Pull requests: elastic/detection-rules
Pull requests list
WIP - KQL non-quoted spaces parsing support
bug
Something isn't working
patch
#6388
opened Jul 6, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[New Rule] AWS Bedrock API Key Used for Destructive or Anti-Recovery Action
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6386
opened Jul 6, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS Bedrock API Key Phantom User Activity Outside Bedrock
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6385
opened Jul 6, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[New Rule] AWS IAM Credentials Added to a Bedrock API Key Phantom User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
#6384
opened Jul 6, 2026 by
bryans3c
Contributor
Loading…
5 tasks
[Rule Tuning] Microsoft Graph Request Email Access by Unusual User and Client
backport: auto
Domain: Cloud
Domain: Web
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#6378
opened Jul 2, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Entra ID / M365 - Unusual ROPC Auth and/or Legacy Clients
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Integration: Microsoft 365
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#6377
opened Jul 2, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] AWS Bedrock AgentCore Gateway Repeated Tool Invocation Failures
backport: auto
community
#6368
opened Jul 1, 2026 by
eeee2345
Loading…
WIP - Initial MITRE v19 Support
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
#6367
opened Jul 1, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[New Rule] Microsoft Defender XDR Promotion Rules
backport: auto
bbr
Building Block Rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#6360
opened Jun 30, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Entra ID AiTM Phishing-Kit Chain Detected
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6359
opened Jun 30, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[Rule Tuning] Entra ID OAuth Device Code Phishing via AiTM
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#6358
opened Jun 30, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Entra ID Device Registration with Phishing Kit Default OS Build
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6354
opened Jun 29, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Entra ID Multiple Device Registrations by a Single User
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6350
opened Jun 29, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] AWS Bedrock Agent Credential Exfiltration Pattern in Invocation Content
backport: auto
community
#6336
opened Jun 28, 2026 by
eeee2345
Loading…
[Rule Tuning] Migrate Phase 1 vendor fields to ECS and trim non-ecs schema
patch
Rule: Tuning
tweaking or tuning an existing rule
schema
#6328
opened Jun 23, 2026 by
Mikaayenson
Contributor
•
Draft
3 of 5 tasks
[New Rule] Entra ID Potential Conditional Access MFA Bypass via First-Party Microsoft Graph Access
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6325
opened Jun 22, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Command Interpreter Spawned by Obsidian
backport: auto
community
#6317
opened Jun 20, 2026 by
Aryu-RU
Loading…
5 of 6 tasks
[New Rule] AWS Backup Monitoring or Audit Controls Disabled
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] AWS Backup Recovery Point Lifecycle Modified
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] AWS Backup Vault Access Policy Modified or Deleted
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] AWS Backup Plan or Selection Deleted
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
[New Rule] Unusual Azure VM Extension Installed; Suspicious Child Process via Azure VM CustomScript Extension
backport: auto
Domain: Cloud
Domain: Endpoint
Integration: Azure
azure related rules
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#6277
opened Jun 15, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
ProTip!
no:milestone will show everything without a milestone.