Pull requests: elastic/detection-rules
Pull requests list
[Rule FN Tuning] System V Init Script Created
backport: auto
Domain: Endpoint
OS: Linux
Team: TRADE
#6758
opened Sep 10, 2026 by
Aegrah
Contributor
Loading…
[FR] Versioned MITRE ATLAS mappings, 9.6 ship gate, and GenAI tags
enhancement
New feature or request
python
Internal python for the repository
Rule: Tuning
tweaking or tuning an existing rule
schema
#6757
opened Sep 9, 2026 by
Mikaayenson
Contributor
•
Draft
4 of 5 tasks
[New Hunt] Add hunts for CVE-2026-20079
backport: auto
Domain: Network
Hunt: New
Hunting
Integration: Network Traffic
#6756
opened Sep 9, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[New Rule] Potential Data Exfiltration via AzCopy or Azure Storage Explorer
backport: auto
Domain: Endpoint
Integration: Endpoint
Elastic Endpoint Security
OS: Windows
windows related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#6755
opened Sep 9, 2026 by
terrancedejesus
Contributor
Loading…
[DaC] [Bug] KeyError when loading a production rule whose Something isn't working
community
detections-as-code
patch
python
Internal python for the repository
schema
Team: TRADE
min_stack_version is above the package version
backport: auto
bug
#6753
opened Sep 9, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] Potential Fileless Execution via Unusual memfd Create Call
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#6748
opened Sep 8, 2026 by
Aegrah
Contributor
Loading…
[New Rules] Add SSH brute force rules for the macOS Security Events integration
backport: auto
Domain: Endpoint
OS: macOS
patch
python
Internal python for the repository
Rule: New
Proposal for new rule
schema
#6747
opened Sep 8, 2026 by
shashank-elastic
Contributor
Loading…
1 of 5 tasks
[New Rule] Potential Fileless Execution via O_TMPFILE
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#6743
opened Sep 7, 2026 by
Aegrah
Contributor
Loading…
[New Rules] Three Linux File-Related Web Server Rules
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#6742
opened Sep 7, 2026 by
Aegrah
Contributor
Loading…
[Tuning] AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
#6740
opened Sep 5, 2026 by
Samirbous
Contributor
Loading…
[Tuning] AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
#6739
opened Sep 5, 2026 by
Samirbous
Contributor
Loading…
[Tuning] Protected Storage Service Access via SMB
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6738
opened Sep 4, 2026 by
Samirbous
Contributor
Loading…
[Tuning] Web Server Cloud Metadata SSRF Request
backport: auto
Rule: Tuning
tweaking or tuning an existing rule
#6737
opened Sep 4, 2026 by
Samirbous
Contributor
Loading…
[Tuning] Update Alert Suppression for Network Rules
backport: auto
currentrelease
Domain: Network
Rule: Tuning
tweaking or tuning an existing rule
#6731
opened Sep 3, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[Tuning] M365 Teams Rogue Help Desk Chat Created
backport: auto
Domain: Cloud
Integration: Microsoft 365
Rule: Tuning
tweaking or tuning an existing rule
#6730
opened Sep 3, 2026 by
Samirbous
Contributor
Loading…
UnifiedLogs SIEM Detection Coverage.
#6728
opened Sep 3, 2026 by
shashank-elastic
Contributor
•
Draft
[Rule Tuning] Suspicious Windows Powershell Arguments
backport: auto
Domain: Endpoint
genai-tradecraft
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6707
opened Aug 28, 2026 by
Mikaayenson
Contributor
Loading…
[New Rule] Entra ID device-bound PRT cookie replay from unusual IP
backport: auto
Domain: Cloud
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6706
opened Aug 28, 2026 by
terrancedejesus
Contributor
Loading…
8 tasks done
ProTip!
Exclude everything labeled
bug with -label:bug.