Skip to content

Pull requests: elastic/detection-rules

New pull request New
112 Open 4,441 Closed
112 Open 4,441 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[New Rule] AWS GetFederationToken Followed by Console Login via Federation Exchange backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6660 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS GuardDuty Threat Intelligence Set Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6659 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS SES Identity Verified Then Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6658 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[New Rule] AWS SES Full Access Policy Attached to IAM Entity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6657 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[New Rule] AWS EKS Access Entry Created Then Deleted by Same Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6656 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
6
[New Rule] AWS GuardDuty Publishing Destination Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6655 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS Detective Graph Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6654 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS S3 Bucket MFA Delete Disabled backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6653 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
4
[New Rule] AWS EC2 Security Group Named Java_Ghost Created backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6652 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[Rule Deprecation] M365 Security Compliance Email Reported by User as Malware or Phish backport: auto Domain: Cloud Domain: SaaS Integration: Microsoft 365 Rule: Deprecation removal of a rule Team: TRADE
#6651 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
2
[Rule Tuning] Azure RBAC Built-In Administrator Roles Assigned backport: auto Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6650 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
3
[New Rule] PKINIT Followed by Same-Principal U2U Service Ticket backport: auto Domain: Endpoint Domain: Identity OS: Windows windows related rules patch Rule: New Proposal for new rule
#6649 opened Aug 13, 2026 by w0rk3r Contributor Loading…
@w0rk3r
8
[Rule Tuning] SeDebugPrivilege Enabled by a Suspicious Process backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6648 opened Aug 13, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[New Rule] Mirai Botnet Binary Download via Wget or TFTP backport: auto community Domain: Endpoint OS: Linux
#6647 opened Aug 13, 2026 by Gideon145 Loading…
1
[Rule Tuning] Entra ID User Sign-in with Unusual Authentication Type backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6646 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
3
[Rule Tuning] Entra ID SharePoint or OneDrive Accessed by Unusual Client backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6645 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
4
[New Rule] Suspicious Process Execution by Zoom on macOS or Linux backport: auto Domain: Endpoint OS: Linux OS: macOS Rule: New Proposal for new rule
#6643 opened Aug 12, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
8
[New Rule] GCP Secret Manager ListSecrets Across Multiple Projects backport: auto Domain: Cloud Integration: GCP GCP related rules minor python Internal python for the repository Rule: New Proposal for new rule schema
#6642 opened Aug 12, 2026 by imays11 Contributor Loading…
@imays11
5
[Rule Tuning] Entra ID OAuth user_impersonation Scope for Unusual User and Client backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6641 opened Aug 12, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
4
[Rule Tuning] Entra ID User Sign-in with Unusual Client backport: auto Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6640 opened Aug 12, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
2
[Rule Tuning] Entra ID User Sign-in with Unusual Non-Managed Device backport: auto Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6639 opened Aug 12, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
5
[Bug] [DaC] ignore_ssl_errors treated as string and query type not supported with --required-only backport: auto bug Something isn't working detections-as-code patch python Internal python for the repository
#6636 opened Aug 11, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
7
[Rule Tuning] First Time Seen Remote Monitoring and Management Tool backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6635 opened Aug 11, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rules] RMM Installation via Internet-Originated MSI backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6633 opened Aug 11, 2026 by w0rk3r Contributor Loading…
@w0rk3r
14
[Rule Tuning] GenAI or MCP Server Child Process Execution backport: auto bbr Building Block Rules Domain: GenAI Rule: Tuning tweaking or tuning an existing rule
#6632 opened Aug 10, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
4
ProTip! Filter pull requests by the default branch with base:main.