Skip to content

Pull requests: elastic/detection-rules

New pull request New
105 Open 4,479 Closed
105 Open 4,479 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[New Rules] Procfs Sycall Read & binfmt Configuration File Creation backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#6698 opened Aug 25, 2026 by Aegrah Contributor Loading…
@Aegrah
9
[New Rule] AWS Bedrock AgentCore Resource Created with IAM Execution Role backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6697 opened Aug 25, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[Rule Tuning/Deprecation] Misc Windows Tuning backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Deprecation removal of a rule Rule: Tuning tweaking or tuning an existing rule
#6696 opened Aug 24, 2026 by w0rk3r Contributor Loading…
@w0rk3r
6
[Tuning] Kubernetes Secrets List Across Cluster or Sensitive Namespaces backport: auto Integration: Kubernetes Kubernetes Integration Rule: Tuning tweaking or tuning an existing rule
#6692 opened Aug 24, 2026 by Samirbous Contributor Loading…
@Samirbous
3
[New Rule] Entra ID Named Location Modified backport: auto community Domain: Cloud Integration: Azure azure related rules
#6691 opened Aug 24, 2026 by descambiado Contributor Loading…
@terrancedejesus
[New] Potential Evasion via Boot Time Removal Tool backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6690 opened Aug 21, 2026 by Samirbous Contributor Loading…
@Samirbous
12
[New Rule] First Seen Network Flow Exporter backport: auto bbr Building Block Rules Domain: Network Integrations: Netflow patch Rule: New Proposal for new rule
#6689 opened Aug 21, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
29
fix(tests): allow same-day rule tunings without updated_date bump backport: auto bug Something isn't working patch python Internal python for the repository
#6681 opened Aug 20, 2026 by Mikaayenson Contributor Loading…
4 tasks
@Mikaayenson
5
[New Rule] Entra ID Admin Registered MFA Method for User backport: auto community Domain: Cloud Integration: Azure azure related rules
#6680 opened Aug 20, 2026 by descambiado Contributor Loading…
@terrancedejesus
[New Rule] Potential ResetNightmare UPN Account Takeover (CVE-2026-27912) backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6679 opened Aug 19, 2026 by w0rk3r Contributor Loading…
@w0rk3r
9
Detect CVE-2026-65400 Screen Sharing exploitation via SSFileCopy helpers backport: auto Domain: Endpoint OS: macOS
#6675 opened Aug 19, 2026 by shashank-elastic Contributor Loading…
5 tasks
@shashank-elastic
44
[CI] Gate main merges on backports and release-branch unit tests backport: auto ci/cd enhancement New feature or request Team: TRADE
#6670 opened Aug 18, 2026 by Mikaayenson Contributor • Draft
5 tasks
@Mikaayenson
[New Rule] Azure WireServer Abuse Related Detections Domain: Cloud Domain: Endpoint Domain: Network Integration: Azure azure related rules Rule: New Proposal for new rule
#6668 opened Aug 18, 2026 by terrancedejesus Contributor • Draft
3 tasks done
@terrancedejesus
1
[FR] Support ES|QL sub queries backport: auto enhancement New feature or request esql ES|QL patch python Internal python for the repository schema
#6665 opened Aug 17, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
10
[New Rule] Dual-signal Suricata SnortML vs signature triage (GID 411) backport: auto community
#6662 opened Aug 16, 2026 by AAH20 Loading…
4 tasks
1
6
[New Rule] AWS GetFederationToken Followed by Console Login via Federation Exchange backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6660 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
8
[New Rule] AWS GuardDuty Threat Intelligence Set Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6659 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
8
[New Rule] AWS SES Identity Verified Then Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6658 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
9
[New Rule] AWS SES Full Access Policy Attached to IAM Entity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6657 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
11
[New Rule] AWS EKS Access Entry Created Then Deleted by Same Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6656 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
15
[New Rule] AWS GuardDuty Publishing Destination Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6655 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[New Rule] AWS Detective Graph Deleted backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6654 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS S3 Bucket MFA Delete Disabled backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6653 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[New Rule] AWS EC2 Security Group Named Java_Ghost Created backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6652 opened Aug 14, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
6
[Rule Deprecation] M365 Security Compliance Email Reported by User as Malware or Phish backport: auto Domain: Cloud Domain: SaaS Integration: Microsoft 365 Rule: Deprecation removal of a rule Team: TRADE
#6651 opened Aug 13, 2026 by terrancedejesus Contributor Loading…
@terrancedejesus
2
ProTip! Adding no:label will show everything without a label.