<html lang="en">
<body>

<p>
    <b>[OOTB] XDR package - ENG. Version 4</b><br>
	Change list:<br>
		Rules were updated:
	<ul>
		<li>Rule R451_16: Selector was revised</li>
		<li>Rule R452_06: Selector was revised</li>
	</ul>
</p>

<p>
    <b>[OOTB] XDR package - ENG. Version 3</b><br>
	Change list:<br>
	New rules were added:
	<ul>
		<li>Rules R450_44-R450_69: rules based on KEDR telemetry</li>
		<li>Rules R451_16, R451_18: ADCS attacks</li>
		<li>Rules R452: AD attack</li>
	</ul>
	Rules were updated:
	<ul>
		<li>Rule R450_22: Selector was revised</li>
		<li>Rule R451_01: Condition was improved</li>
	</ul>
	Other changes:
	<ul>
		<li>Minor typos were fixed</li>
	</ul>
</p>

<p>
    <b>[OOTB] XDR package - ENG. Version 2</b><br>
	Change list:<br>
	New rules were added:
	<ul>
		<li>Rules R451: attacks on AD CS</li>
		<li>Rules R450_20, R450_21, R450_29, R450_39, R450_40, R450_42, R450_43: account manipulation</li>
		<li>Rules R450_22, R450_27, R450_28: hiding scheduled task</li>
		<li>Rule R450_24: DCSync</li>
		<li>Rules R450_25, R450_26, R450_30, R450_31, R450_32, R450_37: possible lateral movement</li>
		<li>Rules R450_35, R450_36: pass-the-hash</li>
		<li>Rule R450_41: golden ticket</li>
	</ul>
	Rules were updated:
	<ul>
		<li>Rules R450_01: Selector was revised</li>
	</ul>
	Other changes:
	<ul>
		<li>Minor typos were fixed</li>
		<li>Filter 'Windows system account' was fixed and renamed to 'DestinationUserName is Windows system account'</li>
	</ul>
</p>
  
<p>
    <b>[OOTB] XDR package - ENG. Version 1</b><br>
	This is the first version of the package.
</p>

</body>
</html>