Skip to content

Pull requests: elastic/detection-rules

New pull request New
96 Open 4,287 Closed
96 Open 4,287 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Tuning] Suspicious Execution via Windows Subsystem for Linux backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6449 opened Jul 14, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
6
Wget and curl LLM assisted rules backport: auto
#6448 opened Jul 14, 2026 by aarju Contributor Loading…
7
[Rule Tuning] Component Object Model Hijacking backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6447 opened Jul 14, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[Rule Tuning] Local Scheduled Task Creation backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6446 opened Jul 14, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rules] GCP GKE Rule Conversions Part 3 backport: auto Domain: Cloud Workloads Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6445 opened Jul 14, 2026 by imays11 Contributor Loading…
@imays11
1
[Rule Tuning] Suspicious Windows Powershell Arguments backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6444 opened Jul 13, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rule] AWS Cognito Unauthenticated Identity Pool Credentials Issued backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6443 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
3
[New Rule] AWS CloudTrail Management Events Disabled via PutEventSelectors backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6442 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
4
[New Rule] AWS GuardDuty Detection Suppression backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6441 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
6
[New Rule] AWS Attempt to Leave Organization backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6440 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
4
[Rule Tuning] Suspicious Execution with NodeJS backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6439 opened Jul 13, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rule] AWS Account Closed backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6438 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
4
[New Rule] AWS IAM User Console Login Without MFA backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6437 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
10
[New Rule] AWS IAM User Created Own Access Key backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6436 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
4
[New Rule] AWS SageMaker Execution Role Passed by Unusual Principal backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6435 opened Jul 13, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
5
[Rule Tuning] Potential Computer Account NTLM Relay Activity backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6431 opened Jul 11, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
3
[New Rules] GCP GKE Rules Conversion Part 2 backport: auto Domain: Cloud Workloads Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6430 opened Jul 10, 2026 by imays11 Contributor Loading…
@imays11
1
[Rule Tuning] Entra ID User Sign-in with Unusual Client backport: auto Domain: Cloud genai-tradecraft Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6429 opened Jul 10, 2026 by Mikaayenson Contributor Loading…
@terrancedejesus
3
[New Rule] Azure AKS API Server Proxying Request to Kubelet Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6428 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS User Exec into Pod Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6427 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Ephemeral Container Added to Pod Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6426 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Suspicious Self-Subject Review via Service Account Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6425 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS API Request Failure Burst by User Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6424 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Kubernetes Events Deleted Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6423 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Service Account Token Created via TokenRequest API Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6422 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
ProTip! Add no:assignee to see everything that’s not assigned.