Pull requests: elastic/detection-rules
Pull requests list
[New Rules] K8s to GKE Rule Conversions - part 1
backport: auto
Domain: Cloud
Integration: GCP
GCP related rules
Rule: New
Proposal for new rule
Team: TRADE
#6397
opened Jul 7, 2026 by
imays11
Contributor
Loading…
[Rule Tuning] Unusual Parent-Child Relationship
backport: auto
Domain: Endpoint
genai-tradecraft
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6394
opened Jul 6, 2026 by
Mikaayenson
Contributor
Loading…
Update Packetbeat ML detection rules to align with the migration to the network module
Rule: Tuning
tweaking or tuning an existing rule
#6389
opened Jul 6, 2026 by
sodhikirti07
Contributor
•
Draft
5 tasks
WIP - KQL non-quoted spaces parsing support
bug
Something isn't working
patch
#6388
opened Jul 6, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[New Rule] AWS Bedrock API Key Used for Destructive or Anti-Recovery Action
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6386
opened Jul 6, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS Bedrock API Key Phantom User Activity Outside Bedrock
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6385
opened Jul 6, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS IAM Credentials Added to a Bedrock API Key Phantom User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6384
opened Jul 6, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS Bedrock AgentCore Gateway Repeated Tool Invocation Failures
backport: auto
community
#6368
opened Jul 1, 2026 by
eeee2345
Loading…
WIP - Initial MITRE v19 Support
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
#6367
opened Jul 1, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[New Rule] Microsoft Defender XDR Promotion Rules
backport: auto
bbr
Building Block Rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#6360
opened Jun 30, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] AWS Bedrock Agent Credential Exfiltration Pattern in Invocation Content
backport: auto
community
#6336
opened Jun 28, 2026 by
eeee2345
Loading…
[Rule Tuning] Migrate Phase 1 vendor fields to ECS and trim non-ecs schema
patch
Rule: Tuning
tweaking or tuning an existing rule
schema
#6328
opened Jun 23, 2026 by
Mikaayenson
Contributor
•
Draft
3 of 5 tasks
[New Rule] Entra ID Potential Conditional Access MFA Bypass via First-Party Microsoft Graph Access
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6325
opened Jun 22, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Command Interpreter Spawned by Obsidian
backport: auto
community
#6317
opened Jun 20, 2026 by
Aryu-RU
Loading…
5 of 6 tasks
[New Rule] AWS Backup Monitoring or Audit Controls Disabled
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] AWS Backup Recovery Point Lifecycle Modified
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] AWS Backup Vault Access Policy Modified or Deleted
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] AWS Backup Plan or Selection Deleted
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] Unusual Azure VM Extension Installed; Suspicious Child Process via Azure VM CustomScript Extension
backport: auto
Domain: Cloud
Domain: Endpoint
Integration: Azure
azure related rules
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6277
opened Jun 15, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] PAN-OS GlobalProtect CVE-2026-0257 Authentication Bypass Detection
backport: auto
Domain: Network
integration: PANW
Rule: New
Proposal for new rule
#6273
opened Jun 12, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[New Rule] Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension
backport: auto
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#6272
opened Jun 12, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
ProTip!
Type g i on any issue or pull request to go back to the issue listing page.