Skip to content

Pull requests: elastic/detection-rules

New pull request New
45 Open 3,405 Closed
45 Open 3,405 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[New Rule] Potential SSH Password Grabbing via strace backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#5294 opened Nov 10, 2025 by Aegrah Loading…
@Aegrah
2
[Rule Tuning] Microsoft 365 Global Administrator Role Assigned backport: auto Domain: Cloud Domain: Identity Domain: SaaS Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
#5293 opened Nov 8, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
2
[Rule Tunings] AWS Cloudtrail Created/Updated/Suspended/Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5292 opened Nov 7, 2025 by imays11 Loading…
@imays11
1
[Rule Tuning] Rapid Secret Retrieval Attempts from AWS SecretsManager backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5291 opened Nov 7, 2025 by imays11 Loading…
@imays11
2
[Tuning] Outbound Scheduled Task Activity via PowerShell backport: auto bug Something isn't working Domain: Endpoint Integration: Windows OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5287 opened Nov 6, 2025 by Samirbous Loading…
2
[Rule Tuning] AWS EC2 Instance Console Login via Assumed Role backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5285 opened Nov 5, 2025 by imays11 Loading…
@imays11
2
[Rule Tuning] AWS IAM SAML Provider Updated backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5284 opened Nov 5, 2025 by imays11 Loading…
@imays11
1
[Rule Tuning] AWS IAM Brute Force of Assume Role Policy backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5282 opened Nov 4, 2025 by imays11 Loading…
@imays11
2
[Rule Tuning] AWS IAM CompromisedKeyQuarantine Policy Attached to User backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5281 opened Nov 4, 2025 by imays11 Loading…
@imays11
1
MITRE ATT&CK Sub-Technique Update - Solves Issue #5279 backport: auto community Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5280 opened Nov 4, 2025 by veritasr3x Loading…
2 tasks done
2
[Rule Tunings] AWS IAM Virtual MFA Device Rules backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5275 opened Nov 3, 2025 by imays11 Loading…
@imays11
1
[Rule Tuning] AWS GetSessionToken Abuse backport: auto bbr Building Block Rules Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5274 opened Nov 3, 2025 by imays11 Loading…
@imays11
1
rule-tuning: Elastic Agent service termination improve for detection backport: auto community Domain: Endpoint Rule: Tuning tweaking or tuning an existing rule
#5272 opened Nov 3, 2025 by alstolten Loading…
1
@Aegrah
3
[Rule Tunings] AWS Group Creation, User Added to Group, Group Deletion backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5269 opened Oct 31, 2025 by imays11 Loading…
@imays11
2
[Rule Tuning] AWS S3 Bucket Configuration Deletion backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5265 opened Oct 29, 2025 by imays11 Loading…
@imays11
1
Renovate Updates backport: auto enhancement New feature or request patch
#5258 opened Oct 28, 2025 by shashank-elastic Loading…
5 tasks
@shashank-elastic
2
Update dependency requests to ~=2.32.5 backport: auto community
#5257 opened Oct 28, 2025 by elastic-renovate-prod bot Loading…
1 task
[Bug] [DAC] Auto Gen Schema Fails on Certain Subqueries backport: auto bug Something isn't working patch python Internal python for the repository schema
#5256 opened Oct 28, 2025 by eric-forte-elastic Loading…
5 tasks
1
@eric-forte-elastic
6
[Rule Tuning] Azure Diagnostic Settings Deletion backport: auto Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#5253 opened Oct 27, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
1
[New Rule] Okta Multiple OS Names Detected for a Single DT Hash Domain: Identity Integration: Okta okta related rules Rule: New Proposal for new rule
#5241 opened Oct 22, 2025 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
6
[Rule Tunings] AWS Multiple API Calls ESQL rules backport: auto bbr Building Block Rules Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5238 opened Oct 21, 2025 by imays11 Loading…
@imays11
5
Update lateral_movement_scheduled_task_target.toml to fix null values backport: auto community Domain: Endpoint OS: Windows windows related rules
#5228 opened Oct 16, 2025 by theusername-sudo Loading…
@w0rk3r
1
[New Rule] File Creation with Curly Braces or Command Substitution backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#5219 opened Oct 14, 2025 by Aegrah Loading…
@Aegrah
5
[New Rule] Azure Compute Snapshot Deletion(s) backport: auto Domain: Cloud Domain: Data Domain: Storage Integration: Azure azure related rules Rule: New Proposal for new rule
#5211 opened Oct 13, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
6
Add rules for Azure Activity Logs/GCP Audit ML jobs backport: skip Domain: Cloud Integration: Azure azure related rules Integration: GCP GCP related rules minor ML machine learning related rule Rule: New Proposal for new rule
#5191 opened Oct 6, 2025 by jmcarlock Loading…
5 tasks
@jmcarlock
20
ProTip! Adding no:label will show everything without a label.