Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] Suspicious Windows Powershell Arguments
backport: auto
currentrelease
Domain: Endpoint
genai-tradecraft
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6707
opened Aug 28, 2026 by
Mikaayenson
Contributor
Loading…
[New Rule] Entra ID device-bound PRT cookie replay from unusual IP
backport: auto
Domain: Cloud
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6706
opened Aug 28, 2026 by
terrancedejesus
Contributor
Loading…
8 tasks done
[New] Potential Entra ID PRT Extraction via BrowserCore
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6705
opened Aug 27, 2026 by
Samirbous
Contributor
Loading…
[Rule Tuning] Tune Network Rules for More Firewall Support
backport: auto
currentrelease
Domain: Network
integration: Fortinet Fortigate
integration: PANW
Rule: Tuning
tweaking or tuning an existing rule
#6702
opened Aug 26, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[Rule Tunings] Kubernetes/GKE Sensitive RBAC Change Followed by Workload Modification
backport: auto
Domain: Cloud Workloads
Domain: Cloud
Integration: GCP
GCP related rules
Integration: Kubernetes
Kubernetes Integration
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6699
opened Aug 25, 2026 by
imays11
Contributor
Loading…
[New Rule] AWS Bedrock AgentCore Resource Created with IAM Execution Role
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6697
opened Aug 25, 2026 by
bryans3c
Contributor
Loading…
4 tasks
[Rule Tuning/Deprecation] Misc Windows Tuning
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Deprecation
removal of a rule
Rule: Tuning
tweaking or tuning an existing rule
#6696
opened Aug 24, 2026 by
w0rk3r
Contributor
Loading…
[New Rule] Entra ID Named Location Modified
backport: auto
community
Domain: Cloud
Integration: Azure
azure related rules
#6691
opened Aug 24, 2026 by
descambiado
Contributor
Loading…
[New Rule] First Seen Network Flow Exporter
backport: auto
bbr
Building Block Rules
Domain: Network
Integrations: Netflow
patch
Rule: New
Proposal for new rule
#6689
opened Aug 21, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
fix(tests): allow same-day rule tunings without updated_date bump
backport: auto
bug
Something isn't working
patch
python
Internal python for the repository
#6681
opened Aug 20, 2026 by
Mikaayenson
Contributor
Loading…
4 tasks
[New Rule] Entra ID Admin Registered MFA Method for User
backport: auto
community
Domain: Cloud
Integration: Azure
azure related rules
#6680
opened Aug 20, 2026 by
descambiado
Contributor
Loading…
[New Rule] Potential ResetNightmare UPN Account Takeover (CVE-2026-27912)
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6679
opened Aug 19, 2026 by
w0rk3r
Contributor
Loading…
Detect CVE-2026-65400 Screen Sharing exploitation via SSFileCopy helpers
backport: auto
Domain: Endpoint
OS: macOS
#6675
opened Aug 19, 2026 by
shashank-elastic
Contributor
Loading…
5 tasks
[CI] Gate main merges on backports and release-branch unit tests
backport: auto
ci/cd
enhancement
New feature or request
Team: TRADE
#6670
opened Aug 18, 2026 by
Mikaayenson
Contributor
•
Draft
5 tasks
[New Rule] Azure WireServer Abuse Related Detections
backport: auto
Domain: Cloud
Domain: Endpoint
Domain: Network
Integration: Azure
azure related rules
OS: Linux
Rule: New
Proposal for new rule
#6668
opened Aug 18, 2026 by
terrancedejesus
Contributor
Loading…
3 tasks done
[FR] Support ES|QL sub queries
backport: auto
enhancement
New feature or request
esql
ES|QL
patch
python
Internal python for the repository
schema
#6665
opened Aug 17, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] AWS SES Identity Verified Then Deleted
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6658
opened Aug 14, 2026 by
bryans3c
Contributor
Loading…
4 tasks
[New Rule] AWS SES Full Access Policy Attached to IAM Entity
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6657
opened Aug 14, 2026 by
bryans3c
Contributor
Loading…
4 tasks
[New Rule] AWS S3 Bucket MFA Delete Disabled
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6653
opened Aug 14, 2026 by
bryans3c
Contributor
Loading…
4 tasks
[New Rule] AWS EC2 Security Group Named Java_Ghost Created
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6652
opened Aug 14, 2026 by
bryans3c
Contributor
Loading…
4 tasks
[Rule Tuning] SeDebugPrivilege Enabled by a Suspicious Process
backport: auto
currentrelease
Domain: Endpoint
genai-tradecraft
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6648
opened Aug 13, 2026 by
Mikaayenson
Contributor
Loading…
[New Rule] Mirai Botnet Binary Download via Wget or TFTP
backport: auto
community
Domain: Endpoint
OS: Linux
#6647
opened Aug 13, 2026 by
Gideon145
Loading…
[New Rules] RMM Installation via Internet-Originated MSI
backport: auto
currentrelease
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6633
opened Aug 11, 2026 by
w0rk3r
Contributor
Loading…
ProTip!
Adding no:label will show everything without a label.