Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] A scheduled task was created
backport: auto
currentrelease
Domain: Endpoint
genai-tradecraft
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6811
opened Sep 16, 2026 by
tradebot-elastic
Loading…
[Rule Deprecation] GKE Unusual Service Account Secret Access via New User Agent
backport: auto
Domain: Cloud
Integration: GCP
GCP related rules
Rule: Deprecation
removal of a rule
Team: TRADE
#6808
opened Sep 15, 2026 by
imays11
Contributor
Loading…
[Rule Tuning] Align ES|QL first-seen rules with new terms semantics
backport: auto
Domain: Cloud
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#6796
opened Sep 15, 2026 by
terrancedejesus
Contributor
Loading…
[New Rule] Potential ECS Agent Communication Protocol Impersonation
backport: auto
Domain: Cloud
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
#6789
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] Potential AWS SSM Agent Registered to External Account
backport: auto
Domain: Cloud
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
#6788
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] AWS CLI Configuration Modified by Unusual Process
backport: auto
bbr
Building Block Rules
Domain: Cloud
Domain: Endpoint
Rule: New
Proposal for new rule
#6787
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] Potential Destructive Cloud CLI Command Executed by GenAI Agent
backport: auto
Domain: Cloud
Domain: Endpoint
Rule: New
Proposal for new rule
#6786
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] Potential Third-Party Cloud Storage Client Execution
backport: auto
Domain: Cloud
Domain: Endpoint
Rule: New
Proposal for new rule
#6785
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] Cloud Offensive Framework Execution
backport: auto
Domain: Cloud
Domain: Endpoint
Rule: New
Proposal for new rule
#6784
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] AWS Audit or Security Service Tampering via CLI
backport: auto
Domain: Cloud
Domain: Endpoint
Rule: New
Proposal for new rule
#6783
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[New Rule] AWS Control Plane Access by Suspicious Process
backport: auto
Domain: Cloud
Domain: Endpoint
Rule: New
Proposal for new rule
#6782
opened Sep 15, 2026 by
bryans3c
Contributor
Loading…
6 tasks
[Rule Tuning] Incoming Execution via PowerShell Remoting
backport: auto
Domain: Endpoint
genai-tradecraft
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6781
opened Sep 15, 2026 by
tradebot-elastic
Loading…
[New Rule] Elastic Defend Alert from an RMM Process Descendant
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6780
opened Sep 14, 2026 by
w0rk3r
Contributor
Loading…
[Rule Tunings] Kubernetes Secret Access Rules Nodes and SAs
backport: auto
Domain: Cloud
Integration: Kubernetes
Kubernetes Integration
Rule: Tuning
tweaking or tuning an existing rule
#6779
opened Sep 14, 2026 by
imays11
Contributor
Loading…
[Rule Tuning] Kubernetes Rapid Secret GET Activity Against Multiple Objects
backport: auto
Integration: Kubernetes
Kubernetes Integration
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#6778
opened Sep 14, 2026 by
imays11
Contributor
Loading…
ProTip!
Adding no:label will show everything without a label.