Pull requests: elastic/detection-rules
Pull requests list
[New/Tuning] Windows Rules to detect top threats/TTPs 24/25
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#5001
opened Aug 21, 2025 by
Samirbous
Loading…
[Rule Tuning] Microsoft Entra ID Suspicious Session Reuse to Graph Access
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#4997
opened Aug 20, 2025 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] AWS STS GetCallerIdentity API Called for the First Time
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#4995
opened Aug 19, 2025 by
imays11
Loading…
[New Rule] Threat Intelligence Signal - Microsoft Defender for Office 365
backport: auto
Domain: Cloud
Domain: Email
Integration: Microsoft 365
Rule: New
Proposal for new rule
#4994
opened Aug 19, 2025 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] First Time Seen AWS Secret Value Accessed in Secrets Manager
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#4992
opened Aug 18, 2025 by
imays11
Loading…
[New Rule] Multi-Base64 Decoding Attempt from Suspicious Location
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#4931
opened Jul 24, 2025 by
Aegrah
Loading…
[New Rule] Toolshell Exploit Chain Detections
backport: auto
bbr
Building Block Rules
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#4928
opened Jul 23, 2025 by
terrancedejesus
Loading…
5 tasks
[New Rule] Kubectl Secret Access
container
OS: Linux
Rule: New
Proposal for new rule
stale
60 days of inactivity
Team: TRADE
[New Rules] Potential Relay Attack against a Computer Account
backport: auto
blocked
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#4826
opened Jun 18, 2025 by
w0rk3r
Loading…
[New] Microsoft Entra ID Protection Alert and Device Registration
backport: auto
Domain: Cloud Workloads
Domain: Cloud
Integration: Azure
azure related rules
Integration: Microsoft 365
patch
Rule: New
Proposal for new rule
#4688
opened Apr 30, 2025 by
Samirbous
Loading…
[New] Potential SAP NetWeaver Exploitation rules
backlog
backport: auto
OS: Linux
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#4666
opened Apr 26, 2025 by
Samirbous
Loading…
[New Rule] Active Directory Forced Authentication from Linux Host
backlog
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
[Rule Tuning] Update rules using NPC integration and non-ECS fields
backlog
backport: auto
blocked
Domain: Network
Rule: Tuning
tweaking or tuning an existing rule
#3194
opened Oct 16, 2023 by
brokensound77
Loading…
ProTip!
Updated in the last three days: updated:>2025-08-20.