Skip to content

Pull requests: elastic/detection-rules

New pull request New
89 Open 4,429 Closed
89 Open 4,429 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[chore] Post PR guidelines only for community PRs backport: auto enhancement New feature or request
#6623 opened Aug 7, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
2
[Rule Tuning] Unusual Process Modifying GenAI Configuration File backport: auto Domain: Endpoint Domain: GenAI Rule: Tuning tweaking or tuning an existing rule
#6622 opened Aug 7, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
7
[New Rule] sqlite3 Query Against a Browser Credential Database backport: auto community Domain: Endpoint OS: macOS
#6621 opened Aug 7, 2026 by clivoa Loading…
6 tasks done
[New Rule] Unusual Child Process of Homebrew's Bundled Ruby Interpreter backport: auto community Domain: Endpoint OS: macOS
#6620 opened Aug 7, 2026 by clivoa Loading…
6 tasks done
[New Rule] Untrusted Process Access to Cryptocurrency Wallet Data backport: auto community Domain: Endpoint OS: macOS
#6619 opened Aug 7, 2026 by clivoa Loading…
6 tasks done
[Rule Tuning] Migrate COMPLETION rules to EIS Claude Sonnet 4.6 backport: auto
#6614 opened Aug 6, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
3
[New Rule] Native Binary Creation Under node_modules backport: auto community Domain: Endpoint OS: Linux
#6613 opened Aug 6, 2026 by clivoa Loading…
6 tasks done
2
[New Rule] Non-Browser Process Connecting to a DNS-over-HTTPS Resolver backport: auto community Domain: Endpoint OS: macOS
#6612 opened Aug 6, 2026 by clivoa Loading…
6 tasks done
13
[FR] Upgrade eql to 1.0.1, align KQL with lark 1.x, and fix NTLM relay field comparison backport: auto currentrelease Domain: Endpoint minor OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6611 opened Aug 6, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
13
[New Rule] Claude Cowork VM Boot Image Tamper backport: auto Domain: GenAI OS: macOS OS: Windows windows related rules Rule: New Proposal for new rule
#6610 opened Aug 6, 2026 by Mikaayenson Contributor Loading…
1 of 5 tasks
@Mikaayenson
6
WIP - [FR] Reduce rebuilding and re-hashing the rules package enhancement New feature or request patch python Internal python for the repository test-suite unit and other testing components
#6594 opened Aug 5, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
@eric-forte-elastic
1
WIP - [FR] Deduplicate query validation targets enhancement New feature or request patch python Internal python for the repository test-suite unit and other testing components
#6593 opened Aug 5, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
@eric-forte-elastic
1
WIP - [FR] Memoize the integration schema enhancement New feature or request patch python Internal python for the repository test-suite unit and other testing components
#6592 opened Aug 5, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
@eric-forte-elastic
1
[Rule Tunings] Add IaC/automation UA exclusions to 54 AWS detection rules backport: auto bbr Building Block Rules Domain: Cloud Integration: AWS AWS related rules Rule: Deprecation removal of a rule Rule: Tuning tweaking or tuning an existing rule
#6589 opened Aug 5, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
6
[New Rule] Kernel Module Loaded with Tainting Flags backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#6588 opened Aug 5, 2026 by Aegrah Contributor Loading…
@Aegrah
12
[New Rule] Azure AKS Unusual Decision by User Agent Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6586 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Pod Exec Potential Reverse Shell Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6585 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Pod Exec with Curl or Wget to HTTPS Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6584 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Forbidden Request from Unusual User Agent Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6583 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Forbidden Creation Request Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6582 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Anonymous Pod Create Update or Patch Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6581 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Multi-Resource Setup Discovery Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6580 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Endpoint Permission Enumeration by User Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6579 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Denied Service Account Request via Unusual User Agent Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6578 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
[New Rule] Azure AKS Anonymous Endpoint Permission Enumeration Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6577 opened Aug 4, 2026 by terrancedejesus Contributor • Draft
3 tasks
@terrancedejesus
1
ProTip! Updated in the last three days: updated:>2026-08-05.