Generate docs for prebuilt-rules 7.11 release (#477)

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

Author: brokensound77

docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc

@@ -7,6 +7,185 @@ The following lists prebuilt rule updates per release. Only rules with
 significant modifications to their query or scope are listed. For detailed
 information about a rule's changes, see the rule's description page.
 
+[float]
+=== 7.11.0
+
+<<attempt-to-modify-an-okta-network-zone>>
+
+<<attempt-to-modify-an-okta-policy-rule>>
+
+<<azure-automation-account-created>>
+
+<<azure-automation-runbook-created-or-modified>>
+
+<<azure-automation-runbook-deleted>>
+
+<<azure-automation-webhook-created>>
+
+<<azure-blob-container-access-level-modification>>
+
+<<azure-command-execution-on-virtual-machine>>
+
+<<azure-conditional-access-policy-modified>>
+
+<<azure-diagnostic-settings-deletion>>
+
+<<azure-event-hub-authorization-rule-created-or-updated>>
+
+<<azure-event-hub-deletion>>
+
+<<azure-external-guest-user-invitation>>
+
+<<azure-firewall-policy-deletion>>
+
+<<azure-global-administrator-role-addition-to-pim-user>>
+
+<<azure-key-vault-modified>>
+
+<<azure-network-watcher-deletion>>
+
+<<azure-privilege-identity-management-role-modified>>
+
+<<azure-resource-group-deletion>>
+
+<<azure-storage-account-key-regenerated>>
+
+<<clearing-windows-event-logs>>
+
+<<dns-activity-to-the-internet>>
+
+<<ftp-file-transfer-protocol-activity-to-the-internet>>
+
+<<gcp-firewall-rule-creation>>
+
+<<gcp-firewall-rule-deletion>>
+
+<<gcp-firewall-rule-modification>>
+
+<<gcp-iam-custom-role-creation>>
+
+<<gcp-iam-role-deletion>>
+
+<<gcp-iam-service-account-key-deletion>>
+
+<<gcp-logging-bucket-deletion>>
+
+<<gcp-logging-sink-deletion>>
+
+<<gcp-logging-sink-modification>>
+
+<<gcp-pub-sub-subscription-creation>>
+
+<<gcp-pub-sub-subscription-deletion>>
+
+<<gcp-pub-sub-topic-creation>>
+
+<<gcp-pub-sub-topic-deletion>>
+
+<<gcp-service-account-creation>>
+
+<<gcp-service-account-deletion>>
+
+<<gcp-service-account-disabled>>
+
+<<gcp-service-account-key-creation>>
+
+<<gcp-storage-bucket-configuration-modification>>
+
+<<gcp-storage-bucket-deletion>>
+
+<<gcp-storage-bucket-permissions-modification>>
+
+<<gcp-virtual-private-cloud-network-deletion>>
+
+<<gcp-virtual-private-cloud-route-creation>>
+
+<<gcp-virtual-private-cloud-route-deletion>>
+
+<<iis-http-logging-disabled>>
+
+<<irc-internet-relay-chat-protocol-activity-to-the-internet>>
+
+<<microsoft-build-engine-loading-windows-credential-libraries>>
+
+<<microsoft-build-engine-using-an-alternate-name>>
+
+<<microsoft-iis-connection-strings-decryption>>
+
+<<microsoft-iis-service-account-password-dumped>>
+
+<<multi-factor-authentication-disabled-for-an-azure-user>>
+
+<<persistence-via-telemetrycontroller-scheduled-task-hijack>>
+
+<<possible-consent-grant-attack-via-azure-registered-application>>
+
+<<potential-dll-sideloading-via-trusted-microsoft-programs>>
+
+<<potential-modification-of-accessibility-binaries>>
+
+<<potential-secure-file-deletion-via-sdelete-utility>>
+
+<<potential-windows-error-manager-masquerading>>
+
+<<proxy-port-activity-to-the-internet>>
+
+<<rdp-remote-desktop-protocol-from-the-internet>>
+
+<<rdp-remote-desktop-protocol-to-the-internet>>
+
+<<rpc-remote-procedure-call-from-the-internet>>
+
+<<rpc-remote-procedure-call-to-the-internet>>
+
+<<remote-file-download-via-desktopimgdownldr-utility>>
+
+<<remote-file-download-via-mpcmdrun>>
+
+<<renamed-autoit-scripts-interpreter>>
+
+<<smb-windows-file-sharing-activity-to-the-internet>>
+
+<<smtp-to-the-internet>>
+
+<<sql-traffic-to-the-internet>>
+
+<<ssh-secure-shell-from-the-internet>>
+
+<<ssh-secure-shell-to-the-internet>>
+
+<<suspicious-.net-code-compilation>>
+
+<<suspicious-endpoint-security-parent-process>>
+
+<<suspicious-ms-office-child-process>>
+
+<<suspicious-process-execution-via-renamed-psexec-executable>>
+
+<<suspicious-zoom-child-process>>
+
+<<tcp-port-8000-activity-to-the-internet>>
+
+<<tor-activity-to-the-internet>>
+
+<<uac-bypass-via-diskcleanup-scheduled-task-hijack>>
+
+<<unusual-child-processes-of-rundll32>>
+
+<<unusual-file-modification-by-dns.exe>>
+
+<<unusual-network-connection-via-rundll32>>
+
+<<unusual-parent-child-relationship>>
+
+<<user-added-as-owner-for-azure-application>>
+
+<<user-added-as-owner-for-azure-service-principal>>
+
+<<vnc-virtual-network-computing-from-the-internet>>
+
+<<vnc-virtual-network-computing-to-the-internet>>
+
 [float]
 === 7.10.0
 
@@ -24,25 +203,25 @@ information about a rule's changes, see the rule's description page.
 
 <<aws-waf-rule-or-rule-group-deletion>>
 
-<<administrator-privileges-assigned-to-okta-group>>
+<<administrator-privileges-assigned-to-an-okta-group>>
 
 <<attempt-to-create-okta-api-token>>
 
-<<attempt-to-deactivate-mfa-for-okta-user-account>>
+<<attempt-to-deactivate-mfa-for-an-okta-user-account>>
 
-<<attempt-to-deactivate-okta-mfa-rule>>
+<<attempt-to-deactivate-an-okta-policy>>
 
-<<attempt-to-deactivate-okta-policy>>
+<<attempt-to-deactivate-an-okta-policy-rule>>
 
-<<attempt-to-delete-okta-policy>>
+<<attempt-to-delete-an-okta-policy>>
 
-<<attempt-to-modify-okta-mfa-rule>>
+<<attempt-to-modify-an-okta-network-zone>>
 
-<<attempt-to-modify-okta-network-zone>>
+<<attempt-to-modify-an-okta-policy>>
 
-<<attempt-to-modify-okta-policy>>
+<<attempt-to-modify-an-okta-policy-rule>>
 
-<<attempt-to-reset-mfa-factors-for-okta-user-account>>
+<<attempt-to-reset-mfa-factors-for-an-okta-user-account>>
 
 <<attempt-to-revoke-okta-api-token>>