Skip to content

Pull requests: elastic/detection-rules

New pull request New
88 Open 4,309 Closed
88 Open 4,309 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Tuning] Lucene Network Rules Language Conversion Domain: Network Rule: Tuning tweaking or tuning an existing rule
#6463 opened Jul 17, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
1
@eric-forte-elastic
2
[Rule Tuning] GenAI Process Connection to Unusual Domain backport: auto Domain: GenAI Rule: Tuning tweaking or tuning an existing rule
#6462 opened Jul 16, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
4
[Rule Tuning] Accepted Default Telnet Port Connection backport: auto Domain: Network integration: Fortinet Fortigate Integration: Network Traffic integration: PANW Integration: pfSense Rule: Tuning tweaking or tuning an existing rule
#6461 opened Jul 16, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[New Hunt] AKS Kubelet nodes/proxy Command Execution from an External Source IP backport: auto Domain: Cloud Domain: Containers Hunt: New Hunting Integration: Azure azure related rules
#6460 opened Jul 16, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
8
[New Rules] GCP GKE Rule Conversions Part 4 backport: auto Domain: Cloud Workloads Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6456 opened Jul 15, 2026 by imays11 Contributor Loading…
@imays11
11
[New Rule] Entra ID ROPC Authentication with Unknown Client ID backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: New Proposal for new rule
#6454 opened Jul 15, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
5
[Rule Tuning] Suspicious Inter-Process Communication via Outlook backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6453 opened Jul 15, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[Rule Tuning] Entra ID / M365 Consent Grant Suppression backport: auto Domain: Cloud Integration: Azure azure related rules Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
#6452 opened Jul 15, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
6
[Rule Tuning] Connection to Commonly Abused Web Services backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6451 opened Jul 15, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
6
[Rule Tuning] Suspicious Execution via Windows Subsystem for Linux backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6449 opened Jul 14, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
7
Wget and curl LLM assisted rules backport: auto Rule: New Proposal for new rule
#6448 opened Jul 14, 2026 by aarju Contributor Loading…
@Mikaayenson
25
[Rule Tuning] Component Object Model Hijacking backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6447 opened Jul 14, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[Rule Tuning] Local Scheduled Task Creation backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6446 opened Jul 14, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rules] GCP GKE Rule Conversions Part 3 backport: auto Domain: Cloud Workloads Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6445 opened Jul 14, 2026 by imays11 Contributor Loading…
@imays11
3
[Rule Tuning] Suspicious Windows Powershell Arguments backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6444 opened Jul 13, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[Rule Tuning] Suspicious Execution with NodeJS backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6439 opened Jul 13, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rule] AWS IAM User Created Own Access Key backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6436 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
8
[New Rule] AWS SageMaker Execution Role Passed by Unusual Principal backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6435 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
5
[Rule Tuning] Potential Computer Account NTLM Relay Activity backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6431 opened Jul 11, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[Rule Tuning] Entra ID User Sign-in with Unusual Client backport: auto Domain: Cloud genai-tradecraft Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6429 opened Jul 10, 2026 by Mikaayenson Contributor Loading…
@terrancedejesus
3
[New Rule] Azure AKS API Server Proxying Request to Kubelet backport: auto Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6428 opened Jul 10, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
5
[New Rule] Azure AKS User Exec into Pod backport: auto Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6427 opened Jul 10, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
9
[New Rule] Azure AKS Ephemeral Container Added to Pod Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6426 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Suspicious Self-Subject Review via Service Account Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6425 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS API Request Failure Burst by User Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6424 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
ProTip! Updated in the last three days: updated:>2026-07-14.