logon Process
+
+Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/pt/blog/how-attackers-abuse-access-token-manipulation
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"authentication" and host.os.type:"windows" and winlog.logon.type:"NewCredentials" and winlog.event_data.LogonProcessName:(Advapi* or "Advapi  ")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
index afc81953ee..7b302428f1 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
@@ -7,7 +7,6 @@ Identifies the use of the Kerberos credential cache (kcc) utility to dump locall
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies the use of the Kerberos credential cache (kcc) utility to dump locall
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index 9590a1cf5e..751e60773a 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -53,7 +53,7 @@ Kerberos is the default authentication protocol in Active Directory, designed to
 Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
index f58a33c89e..71af9ed37b 100644
--- a/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
@@ -7,7 +7,6 @@ Adversaries may collect keychain storage data from a system to in order to acqui
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -35,7 +34,7 @@ Adversaries may collect keychain storage data from a system to in order to acqui
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
index c6165196ae..f01e5fe8ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
@@ -7,7 +7,6 @@ An adversary can establish persistence by installing a new launch agent that exe
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -32,7 +31,7 @@ An adversary can establish persistence by installing a new launch agent that exe
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
index 55941dfd6b..931f8c83bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
@@ -7,7 +7,6 @@ Indicates the creation or modification of a launch daemon, which adversaries may
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -32,7 +31,7 @@ Indicates the creation or modification of a launch daemon, which adversaries may
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index c29e4d1aab..43fd88aab6 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new groups to maintain access to victim systems or escalate
 This rule identifies the usages of `groupadd` and `addgroup` to create new groups.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index e3faf3076b..0aed48d8c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new accounts (both local and domain) to maintain access to
 This rule identifies the usage of `useradd` and `adduser` to create new accounts.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
index 8bd1b4d32c..b21d549950 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -57,8 +57,8 @@ Attackers may add users to a privileged group in order to escalate privileges or
 This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index 6e0692172d..2ed109fc73 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -60,7 +60,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index efd15d1093..55ae38e01f 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -61,7 +61,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
index adcb8af6db..772c59d1b1 100644
--- a/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
@@ -34,7 +34,7 @@ Detects the execution of a MacOS installer package with an abnormal child proces
 * Tactic: Command and Control
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 5ecbbe23a5..90b2bfa024 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -60,7 +60,7 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
index ebf0f6f1b6..b61e2ba0c9 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
@@ -7,7 +7,6 @@ Identifies modifications to an environment variable using the built-in launchctl
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies modifications to an environment variable using the built-in launchctl
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
index 36711d786c..6f3385371c 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
@@ -7,7 +7,6 @@ Identifies changes to the Safari configuration using the built-in defaults comma
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies changes to the Safari configuration using the built-in defaults comma
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
index ba3355465e..af2e186a5b 100644
--- a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
@@ -57,7 +57,7 @@ The Microsoft Build Engine, also known as MSBuild, is a platform for building ap
 This rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
index d9ced56709..11bc1414e6 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address, followed by a successful logon, indicating that an attacker potentially successfully compromised the account.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
index e70da27de6..d6d1348b2e 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
@@ -59,7 +59,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc
new file mode 100644
index 0000000000..a0c8c8b4a0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc
@@ -0,0 +1,77 @@
+[[multiple-okta-client-addresses-for-a-single-user-session]]
+=== Multiple Okta Client Addresses for a Single User Session
+
+Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user's Okta account and is using it to access the organization's resources.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 60m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system
+    and okta.authentication_context.external_session_id:* and okta.debug_context.debug_data.dt_hash:*
+    and not (okta.actor.id: okta* or okta.actor.display_name: okta*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc
new file mode 100644
index 0000000000..734b164369
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc
@@ -0,0 +1,76 @@
+[[multiple-okta-sessions-detected-for-a-single-user]]
+=== Multiple Okta Sessions Detected for a Single User
+
+Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 60m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.event_type:user.session.start and okta.authentication_context.external_session_id:*
+    and not (okta.actor.id: okta* or okta.actor.display_name: okta*) 
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Web Session Cookie
+** ID: T1550.004
+** Reference URL: https://attack.mitre.org/techniques/T1550/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-users-with-the-same-device-token-hash.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-users-with-the-same-device-token-hash.asciidoc
new file mode 100644
index 0000000000..33c70c3195
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-users-with-the-same-device-token-hash.asciidoc
@@ -0,0 +1,75 @@
+[[multiple-okta-users-with-the-same-device-token-hash]]
+=== Multiple Okta Users with the Same Device Token Hash
+
+Detects when Okta user or system events are reported for multiple users with the same device token hash.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and not okta.actor.id:okta* and okta.debug_context.debug_data.dt_hash:* and okta.event_type:(system* or user*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
index e4e32acb2e..7408e4fa3b 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
@@ -58,7 +58,7 @@ Attackers can abuse `certutil.exe` to download malware, offensive security tools
 This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
index 79e0f98665..cd340a5b30 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
@@ -59,7 +59,7 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 This rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
index aa8caba6a7..c8fa391314 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
@@ -58,7 +58,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
index a6c46ab537..acd33d6ddb 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries (such as process trees, com
 This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc
new file mode 100644
index 0000000000..81c6c6dd96
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc
@@ -0,0 +1,92 @@
+[[new-okta-authentication-behavior-detected]]
+=== New Okta Authentication Behavior Detected
+
+Detects events where Okta behavior detection has identified a new authentication behavior.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+* https://help.okta.com/oie/en-us/content/topics/security/behavior-detection/about-behavior-detection.htm
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating New Okta Authentication Behavior Detected
+
+This rule detects events where Okta behavior detection has identified a new authentication behavior such as a new device or location.
+
+#### Possible investigation steps:
+- Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the authentication anomaly by examining the `okta.debug_context.debug_data.risk_behaviors` and `okta.debug_context.debug_data.flattened` fields.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- A user may be using a new device or location to sign in.
+- The Okta behavior detection may be incorrectly identifying a new authentication behavior and need adjusted.
+
+### Response and remediation:
+- If the user is legitimate and the authentication behavior is not suspicious, no action is required.
+- If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
+    - If MFA is already enabled, consider resetting MFA for the user.
+- If the user is not legitimate, consider deactivating the user's account.
+- If this is a false positive, consider adjusting the Okta behavior detection settings.
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.debug_context.debug_data.risk_behaviors:*
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
diff --git a/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc
new file mode 100644
index 0000000000..7dd2daeb8c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc
@@ -0,0 +1,102 @@
+[[new-okta-identity-provider-idp-added-by-admin]]
+=== New Okta Identity Provider (IdP) Added by Admin
+
+Detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating New Okta Identity Provider (IdP) Added by Admin
+
+This rule detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta.
+
+#### Possible investigation steps:
+- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Identify the IdP added by reviewing the `okta.target` field and determing if this IdP is authorized.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- It might be a false positive if the action was part of a planned activity or performed by an authorized person.
+- Several unsuccessful attempts prior to this success, may indicate an adversary attempting to add an unauthorized IdP multiple times.
+
+### Response and remediation:
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
+- If the actor is unauthorized, deactivate their account via the Okta console.
+- If the actor is authorized, ensure that the actor's account is not compromised.
+- Reset the user's password and enforce MFA re-enrollment, if applicable.
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "okta.system" and event.action: "system.idp.lifecycle.create" and okta.outcome.result: "SUCCESS"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Sub-technique:
+** Name: Hybrid Identity
+** ID: T1556.007
+** Reference URL: https://attack.mitre.org/techniques/T1556/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
index 0bce6b7629..08bed4efd2 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -60,8 +60,8 @@ Attackers can leverage systemd timers to run scripts, commands, or malicious sof
 This rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc
new file mode 100644
index 0000000000..87fdfdb2e6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc
@@ -0,0 +1,72 @@
+[[okta-fastpass-phishing-detection]]
+=== Okta FastPass Phishing Detection
+
+Detects when Okta FastPass prevents a user from authenticating to a phishing website.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://sec.okta.com/fastpassphishingdetection
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and event.category:authentication and 
+  okta.event_type:user.authentication.auth_via_mfa and event.outcome:failure and okta.outcome.reason:"FastPass declined phishing attempt"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
new file mode 100644
index 0000000000..b9ef3c91ec
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
@@ -0,0 +1,116 @@
+[[okta-sign-in-events-via-third-party-idp]]
+=== Okta Sign-In Events via Third-Party IdP
+
+Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Okta Sign-In Events via Third-Party IdP
+
+This rule detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
+
+Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain access to the tenant. Following this action, adversaries may attempt to sign in to the tenant using the unauthorized IdP. This rule detects both the addition of an unauthorized IdP and the subsequent sign-in attempt.
+
+#### Possible investigation steps:
+- Identify the third-party IdP by examining the `okta.authentication_context.issuer.id` field.
+- Once the third-party IdP is identified, determine if this IdP is authorized to be used by the tenant.
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields in historical data.
+    - The `New Okta Identity Provider (IdP) Added by Admin` rule may be helpful in identifying the actor and the IdP creation event.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- It might be a false positive if this IdP is authorized to be used by the tenant.
+- This may be a false positive if an authorized third-party IdP is used to sign in to the tenant but failures occurred due to an incorrect configuration.
+
+### Response and remediation:
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- Reset the effected user's password and enforce MFA re-enrollment, if applicable.
+- Mobile device forensics may be required to determine if the user's device is compromised.
+- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
+- If the actor is unauthorized, deactivate their account via the Okta console.
+- If the actor is authorized, ensure that the actor's account is not compromised.
+
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.debug_context.debug_data.request_uri:/oauth2/v1/authorize/callback and
+    (not okta.authentication_context.issuer.id:Okta and event.action:(user.authentication.auth_via_IDP
+        or user.authentication.auth_via_inbound_SAML
+        or user.authentication.auth_via_mfa
+        or user.authentication.auth_via_social)
+        or event.action:user.session.start) or
+    (event.action:user.authentication.auth_via_IDP and okta.outcome.result:FAILURE
+        and okta.outcome.reason:("A SAML assert with the same ID has already been processed by Okta for a previous request"
+            or "Unable to match transformed username"
+            or "Unable to resolve IdP endpoint"
+            or "Unable to validate SAML Response"
+            or "Unable to validate incoming SAML Assertion"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Trusted Relationship
+** ID: T1199
+** Reference URL: https://attack.mitre.org/techniques/T1199/
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc
new file mode 100644
index 0000000000..b3066cb682
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc
@@ -0,0 +1,77 @@
+[[okta-user-sessions-started-from-different-geolocations]]
+=== Okta User Sessions Started from Different Geolocations
+
+Detects when a specific Okta actor has multiple sessions started from different geolocations.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.event_type:user.session.start and not okta.security_context.is_proxy:true
+    and okta.actor.id:* and client.geo.country_name:*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
index 3671a80098..4264265666 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies the creation or modification of a DirectoryService PlugIns (dsplug) f
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies the creation or modification of a DirectoryService PlugIns (dsplug) f
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
index 183e4a79eb..55b8f2a72c 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
@@ -7,7 +7,6 @@ An adversary can establish persistence by modifying an existing macOS dock prope
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ An adversary can establish persistence by modifying an existing macOS dock prope
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
index df9391463f..fae5f8d3c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
@@ -7,7 +7,6 @@ Detects modification of a Folder Action script. A Folder Action script is execut
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Detects modification of a Folder Action script. A Folder Action script is execut
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
index f69d065054..d3a51f8871 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
@@ -7,7 +7,6 @@ Identifies use of the Defaults command to install a login or logoff hook in MacO
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies use of the Defaults command to install a login or logoff hook in MacO
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index a130319e7d..186532176d 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -61,7 +61,7 @@ Windows Update Orchestrator Service is a DCOM service used by other components t
 This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index 1e9287dd59..7af520412b 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -57,7 +57,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
index 2922080426..c58963f440 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
@@ -7,7 +7,6 @@ Identifies attempts to add an account to the admin group via the command line. T
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies attempts to add an account to the admin group via the command line. T
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
index c1312f83e1..cd9b3bf642 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
@@ -58,7 +58,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 This rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
index 8b53911a47..50249c7210 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
@@ -58,7 +58,7 @@ Adversaries can abuse MSBuild to proxy the execution of malicious code. The inli
 This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index 68293a225f..f68e8b6c98 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -59,7 +59,7 @@ Attackers may try to unload minifilters to avoid protections such as malware det
 This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
index 31993c177b..438579ef8a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
@@ -7,7 +7,6 @@ Identifies attempts to create a local account that will be hidden from the macOS
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies attempts to create a local account that will be hidden from the macOS
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
index 94857b580e..fcc7871277 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
@@ -7,7 +7,6 @@ Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be
 * Tactic: Lateral Movement
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
index 03e0b52540..850295466a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -57,8 +57,8 @@ Attackers may create new accounts with a UID of 0 to maintain root access to tar
 This rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 - Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
index aa244aadf5..d6031e1096 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
@@ -7,7 +7,6 @@ Identifies a high number (20) of macOS SSH KeyGen process executions from the sa
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies a high number (20) of macOS SSH KeyGen process executions from the sa
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
index 9179caabd7..5068efa8ab 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
@@ -7,7 +7,6 @@ Identifies the creation of a suspicious zip file prepended with special characte
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -34,7 +33,7 @@ Identifies the creation of a suspicious zip file prepended with special characte
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 739faeb31a..41e61857ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -61,7 +61,7 @@ More details can be found [here](https://attack.mitre.org/techniques/T1546/008/)
 This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..56c55a57e7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,112 @@
+[[potential-okta-mfa-bombing-via-push-notifications]]
+=== Potential Okta MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Okta MFA Bombing via Push Notifications
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+#### Possible investigation steps:
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+### False positive analysis:
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+### Response and remediation:
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [authentication where event.dataset == "okta.system"
+    and okta.event_type == "user.mfa.okta_verify.deny_push"] with runs=5
+  until [authentication where event.dataset == "okta.system"
+    and (okta.event_type: (
+      "user.authentication.sso",
+      "user.authentication.auth_via_mfa",
+      "user.authentication.verify",
+      "user.session.start") and okta.outcome.result == "SUCCESS")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
index 15f83e0169..daa3609083 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -61,8 +61,8 @@ Attackers can abuse files within the `/etc/init.d/` directory to run scripts, co
 This rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 #### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
index edf68172ab..5bfb97439e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
index 4af3ac8564..53ff1da635 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -61,8 +61,8 @@ There might still be users that use `rc.local` in a benign matter, so investigat
 Detection alerts from this rule indicate the creation of a new `/etc/rc.local` file. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
index bbbbfcb7ad..5871b85635 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies modifications to the Atom desktop text editor Init File. Adversaries
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -33,7 +32,7 @@ Identifies modifications to the Atom desktop text editor Init File. Adversaries
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
index 662031f671..163e0c1626 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
@@ -7,7 +7,6 @@ Identifies the creation or modification of the login window property list (plist
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies the creation or modification of the login window property list (plist
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
index 7cff26edc1..7bdcbfdb32 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
@@ -7,7 +7,6 @@ Identifies the creation or modification of the default configuration for periodi
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -34,7 +33,7 @@ Identifies the creation or modification of the default configuration for periodi
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
index 9e1e7ff086..51d459877f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
@@ -7,7 +7,6 @@ Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusin
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusin
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
index 1dd21b4973..b61b029626 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies the use of sqlite3 to directly modify the Transparency, Consent, and
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -34,7 +33,7 @@ Identifies the use of sqlite3 to directly modify the Transparency, Consent, and
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index 8c8e5170c6..fd91a52870 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -56,7 +56,7 @@ InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (
 This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
index 6c6caac0ce..1f6fd662aa 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -60,8 +60,8 @@ Adversaries may backdoor web servers with web shells to establish persistent acc
 This rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index bd93808e36..d10c0be5d7 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -59,7 +59,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..1e0215c5cf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,111 @@
+[[potentially-successful-mfa-bombing-via-push-notifications]]
+=== Potentially Successful MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+
+*Version*: 208
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Potential Abuse of Repeated MFA Push Notifications
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+#### Possible investigation steps:
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+### False positive analysis:
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+### Response and remediation:
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [authentication where event.dataset == "okta.system" and event.module == "okta"
+    and event.action == "user.mfa.okta_verify.deny_push"] with runs=3
+  [authentication where event.dataset == "okta.system" and event.module == "okta"
+    and (event.action : (
+      "user.authentication.sso",
+      "user.authentication.auth_via_mfa",
+      "user.authentication.verify",
+      "user.session.start") and okta.outcome.result == "SUCCESS")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index be972d7609..cb69764ac9 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -61,7 +61,7 @@ Although this is an interesting project for every developer and admin out there,
 Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index ff64e6e8f4..64bf6eea85 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -54,7 +54,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index efaf4e2a5e..3d228352ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -61,7 +61,7 @@ A named pipe is a type of inter-process communication (IPC) mechanism used in op
 Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
index f96040899c..7c60c25b08 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies modifications to the root crontab file. Adversaries may overwrite thi
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies modifications to the root crontab file. Adversaries may overwrite thi
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
index 8e7312530b..f6fb74bc47 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address against an account that contains the `admin` pattern on its name, which is likely a highly privileged account.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index b1af5f89fb..75ecf47165 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -57,7 +57,7 @@ CHM (Compiled HTML) files are a format for delivering online help files on Windo
 When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
index b65b3a198c..dd890fc837 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
@@ -53,7 +53,7 @@ Identifies a process termination event quickly followed by the deletion of its e
 This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc b/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
index d5238b5bce..c949d35951 100644
--- a/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
@@ -7,7 +7,6 @@ Identifies the use of osascript to execute scripts via standard input that may p
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies the use of osascript to execute scripts via standard input that may p
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index c009e9d658..7262c21df9 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -60,7 +60,7 @@ Attackers who add those DLLs to the registry locations can execute code with ele
 This rule identifies modifications on the AppInit registry keys.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index 6c02d92ed0..2e6a4b4267 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -21,8 +21,7 @@ Identifies the execution of a file that was created by the virtual system proces
 
 *References*: 
 
-* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html
-
+* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html
 
 *Tags*: 
 
@@ -55,7 +54,7 @@ Identifies the execution of a file that was created by the virtual system proces
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index 4bb5859c7a..ff398712fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 
 *References*: 
 
-* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html
+* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html
 
 *Tags*: 
 
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index 05df514c02..dfe8dea607 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index d3c70bf1a2..acac74bd1b 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -60,7 +60,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index 166bee16bb..09d833eba7 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -53,7 +53,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
index b906c4992e..f1986c081b 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
@@ -58,7 +58,7 @@ Attackers commonly use WSH scripts as their initial access method, acting like d
 This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
index 669050b325..ed7103c171 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
@@ -7,7 +7,6 @@ Detects use of the systemsetup command to enable remote SSH Login.
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -34,7 +33,7 @@ Detects use of the systemsetup command to enable remote SSH Login.
 * Tactic: Lateral Movement
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index 09b5ab4074..d3f55c6959 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -57,7 +57,7 @@ The Service Control Manager Remote Protocol is a client/server protocol used for
 This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index f027095e04..dacc01f6da 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -59,7 +59,7 @@ AutoIt is a scripting language and tool for automating tasks on Microsoft Window
 This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index c9458514d2..49720e5e84 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -55,7 +55,7 @@ Identifies the execution of a process with a single character process name, diff
 Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
index c21248093c..1859770477 100644
--- a/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
@@ -7,7 +7,6 @@ Identifies when a screensaver plist file is modified by an unexpected process. A
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies when a screensaver plist file is modified by an unexpected process. A
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index 8372f2b102..b0e73f7033 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -60,7 +60,7 @@ Windows services are background processes that run with SYSTEM privileges and pr
 The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc b/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
index bf1718d731..f9a1e48a38 100644
--- a/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of the shell process (sh) via scripting (JXA or AppleSc
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies the execution of the shell process (sh) via scripting (JXA or AppleSc
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
index 18b432cdef..cab0bea6b7 100644
--- a/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies changes to the SoftwareUpdate preferences using the built-in defaults
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies changes to the SoftwareUpdate preferences using the built-in defaults
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
index b1ebe743fc..acb1391391 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
@@ -54,7 +54,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for unsigned processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index 3188bce51c..08c9874ce3 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -52,7 +52,7 @@ Identifies run key or startup key registry modifications. In order to survive re
 Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index ee7ac26219..3954cc5342 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -59,7 +59,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule monitors for commonly abused processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
index ce5b1a01f5..972f258539 100644
--- a/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
@@ -7,7 +7,6 @@ Adversaries may create or modify the Sublime application plugins or scripts to e
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -32,7 +31,7 @@ Adversaries may create or modify the Sublime application plugins or scripts to e
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index 0584e66168..d80016736e 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -57,7 +57,7 @@ More details on SUNBURST can be found on the [Mandiant Report](https://www.mandi
 This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index b93883517d..0229d557e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -59,7 +59,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
index d13bd84120..eccefc2cc6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of the Automator Workflows process followed by a networ
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -32,7 +31,7 @@ Identifies the execution of the Automator Workflows process followed by a networ
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
index 5234412593..e3a5ba608e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
@@ -33,7 +33,7 @@ Identifies the execution of a suspicious browser child process. Adversaries may
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
index 0c8c95b641..d72f20f851 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
@@ -8,7 +8,6 @@ Identifies suspicious modifications of the calendar file by an unusual process.
 *Rule indices*: 
 
 * logs-endpoint.events.*
-* auditbeat-*
 
 *Severity*: medium
 
@@ -34,7 +33,7 @@ Identifies suspicious modifications of the calendar file by an unusual process.
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 996fe2b255..8c2af43abe 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -63,7 +63,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
index a1e087cfd8..a56d913eef 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
@@ -7,7 +7,6 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
index ebce6a750a..b48c3e056a 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
@@ -32,7 +32,7 @@ Identifies attempts to create or modify a crontab via a process that is not cron
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
index 91f427628b..d3548d5a56 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
@@ -31,7 +31,7 @@ Identifies the execution of a suspicious child process of the Event Monitor Daem
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
index b1b47f175d..1bafabc4c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of a launchd child process with a hidden file. An adver
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -35,7 +34,7 @@ Identifies the execution of a launchd child process with a hidden file. An adver
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
index 431b14228b..e603574594 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 * Tactic: Initial Access
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc
index c8d9e5c06d..25b4aebcf6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc
@@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i
 
 *References*: 
 
-* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
+* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
 
 *Tags*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
index a23ca61819..50656aebba 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -57,7 +57,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
index bd4fb4efe0..9f04dc78d7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
@@ -57,7 +57,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk, bypassing file-based security protections. These executables are generally base64 encoded.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index b0e8c572b4..e05c664697 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -60,7 +60,7 @@ Print Spooler is a Windows service enabled by default in all Windows clients and
 The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
index 44560125be..864b44ad30 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
@@ -60,7 +60,7 @@ More context and technical details can be found in this [research blog](https://
 This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
index d092956595..b98da4abc4 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
index 16522d71cf..e35d92a8d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -54,7 +54,7 @@ Attackers may create new services to execute system shells and other command exe
 This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 #### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index aa0f392c76..3130d9bf69 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -54,7 +54,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
index 7bcd5c82c1..910d68b205 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
@@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt
 * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/
 * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/
 * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx
-* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/
+* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/
 
 *Tags*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index 5305137091..c0be577a87 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -58,7 +58,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index 52abdc715f..205ba817a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -57,7 +57,7 @@ The Service Host process (SvcHost) is a system process that can host one, or mul
 This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index b70123c89d..710b4d85a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -58,7 +58,7 @@ Attackers may configure existing services or create new ones to execute system s
 This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
index 02d1e78bbc..3c4b2622fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
@@ -7,7 +7,6 @@ Keychains are the built-in way for macOS to keep track of users' passwords and c
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -32,7 +31,7 @@ Keychains are the built-in way for macOS to keep track of users' passwords and c
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
index b2e846ff2f..8fe690c214 100644
--- a/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
@@ -7,7 +7,6 @@ Identifies the use of the mount_apfs command to mount the entire file system thr
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: high
@@ -33,7 +32,7 @@ Identifies the use of the mount_apfs command to mount the entire file system thr
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index 2eec74aba1..54ccecc553 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index 3df13e1107..e9b6c3e815 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index e5c7e6375b..a192c396eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index 269d00042c..4d010fb5c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index 771ca933ba..4e84059ef6 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -62,7 +62,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index 3894575b12..4b38619b58 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -62,7 +62,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc b/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
index 04a3f3c500..0ccbd393d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
@@ -7,7 +7,6 @@ Identifies when a child process is spawned by the screensaver engine process, wh
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies when a child process is spawned by the screensaver engine process, wh
 * Tactic: Persistence
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index 6eaa986b59..9855c78342 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -58,7 +58,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index a87a6ad71e..2934e48e10 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -58,7 +58,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index c90ae1b321..483e902481 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -57,7 +57,7 @@ The regular data stream, also referred to as the unnamed data stream since the n
 Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index aaca916e2d..2591057913 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -55,7 +55,7 @@ Attackers can abuse certain trusted developer utilities to proxy the execution o
 This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index aaaf8c70ed..af2967f18d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -60,7 +60,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule uses this information to spot suspicious parent and child processes.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
index 1b251b68e7..34abeeac97 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
index 91127778dd..76924a3398 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
@@ -7,7 +7,6 @@ Identifies the execution of macOS built-in commands to connect to an existing Vi
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -34,7 +33,7 @@ Identifies the execution of macOS built-in commands to connect to an existing Vi
 * Tactic: Lateral Movement
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
index ebf60315f5..d615bf3239 100644
--- a/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
@@ -7,7 +7,6 @@ Identifies the use of the built-in networksetup command to configure webproxy se
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies the use of the built-in networksetup command to configure webproxy se
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index c3549a83a3..730b2c5360 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -61,7 +61,7 @@ Netsh is a Windows command line tool used for network configuration and troubles
 This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index 991096b4a8..5f9deb036a 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -95,3 +95,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-10-4/prebuilt-rules-8
 include::detections/prebuilt-rules/downloadable-packages/8-10-5/prebuilt-rules-8-10-5-appendix.asciidoc[]
 
 include::detections/prebuilt-rules/downloadable-packages/8-10-6/prebuilt-rules-8-10-6-appendix.asciidoc[]
+
+include::detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rules-8-10-7-appendix.asciidoc[]

From 2ccf8b37e17c332898dd210d2877a4f7122b6945 Mon Sep 17 00:00:00 2001
From: eric-forte-elastic <eric.forte@elastic.co>
Date: Tue, 28 Nov 2023 16:06:38 -0500
Subject: [PATCH 2/2] Updated links and message

---
 ...ilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc | 2 +-
 ...uilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc | 2 +-
 .../prebuilt-rules-downloadable-updates.asciidoc             | 5 ++++-
 .../adding-hidden-file-attribute-via-attrib.asciidoc         | 2 +-
 .../rule-details/adobe-hijack-persistence.asciidoc           | 2 +-
 .../anomalous-process-for-a-windows-population.asciidoc      | 2 +-
 .../rule-details/anomalous-windows-process-creation.asciidoc | 2 +-
 .../rule-details/bypass-uac-via-event-viewer.asciidoc        | 2 +-
 ...gning-policy-modification-through-built-in-tools.asciidoc | 2 +-
 ...ode-signing-policy-modification-through-registry.asciidoc | 2 +-
 .../rule-details/command-prompt-network-connection.asciidoc  | 2 +-
 .../connection-to-commonly-abused-web-services.asciidoc      | 2 +-
 .../rule-details/direct-outbound-smb-connection.asciidoc     | 2 +-
 ...numeration-of-privileged-local-groups-membership.asciidoc | 2 +-
 .../execution-from-unusual-directory-command-line.asciidoc   | 2 +-
 ...een-aws-secret-value-accessed-in-secrets-manager.asciidoc | 2 +-
 .../rule-details/first-time-seen-driver-loaded.asciidoc      | 2 +-
 .../kerberos-traffic-from-unusual-process.asciidoc           | 2 +-
 .../rule-details/linux-group-creation.asciidoc               | 4 ++--
 .../rule-details/linux-user-account-creation.asciidoc        | 4 ++--
 .../linux-user-added-to-privileged-group.asciidoc            | 4 ++--
 .../rule-details/lsass-memory-dump-creation.asciidoc         | 2 +-
 .../rule-details/lsass-memory-dump-handle-access.asciidoc    | 2 +-
 .../microsoft-build-engine-using-an-alternate-name.asciidoc  | 2 +-
 .../rule-details/msbuild-making-network-connections.asciidoc | 2 +-
 ...multiple-logon-failure-followed-by-logon-success.asciidoc | 2 +-
 ...tiple-logon-failure-from-the-same-source-address.asciidoc | 2 +-
 .../rule-details/network-connection-via-certutil.asciidoc    | 2 +-
 .../network-connection-via-compiled-html-file.asciidoc       | 2 +-
 .../network-connection-via-registration-utility.asciidoc     | 2 +-
 .../network-connection-via-signed-binary.asciidoc            | 2 +-
 .../rule-details/new-systemd-timer-created.asciidoc          | 4 ++--
 ...rsistence-via-update-orchestrator-service-hijack.asciidoc | 2 +-
 .../persistent-scripts-in-the-startup-directory.asciidoc     | 2 +-
 ...antimalware-scan-interface-bypass-via-powershell.asciidoc | 2 +-
 ...-credential-access-via-trusted-developer-utility.asciidoc | 2 +-
 .../potential-evasion-via-filter-manager.asciidoc            | 2 +-
 .../potential-linux-backdoor-user-account-creation.asciidoc  | 4 ++--
 ...potential-modification-of-accessibility-binaries.asciidoc | 2 +-
 .../potential-persistence-through-init-d-detected.asciidoc   | 4 ++--
 ...-persistence-through-motd-file-creation-detected.asciidoc | 4 ++--
 ...tential-persistence-through-run-control-detected.asciidoc | 4 ++--
 ...l-privilege-escalation-via-installerfiletakeover.asciidoc | 2 +-
 .../potential-remote-code-execution-via-web-server.asciidoc  | 4 ++--
 .../potential-windows-error-manager-masquerading.asciidoc    | 2 +-
 .../rule-details/powershell-psreflect-script.asciidoc        | 2 +-
 ...rshell-suspicious-payload-encoded-and-compressed.asciidoc | 2 +-
 ...rivilege-escalation-via-named-pipe-impersonation.asciidoc | 2 +-
 .../rule-details/privileged-account-brute-force.asciidoc     | 2 +-
 .../process-activity-via-compiled-html-file.asciidoc         | 2 +-
 .../process-termination-followed-by-deletion.asciidoc        | 2 +-
 .../registry-persistence-via-appinit-dll.asciidoc            | 2 +-
 .../rule-details/remote-execution-via-file-shares.asciidoc   | 2 +-
 .../rule-details/remote-file-copy-via-teamviewer.asciidoc    | 2 +-
 ...mote-file-download-via-desktopimgdownldr-utility.asciidoc | 2 +-
 .../rule-details/remote-file-download-via-mpcmdrun.asciidoc  | 2 +-
 .../remote-file-download-via-powershell.asciidoc             | 2 +-
 .../remote-file-download-via-script-interpreter.asciidoc     | 2 +-
 .../rule-details/remotely-started-services-via-rpc.asciidoc  | 2 +-
 .../rule-details/renamed-autoit-scripts-interpreter.asciidoc | 2 +-
 ...renamed-utility-executed-with-short-program-name.asciidoc | 2 +-
 .../service-control-spawned-via-script-interpreter.asciidoc  | 2 +-
 .../startup-folder-persistence-via-unsigned-process.asciidoc | 2 +-
 .../startup-or-run-key-registry-modification.asciidoc        | 2 +-
 .../startup-persistence-by-a-suspicious-process.asciidoc     | 2 +-
 .../sunburst-command-and-control-activity.asciidoc           | 2 +-
 .../suspicious-antimalware-scan-interface-dll.asciidoc       | 2 +-
 .../rule-details/suspicious-certutil-commands.asciidoc       | 2 +-
 .../suspicious-net-reflection-via-powershell.asciidoc        | 2 +-
 ...portable-executable-encoded-in-powershell-script.asciidoc | 2 +-
 .../suspicious-print-spooler-spl-file-created.asciidoc       | 2 +-
 ...suspicious-process-access-via-direct-system-call.asciidoc | 2 +-
 .../suspicious-process-spawned-from-motd-detected.asciidoc   | 4 ++--
 .../suspicious-service-was-installed-in-the-system.asciidoc  | 2 +-
 .../suspicious-startup-shell-folder-modification.asciidoc    | 2 +-
 .../rule-details/suspicious-zoom-child-process.asciidoc      | 2 +-
 .../rule-details/svchost-spawning-cmd.asciidoc               | 2 +-
 .../rule-details/system-shells-via-services.asciidoc         | 2 +-
 .../rule-details/threat-intel-hash-indicator-match.asciidoc  | 2 +-
 .../threat-intel-ip-address-indicator-match.asciidoc         | 2 +-
 .../rule-details/threat-intel-url-indicator-match.asciidoc   | 2 +-
 .../threat-intel-windows-registry-indicator-match.asciidoc   | 2 +-
 ...ypass-attempt-via-windows-directory-masquerading.asciidoc | 2 +-
 .../uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc  | 2 +-
 .../rule-details/untrusted-driver-loaded.asciidoc            | 2 +-
 ...table-file-creation-by-a-system-critical-process.asciidoc | 2 +-
 .../unusual-file-creation-alternate-data-stream.asciidoc     | 2 +-
 ...al-network-activity-from-a-windows-system-binary.asciidoc | 2 +-
 .../rule-details/unusual-parent-child-relationship.asciidoc  | 2 +-
 .../rule-details/unusual-process-for-a-windows-host.asciidoc | 2 +-
 .../wireless-credential-dumping-using-netsh-command.asciidoc | 2 +-
 91 files changed, 104 insertions(+), 101 deletions(-)

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc
index 52296d9b6a..412e600c8c 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-execution-via-file-shares.asciidoc
@@ -54,7 +54,7 @@ Identifies the execution of a file that was created by the virtual system proces
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc
index 9804e8ca36..b3935551a9 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-10-7/prebuilt-rule-8-10-7-remote-file-copy-via-teamviewer.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 01ead4e834..5ec513508b 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -14,7 +14,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 
 
 |<<prebuilt-rule-8-10-7-prebuilt-rules-8-10-7-summary, 8.10.7>> | 28 Nov 2023 | 11 | 68 | 
-Update Status Message
+This release includes new rules for Okta and Windows.
+New rules for Okta include anomalous authentication events into the admin console and 3rd party applications.
+The new rule for Windows checks for the first time one has seen a NewCredentials logon process.
+Additionally included is a tunning for an Okta rule detecting MFA bombing via push notifications.
 
 
 |<<prebuilt-rule-8-10-6-prebuilt-rules-8-10-6-summary, 8.10.6>> | 14 Nov 2023 | 2 | 366 |
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index 05da3d6dc3..f025155d26 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -60,7 +60,7 @@ Attackers can use this attribute to conceal tooling and malware to prevent admin
 This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index 15db086975..e8b01c4848 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -57,7 +57,7 @@ Detects writing executable files that will be automatically launched by Adobe on
 Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
index 523c717875..5132d58f73 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
index 8c469ccbbf..95462ceaba 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index 16c8a1ff37..f0e66d7a9c 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -60,7 +60,7 @@ For more information about the UAC and how it works, check the [official Microso
 During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
index 43830021d5..42482b5b4b 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining the security of the system. However
 This rule identifies commands that can disable the Driver Signature Enforcement feature.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
index f994e8d1b2..65a4f14022 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies registry modifications that can disable DSE.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
index 6a5670a1ff..7346f6e552 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
@@ -57,7 +57,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 This rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index 2e52c55f1a..12c2615423 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -53,7 +53,7 @@ Adversaries may use an existing, legitimate external Web service as a means for
 This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
index aeccb46039..c1474f52dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
@@ -53,7 +53,7 @@ Identifies unexpected processes making network connections over port 445. Window
 This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index a8ded2d769..d97006cf60 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -54,7 +54,7 @@ After successfully compromising an environment, attackers may try to gain situat
 This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index dd55e83547..f9d31323fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -56,7 +56,7 @@ Identifies process execution from suspicious default Windows directories. This m
 This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
index eb5736f7e8..bf58ea2539 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
@@ -54,7 +54,7 @@ An adversary equipped with compromised credentials may attempt to access the sec
 
 AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.
 
-This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a [New Terms](https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a {security-guide}/security/master/rules-ui-create.html#create-new-terms-rule[New Terms] rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
index eec6aec376..995a424d7f 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -60,7 +60,7 @@ Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elast
 This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index 751e60773a..9590a1cf5e 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -53,7 +53,7 @@ Kerberos is the default authentication protocol in Active Directory, designed to
 Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index 43fd88aab6..c29e4d1aab 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new groups to maintain access to victim systems or escalate
 This rule identifies the usages of `groupadd` and `addgroup` to create new groups.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index 0aed48d8c8..e3faf3076b 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new accounts (both local and domain) to maintain access to
 This rule identifies the usage of `useradd` and `adduser` to create new accounts.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
index b21d549950..8bd1b4d32c 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -57,8 +57,8 @@ Attackers may add users to a privileged group in order to escalate privileges or
 This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index 2ed109fc73..6e0692172d 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -60,7 +60,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index 55ae38e01f..efd15d1093 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -61,7 +61,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 90b2bfa024..5ecbbe23a5 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -60,7 +60,7 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
index af2e186a5b..ba3355465e 100644
--- a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
@@ -57,7 +57,7 @@ The Microsoft Build Engine, also known as MSBuild, is a platform for building ap
 This rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
index 11bc1414e6..d9ced56709 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address, followed by a successful logon, indicating that an attacker potentially successfully compromised the account.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
index d6d1348b2e..e70da27de6 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
@@ -59,7 +59,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
index 7408e4fa3b..e4e32acb2e 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
@@ -58,7 +58,7 @@ Attackers can abuse `certutil.exe` to download malware, offensive security tools
 This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
index cd340a5b30..79e0f98665 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
@@ -59,7 +59,7 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 This rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
index c8fa391314..aa8caba6a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
@@ -58,7 +58,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
index acd33d6ddb..a6c46ab537 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries (such as process trees, com
 This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
index 08bed4efd2..0bce6b7629 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -60,8 +60,8 @@ Attackers can leverage systemd timers to run scripts, commands, or malicious sof
 This rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index 186532176d..a130319e7d 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -61,7 +61,7 @@ Windows Update Orchestrator Service is a DCOM service used by other components t
 This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index 7af520412b..1e9287dd59 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -57,7 +57,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
index cd9b3bf642..c1312f83e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
@@ -58,7 +58,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 This rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
index 50249c7210..8b53911a47 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
@@ -58,7 +58,7 @@ Adversaries can abuse MSBuild to proxy the execution of malicious code. The inli
 This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index f68e8b6c98..68293a225f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -59,7 +59,7 @@ Attackers may try to unload minifilters to avoid protections such as malware det
 This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
index 850295466a..03e0b52540 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -57,8 +57,8 @@ Attackers may create new accounts with a UID of 0 to maintain root access to tar
 This rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. 
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 - Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 41e61857ff..739faeb31a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -61,7 +61,7 @@ More details can be found [here](https://attack.mitre.org/techniques/T1546/008/)
 This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
index daa3609083..15f83e0169 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -61,8 +61,8 @@ Attackers can abuse files within the `/etc/init.d/` directory to run scripts, co
 This rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 #### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
index 5bfb97439e..edf68172ab 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
index 53ff1da635..4af3ac8564 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -61,8 +61,8 @@ There might still be users that use `rc.local` in a benign matter, so investigat
 Detection alerts from this rule indicate the creation of a new `/etc/rc.local` file. 
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index fd91a52870..8c8e5170c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -56,7 +56,7 @@ InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (
 This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
index 1f6fd662aa..6c6caac0ce 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -60,8 +60,8 @@ Adversaries may backdoor web servers with web shells to establish persistent acc
 This rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index d10c0be5d7..bd93808e36 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -59,7 +59,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index cb69764ac9..be972d7609 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -61,7 +61,7 @@ Although this is an interesting project for every developer and admin out there,
 Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index 64bf6eea85..ff64e6e8f4 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -54,7 +54,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index 3d228352ff..efaf4e2a5e 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -61,7 +61,7 @@ A named pipe is a type of inter-process communication (IPC) mechanism used in op
 Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
index f6fb74bc47..8e7312530b 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address against an account that contains the `admin` pattern on its name, which is likely a highly privileged account.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index 75ecf47165..b1af5f89fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -57,7 +57,7 @@ CHM (Compiled HTML) files are a format for delivering online help files on Windo
 When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
index dd890fc837..b65b3a198c 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
@@ -53,7 +53,7 @@ Identifies a process termination event quickly followed by the deletion of its e
 This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index 7262c21df9..c009e9d658 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -60,7 +60,7 @@ Attackers who add those DLLs to the registry locations can execute code with ele
 This rule identifies modifications on the AppInit registry keys.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index 2e6a4b4267..ebb6976e60 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -54,7 +54,7 @@ Identifies the execution of a file that was created by the virtual system proces
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index ff398712fe..d1d1984118 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index dfe8dea607..05df514c02 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index acac74bd1b..d3c70bf1a2 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -60,7 +60,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index 09d833eba7..166bee16bb 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -53,7 +53,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
index f1986c081b..b906c4992e 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
@@ -58,7 +58,7 @@ Attackers commonly use WSH scripts as their initial access method, acting like d
 This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index d3f55c6959..09b5ab4074 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -57,7 +57,7 @@ The Service Control Manager Remote Protocol is a client/server protocol used for
 This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index dacc01f6da..f027095e04 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -59,7 +59,7 @@ AutoIt is a scripting language and tool for automating tasks on Microsoft Window
 This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index 49720e5e84..c9458514d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -55,7 +55,7 @@ Identifies the execution of a process with a single character process name, diff
 Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index b0e73f7033..8372f2b102 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -60,7 +60,7 @@ Windows services are background processes that run with SYSTEM privileges and pr
 The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
index acb1391391..b1ebe743fc 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
@@ -54,7 +54,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for unsigned processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index 08c9874ce3..3188bce51c 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -52,7 +52,7 @@ Identifies run key or startup key registry modifications. In order to survive re
 Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index 3954cc5342..ee7ac26219 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -59,7 +59,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule monitors for commonly abused processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index d80016736e..0584e66168 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -57,7 +57,7 @@ More details on SUNBURST can be found on the [Mandiant Report](https://www.mandi
 This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index 0229d557e7..b93883517d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -59,7 +59,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 8c2af43abe..996fe2b255 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -63,7 +63,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
index 50656aebba..a23ca61819 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -57,7 +57,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
index 9f04dc78d7..bd4fb4efe0 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
@@ -57,7 +57,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk, bypassing file-based security protections. These executables are generally base64 encoded.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index e05c664697..b0e8c572b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -60,7 +60,7 @@ Print Spooler is a Windows service enabled by default in all Windows clients and
 The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
index 864b44ad30..44560125be 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
@@ -60,7 +60,7 @@ More context and technical details can be found in this [research blog](https://
 This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
index b98da4abc4..d092956595 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. 
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
index e35d92a8d9..16522d71cf 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -54,7 +54,7 @@ Attackers may create new services to execute system shells and other command exe
 This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 #### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index 3130d9bf69..aa0f392c76 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -54,7 +54,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index c0be577a87..5305137091 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -58,7 +58,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index 205ba817a3..52abdc715f 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -57,7 +57,7 @@ The Service Host process (SvcHost) is a system process that can host one, or mul
 This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index 710b4d85a8..b70123c89d 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -58,7 +58,7 @@ Attackers may configure existing services or create new ones to execute system s
 This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index 54ccecc553..2eec74aba1 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index e9b6c3e815..3df13e1107 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index a192c396eb..e5c7e6375b 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index 4d010fb5c8..269d00042c 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index 4e84059ef6..771ca933ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -62,7 +62,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index 4b38619b58..3894575b12 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -62,7 +62,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index 9855c78342..6eaa986b59 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -58,7 +58,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index 2934e48e10..a87a6ad71e 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -58,7 +58,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index 483e902481..c90ae1b321 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -57,7 +57,7 @@ The regular data stream, also referred to as the unnamed data stream since the n
 Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index 2591057913..aaca916e2d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -55,7 +55,7 @@ Attackers can abuse certain trusted developer utilities to proxy the execution o
 This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index af2967f18d..aaaf8c70ed 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -60,7 +60,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule uses this information to spot suspicious parent and child processes.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
index 34abeeac97..1b251b68e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index 730b2c5360..c3549a83a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -61,7 +61,7 @@ Netsh is a Windows command line tool used for network configuration and troubles
 This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps