Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] Microsoft 365 Global Administrator Role Assigned
Domain: Cloud
Domain: Identity
Domain: SaaS
Integration: Microsoft 365
Rule: Tuning
tweaking or tuning an existing rule
#5293
opened Nov 8, 2025 by
terrancedejesus
•
Draft
5 tasks
[Rule Tunings] AWS Cloudtrail Created/Updated/Suspended/Deleted
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] Rapid Secret Retrieval Attempts from AWS SecretsManager
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS EC2 Instance Console Login via Assumed Role
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS IAM SAML Provider Updated
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS IAM Brute Force of Assume Role Policy
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS IAM CompromisedKeyQuarantine Policy Attached to User
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tunings] AWS IAM Virtual MFA Device Rules
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS GetSessionToken Abuse
bbr
Building Block Rules
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
rule-tuning: Elastic Agent service termination improve for detection
backport: auto
community
Domain: Endpoint
Rule: Tuning
tweaking or tuning an existing rule
#5272
opened Nov 3, 2025 by
alstolten
Loading…
[Rule Tunings] AWS Group Creation, User Added to Group, Group Deletion
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5269
opened Oct 31, 2025 by
imays11
Loading…
[New Rule] Privilege Escalation via SUID/SGID Proxy Execution
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5266
opened Oct 30, 2025 by
Aegrah
Loading…
[Rule Tuning] AWS S3 Bucket Configuration Deletion
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5265
opened Oct 29, 2025 by
imays11
Loading…
Renovate Updates
backport: auto
enhancement
New feature or request
patch
#5258
opened Oct 28, 2025 by
shashank-elastic
Loading…
5 tasks
[Bug] [DAC] Auto Gen Schema Fails on Certain Subqueries
backport: auto
bug
Something isn't working
patch
python
Internal python for the repository
schema
#5256
opened Oct 28, 2025 by
eric-forte-elastic
Loading…
5 tasks
[Rule Tuning] AWS S3 Bucket Server Access Logging Disabled
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5254
opened Oct 27, 2025 by
imays11
Loading…
[Rule Tuning] Azure Diagnostic Settings Deletion
backport: auto
Domain: Cloud
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5253
opened Oct 27, 2025 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] AWS S3 Bucket Expiration Lifecycle Configuration Added
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5251
opened Oct 27, 2025 by
imays11
Loading…
[New] Windows Server Update Service Spawning Suspicious Processes
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#5250
opened Oct 24, 2025 by
Samirbous
Loading…
[New Rule][Deprecation] AWS EC2 Export Task Rules
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Deprecation
removal of a rule
Rule: New
Proposal for new rule
Team: TRADE
#5248
opened Oct 24, 2025 by
imays11
Loading…
[Rule Tuning] AWS EC2 Full Network Packet Capture Detected
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5244
opened Oct 23, 2025 by
imays11
Loading…
[New Rule] Okta Multiple OS Names Detected for a Single DT Hash
Domain: Identity
Integration: Okta
okta related rules
Rule: New
Proposal for new rule
#5241
opened Oct 22, 2025 by
terrancedejesus
•
Draft
5 tasks
ProTip!
Add no:assignee to see everything that’s not assigned.