Skip to content

Pull requests: elastic/detection-rules

New pull request New
33 Open 2,749 Closed
33 Open 2,749 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule: Tuning] - Azure blob permission modification tagging - Correct tags backport: auto community Domain: Cloud Integration: Azure azure related rules
#4371 opened Jan 12, 2025 by jvalente-salemstate Loading…
3 tasks done
1
[Rule Tuning] Suspicious Communication App Child Process backport: auto bbr Building Block Rules community Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#4369 opened Jan 10, 2025 by w0rk3r Loading…
@w0rk3r
1
[Rule Tuning] Windows Misc BBR Tuning backport: auto bbr Building Block Rules community Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#4368 opened Jan 10, 2025 by w0rk3r Loading…
@w0rk3r
1
Deprecate Experimental ML commands backport: auto community enhancement New feature or request patch python Internal python for the repository
#4365 opened Jan 10, 2025 by shashank-elastic Loading…
5 tasks
1
@shashank-elastic
1
Testing rule updates and guidelines backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#4360 opened Jan 9, 2025 by terrancedejesus Loading…
5 tasks
1
[FR] Generate investigation guides enhancement New feature or request Security Content
#4358 opened Jan 8, 2025 by Mikaayenson • Draft
1 of 5 tasks
@Mikaayenson
35
[New Rule] Adding Coverage for AWS SQS Queue Purge backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#4354 opened Jan 8, 2025 by terrancedejesus Loading…
3 of 5 tasks
@terrancedejesus
3
[New Rule] Potential Process Name Stomping with Prctl backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#4352 opened Jan 8, 2025 by Aegrah Loading…
@Aegrah
1
[Hunt Tuning] Persistence via SSH Configurations and/or Keys backport: auto Hunt: Tuning Hunting OS: Linux patch Team: TRADE
#4351 opened Jan 8, 2025 by Aegrah Loading…
@Aegrah
1
[New Rule] Adding Coverage for SNS Topic Message Publish by Rare User backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#4350 opened Jan 7, 2025 by terrancedejesus Loading…
5 tasks
@terrancedejesus
1
[New Rules] Kernel Seeking/Unpacking Activity backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#4341 opened Jan 7, 2025 by Aegrah Loading…
@Aegrah
1
[New Rule] Process Started with Executable Stack backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#4340 opened Jan 7, 2025 by Aegrah Loading…
@Aegrah
1
[New Rule] System Binary Path File Permission Modification backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#4339 opened Jan 7, 2025 by Aegrah Loading…
@Aegrah
1
[New Rule] Suspicious Path Invocation from Command Line backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#4338 opened Jan 7, 2025 by Aegrah Loading…
@Aegrah
1
[New BBR] Linux System Information Discovery via Getconf backport: auto bbr Building Block Rules OS: Linux Rule: New Proposal for new rule Team: TRADE
#4337 opened Jan 7, 2025 by Aegrah Loading…
@Aegrah
1
[Rule Tuning] Add Public Snapshot Coverage Regarding AWS EC2 EBS Snapshot Shared or Made Public backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#4335 opened Jan 6, 2025 by terrancedejesus Loading…
4 of 5 tasks
@terrancedejesus
1
[Rule Tuning] Adjusting Verbiage for AWS EC2 Instance Connect SSH Public Key Uploaded backport: auto documentation Improvements or additions to documentation Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#4334 opened Jan 6, 2025 by terrancedejesus Loading…
4 of 5 tasks
@terrancedejesus
1
[New Rule] Adding Coverage for AWS EC2 Deprecated AMI Discovery backport: auto Domain: Cloud Integration: AWS AWS related rules patch Rule: New Proposal for new rule
#4328 opened Dec 24, 2024 by terrancedejesus Loading…
2 of 5 tasks
@terrancedejesus
1
[New Rule] Adding Coverage for AWS S3 Unauthenticated Object Retrieval by Rare Source backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#4315 opened Dec 17, 2024 by terrancedejesus Loading…
2 of 5 tasks
@terrancedejesus
2
[New Rule] Adding Coverage for AWS S3 Unauthenticated Object Upload by Rare Source backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#4314 opened Dec 17, 2024 by terrancedejesus Loading…
3 of 5 tasks
@terrancedejesus
1
[New Rule] Adding Coverage for AWS S3 Unauthenticated Bucket Listing by Rare Source backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#4313 opened Dec 17, 2024 by terrancedejesus Loading…
3 of 5 tasks
@terrancedejesus
4
[Bug] [DaC] Metadata maturity field default mismatch and poor enforcement of rule naming conventions backport: auto bug Something isn't working minor python Internal python for the repository
#4285 opened Dec 6, 2024 by eric-forte-elastic Loading…
5 tasks
1
@eric-forte-elastic
6
Add Fortigate Fortinet index to multiple detection rules backport: auto community RTA work on RTA framework
#4275 opened Nov 27, 2024 by SHolzhauer Loading…
1 of 2 tasks
1
Revert "[Bug] Handle formatting empty list" backport: auto python Internal python for the repository
#4087 opened Sep 17, 2024 by brokensound77 Loading…
5
[New Rule] Potential Forced Authentication - SMB Named Pipes backlog backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#3916 opened Jul 24, 2024 by w0rk3r • Draft
@w0rk3r
10
ProTip! Adding no:label will show everything without a label.