Pull requests: elastic/detection-rules
Pull requests list
[New Rule] Potential DHCP Starvation via High Client MAC Cardinality
backport: auto
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#6355
opened Jun 29, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] Entra ID Device Registration with Phishing Kit Default OS Build
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6354
opened Jun 29, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Deprecated TLS Version or Weak Cipher Negotiated Externally
backport: auto
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#6353
opened Jun 29, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] Potential ICMP Tunneling Activity to the Internet
backport: auto
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#6352
opened Jun 29, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] ICMP Redirect Message from Internal Host
backport: auto
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#6351
opened Jun 29, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] Entra ID Multiple Device Registrations by a Single User
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6350
opened Jun 29, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] ICMP Timestamp or Information Request from the Internet
backport: auto
Domain: Network
Integration: Network Traffic
Rule: New
Proposal for new rule
#6349
opened Jun 29, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rule] AWS IAM User Console Login from Multiple Geolocations
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6348
opened Jun 29, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6347
opened Jun 29, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS ECR Repository or Registry Policy Granted Public Access
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6342
opened Jun 29, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[FR] Allow filter-only KQL and Indicator Match rules
backport: auto
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
Team: TRADE
#6334
opened Jun 26, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New] Protected Storage Service Access via SMB
backport: auto
Domain: Endpoint
Integration: Windows
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6333
opened Jun 26, 2026 by
Samirbous
Contributor
Loading…
[Rule Tuning] Persistence via Suspicious Launch Agent or Launch Daemon
backport: auto
Domain: Endpoint
OS: macOS
Rule: Tuning
tweaking or tuning an existing rule
#6332
opened Jun 25, 2026 by
Mikaayenson
Contributor
Loading…
[Rule Tuning] Multiple Remote Management Tool Vendors on Same Host
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6331
opened Jun 24, 2026 by
w0rk3r
Contributor
Loading…
[New Rule] Potential SSH Reverse Port Forwarding
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6330
opened Jun 24, 2026 by
w0rk3r
Contributor
Loading…
[Rule Tuning] Migrate Phase 1 vendor fields to ECS and trim non-ecs schema
patch
Rule: Tuning
tweaking or tuning an existing rule
schema
#6328
opened Jun 23, 2026 by
Mikaayenson
Contributor
•
Draft
3 of 5 tasks
[Rule Tuning] First Time Seen Remote Monitoring and Management Tool
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#6326
opened Jun 23, 2026 by
w0rk3r
Contributor
Loading…
[New Rule] Entra ID Potential Conditional Access MFA Bypass via First-Party Microsoft Graph Access
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6325
opened Jun 22, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] AWS Backup Monitoring or Audit Controls Disabled
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6315
opened Jun 19, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS Backup Recovery Point Lifecycle Modified
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6314
opened Jun 19, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS Backup Vault Access Policy Modified or Deleted
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6313
opened Jun 19, 2026 by
bryans3c
Contributor
Loading…
5 tasks
ProTip!
Filter pull requests by the default branch with base:main.