Skip to content

Pull requests: elastic/detection-rules

New pull request New
85 Open 4,279 Closed
85 Open 4,279 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[New Rules] GCP GKE Rules Conversion Part 2 backport: auto Domain: Cloud Workloads Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6430 opened Jul 10, 2026 by imays11 Contributor Loading…
@imays11
1
[Rule Tuning] Entra ID User Sign-in with Unusual Client backport: auto Domain: Cloud genai-tradecraft Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6429 opened Jul 10, 2026 by Mikaayenson Contributor Loading…
@terrancedejesus
3
[New Rule] Azure AKS API Server Proxying Request to Kubelet Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6428 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS User Exec into Pod Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6427 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Ephemeral Container Added to Pod Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6426 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Suspicious Self-Subject Review via Service Account Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6425 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS API Request Failure Burst by User Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6424 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Kubernetes Events Deleted Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6423 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Service Account Token Created via TokenRequest API Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6422 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Secret get or list with Suspicious User Agent Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6421 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[New Rule] Azure AKS Certificate Signing Request Created or Approved Domain: Cloud Domain: Containers Domain: Identity Integration: Azure azure related rules Rule: New Proposal for new rule
#6420 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[Enhancement] Update non-ecs-schema.json to include necessary Azure platform log fields for AKS backport: auto enhancement New feature or request Integration: Azure azure related rules schema
#6418 opened Jul 10, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
4
[New Rule] Azure AKS CoreDNS or Kube-DNS Configuration Modified Domain: Cloud Domain: Containers Integration: Azure azure related rules Rule: New Proposal for new rule
#6417 opened Jul 10, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
1
[Rule Tuning] File Creation in World-Writable Directory by Unusual Process backport: auto Domain: Endpoint genai-tradecraft OS: Linux Rule: Tuning tweaking or tuning an existing rule
#6416 opened Jul 10, 2026 by Mikaayenson Contributor Loading…
@Aegrah
4
[Rule Tuning] Potential Credential Access via DCSync backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6415 opened Jul 10, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
3
[Rule Tuning] A scheduled task was created backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6414 opened Jul 10, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
3
WIP - [FR] Use ephemeral tokens enhancement New feature or request
#6413 opened Jul 9, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
@eric-forte-elastic
1
[Rule Tuning] AWS Lambda Function URL Created with Public Access backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#6412 opened Jul 9, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
2
[Rule Tuning] AWS Bedrock High-Frequency Single-Model Inference API Probing backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#6411 opened Jul 9, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
4
[Rule Tuning] Unusual Process Modifying GenAI Configuration File backport: auto genai-tradecraft Rule: Tuning tweaking or tuning an existing rule
#6410 opened Jul 8, 2026 by Mikaayenson Contributor Loading…
@Mikaayenson
4
[Rule Tuning] M365 Identity Login from Atypical Region backport: auto Domain: Cloud genai-tradecraft Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
#6409 opened Jul 8, 2026 by Mikaayenson Contributor Loading…
@terrancedejesus
3
[Rule Tuning] Entra ID High Risk Sign-in backport: auto Domain: Cloud genai-tradecraft Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#6408 opened Jul 8, 2026 by Mikaayenson Contributor Loading…
@terrancedejesus
3
[Rule Tuning] Mofcomp Activity backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6407 opened Jul 8, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[New Rules] AWS Bedrock AgentCore Runtime Prompt Credential Access (x2) + integration manifest backport: auto Domain: Cloud minor Rule: New Proposal for new rule
#6406 opened Jul 8, 2026 by bryans3c Contributor Loading…
5 tasks
@bryans3c
14
[New Rules] GCP GKE CSR Abuse Rules backport: auto Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6405 opened Jul 8, 2026 by imays11 Contributor Loading…
@imays11
1
ProTip! Adding no:label will show everything without a label.