Skip to content

Pull requests: elastic/detection-rules

New pull request New
96 Open 4,379 Closed
96 Open 4,379 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Update actions/checkout digest backport: auto community
#6551 opened Jul 31, 2026 by elastic-renovate-prod Bot Loading…
1 task
[Rule Tuning] Rewriting execution through perl rule due to impossible condition backport: auto community Domain: Endpoint OS: Linux
#6549 opened Jul 31, 2026 by litemars Contributor Loading…
[Rule Tuning] Wrong regex in the macOS c2 detection query backport: auto community Domain: Endpoint OS: macOS
#6548 opened Jul 30, 2026 by litemars Contributor Loading…
[Rule Tuning] Adding co-author in multiple rules backport: auto community Domain: Endpoint OS: Linux OS: macOS
#6547 opened Jul 30, 2026 by litemars Contributor Loading…
[New Rule] Cassandra JavaScript UDF Creation backport: auto Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#6543 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
9
[New Rule] Postgresql COPY PROGRAM Command Execution backport: auto Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#6542 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
12
[New Rule] MySQL User-Defined Function Injection backport: auto Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#6541 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
12
[New Rule] Destructive MongoDB Command backport: auto Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#6540 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
10
[New Rule] Certighost ADCS Detections
#6537 opened Jul 30, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
5
[New Rule] Potential NFS Destructive Operation Burst backport: auto Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#6536 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
16
[New Rule] NFS AUTH_SYS Root UID Access backport: auto Domain: Network Rule: New Proposal for new rule
#6535 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
6
[New Rule] First Time Seen Memcached Writer backport: auto Domain: Network Rule: New Proposal for new rule
#6534 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
9
[New Rule] Mark-of-the-Web Removal by an Unusual Process backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6533 opened Jul 30, 2026 by w0rk3r Contributor Loading…
@w0rk3r
7
[Bug] Edge case rule loading bugs backport: auto bug Something isn't working patch python Internal python for the repository
#6532 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
2
[Rule: Tuning] Fixing logic issue on the macOS rule for discovery external IP using curl backport: auto community Domain: Endpoint OS: macOS
#6530 opened Jul 30, 2026 by litemars Contributor Loading…
3
[Rule Tuning] Fixing Typo in the macOS persistence emond modification rule backport: auto community Domain: Endpoint OS: macOS
#6529 opened Jul 30, 2026 by litemars Contributor Loading…
5
[New Rule] Direct Process Execution via setsid, nohup, or disown backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#6526 opened Jul 30, 2026 by Aegrah Contributor Loading…
@Aegrah
10
[Rule Tuning] Suspicious Service was Installed in the System backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6523 opened Jul 29, 2026 by w0rk3r Contributor Loading…
@w0rk3r
5
[New Rule] First Time Seen RMM Signer Across the Environment backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6522 opened Jul 29, 2026 by w0rk3r Contributor • Draft
@w0rk3r
4
[Rule Tuning] Potential Timestomp in Executable Files backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6521 opened Jul 29, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
7
[Rule Tuning] Potential Data Exfiltration Through Curl backport: auto genai-tradecraft Rule: Tuning tweaking or tuning an existing rule
#6520 opened Jul 29, 2026 by Mikaayenson Contributor Loading…
@Aegrah
4
[Rule Tuning] Potential Computer Account NTLM Relay Activity backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6512 opened Jul 28, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
6
[Rule Tuning] Add Resources: LLM tag for ES|QL COMPLETION rules backport: auto python Internal python for the repository schema
#6506 opened Jul 27, 2026 by Mikaayenson Contributor Loading…
2 of 3 tasks
@Mikaayenson
5
[Bug] Fix import-rules error handling: KeyError on errors without rule_id; unread exceptions/connector error arrays community
#6504 opened Jul 27, 2026 by runicdefnd3r • Draft
1 task
1
Validate the field against the schema in KQL range expressions backport: auto community Domain: Endpoint OS: Windows windows related rules
#6502 opened Jul 27, 2026 by munzzyy Loading…
3
ProTip! Find all pull requests that aren't related to any open issues with -linked:issue.