Skip to content

Pull requests: elastic/detection-rules

New pull request New
104 Open 4,440 Closed
104 Open 4,440 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Deprecation] M365 Security Compliance Email Reported by User as Malware or Phish Domain: Cloud Domain: SaaS Integration: Microsoft 365 Rule: Deprecation removal of a rule Team: TRADE
#6651 opened Aug 13, 2026 by terrancedejesus Contributor • Draft
@terrancedejesus
1
[Rule Tuning] Azure RBAC Built-In Administrator Roles Assigned backport: auto Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6650 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
3
[New Rule] PKINIT Followed by Same-Principal U2U Service Ticket backport: auto Domain: Endpoint Domain: Identity OS: Windows windows related rules patch Rule: New Proposal for new rule
#6649 opened Aug 13, 2026 by w0rk3r Contributor Loading…
@w0rk3r
8
[Rule Tuning] SeDebugPrivilege Enabled by a Suspicious Process backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6648 opened Aug 13, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[New Rule] Mirai Botnet Binary Download via Wget or TFTP backport: auto community Domain: Endpoint OS: Linux
#6647 opened Aug 13, 2026 by Gideon145 Loading…
1
[Rule Tuning] Entra ID User Sign-in with Unusual Authentication Type backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6646 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
3
[Rule Tuning] Entra ID SharePoint or OneDrive Accessed by Unusual Client backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6645 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
4
[New Rule] Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) backport: auto Domain: Endpoint OS: Windows windows related rules patch Rule: New Proposal for new rule
#6644 opened Aug 12, 2026 by w0rk3r Contributor Loading…
@w0rk3r
9
[New Rule] Suspicious Process Execution by Zoom on macOS or Linux backport: auto Domain: Endpoint OS: Linux OS: macOS Rule: New Proposal for new rule
#6643 opened Aug 12, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
8
[New Rule] GCP Secret Manager ListSecrets Across Multiple Projects backport: auto Domain: Cloud Integration: GCP GCP related rules minor python Internal python for the repository Rule: New Proposal for new rule schema
#6642 opened Aug 12, 2026 by imays11 Contributor Loading…
@imays11
5
[Rule Tuning] Entra ID OAuth user_impersonation Scope for Unusual User and Client backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6641 opened Aug 12, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
4
[Rule Tuning] Entra ID User Sign-in with Unusual Client backport: auto Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6640 opened Aug 12, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
2
[Rule Tuning] Entra ID User Sign-in with Unusual Non-Managed Device backport: auto Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6639 opened Aug 12, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
5
[Bug] [DaC] ignore_ssl_errors treated as string and query type not supported with --required-only backport: auto bug Something isn't working detections-as-code patch python Internal python for the repository
#6636 opened Aug 11, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
6
[Rule Tuning] First Time Seen Remote Monitoring and Management Tool backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6635 opened Aug 11, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rules] RMM Installation via Internet-Originated MSI backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6633 opened Aug 11, 2026 by w0rk3r Contributor Loading…
@w0rk3r
14
[Rule Tuning] GenAI or MCP Server Child Process Execution backport: auto bbr Building Block Rules Domain: GenAI Rule: Tuning tweaking or tuning an existing rule
#6632 opened Aug 10, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
4
[Rule Tuning] Potential Computer Account NTLM Relay Activity backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6631 opened Aug 10, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
5
[Rule Tuning] IPSEC NAT Traversal Port Activity backport: auto Domain: Network Rule: Tuning tweaking or tuning an existing rule
#6629 opened Aug 10, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
9
Update actions/setup-python digest to ece7cb0 backport: auto community
#6627 opened Aug 10, 2026 by elastic-renovate-prod Bot Loading…
1 task
[Rule Tuning] Potential Credential Access via DCSync backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6626 opened Aug 9, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
4
[Rule Tuning] Web Server Potential SQL Injection Request backport: auto genai-tradecraft Rule: Tuning tweaking or tuning an existing rule
#6625 opened Aug 9, 2026 by Mikaayenson Contributor Loading…
@Samirbous
4
[New Rule] Entra ID Windows Hello for Business Key-Borrowing Detections backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: New Proposal for new rule
#6624 opened Aug 8, 2026 by terrancedejesus Contributor Loading…
3 of 5 tasks
@terrancedejesus
8
[chore] Post PR guidelines only for community PRs backport: auto enhancement New feature or request
#6623 opened Aug 7, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
4
[Rule Tuning] Unusual Process Modifying GenAI Configuration File backport: auto Domain: Endpoint Domain: GenAI Rule: Tuning tweaking or tuning an existing rule
#6622 opened Aug 7, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
8
ProTip! What’s not been updated in a month: updated:<2026-07-14.